joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b5f80
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret

Function at 0x1800b9bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 8], rax
xor eax, eax
lea r15, [0x180134d00]
mov dword [rsp + 1], eax
xor r8b, r8b
movzx r11d, byte [rsp + 4]
mov r14, rcx
movzx ebx, byte [rsp + 3]
mov rbp, rcx
movzx edi, byte [rsp + 2]
sub r14, r15
mov word [rsp + 5], ax
movzx r10d, al
movzx r9d, byte [rsp + 6]
movzx esi, al
nop dword [rax]
nop word [rax + rax]
lea rcx, [r14 + rax]
movzx edx, byte [rcx + r15]
movzx ecx, byte [rax + r15]
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
inc rax
or r9b, cl
cmp rax, 0x1f
jb 0x1800b9c60
movzx edx, byte [rax + rbp]
movzx ecx, byte [rax + r15]
and dl, 0x7f
xor cl, dl
or r8b, cl
movzx ecx, byte [rax + r15 + 0x20]
xor cl, dl
or sil, cl
movzx ecx, byte [rax + r15 + 0x40]
xor cl, dl
or dil, cl
movzx ecx, byte [rax + r15 + 0x60]
xor cl, dl
or bl, cl
movzx ecx, byte [rax + r15 + 0x80]
xor cl, dl
or r11b, cl
movzx ecx, byte [rax + r15 + 0xa0]
xor cl, dl
or r10b, cl
movzx ecx, byte [rax + r15 + 0xc0]
xor cl, dl
movzx eax, bl
dec eax
movzx edx, dil
or r9b, cl
dec edx
or edx, eax
movzx ecx, r9b
dec ecx
movzx eax, r11b
dec eax
or edx, eax
movzx eax, r10b
dec eax
or eax, edx
or eax, ecx
movzx ecx, sil
dec ecx
or eax, ecx
movzx ecx, r8b
dec ecx
or eax, ecx
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180107470
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret

Function at 0x1800bb0f0
Capabilities:
Encode data using add xor sub operations
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
lea r8, [0x180134e00]
sub rcx, r8
mov r10b, 1
mov r11d, reloc.WLDAP32.dll_Ordinal_32
lea rbx, [rcx + 0x20]
nop
movzx edx, byte [rbx + r8 - 1]
lea r8, [r8 - 1]
movzx ecx, byte [r8]
mov eax, edx
sub eax, ecx
xor edx, ecx
sar eax, 8
dec edx
and al, r10b
sar edx, 8
or r9b, al
and r10b, dl
add r11d, 0xffffffff
jne 0x1800bb110
mov rbx, qword [rsp + 8]
xor eax, eax
test r9b, r9b
setne al
ret
Function at 0x1800bc090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x1800bc0a0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x1800bc0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx ecx, byte [rcx + rax]
inc rax
xor ecx, edx
or dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x1800bc0e0
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret
Function at 0x1800c3520
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800c3581
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1800c357b
shr ax, 8
cmp al, 2
jne 0x1800c357b
call fcn.1800ce4a0
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180107470
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180107470
add rsp, 0x1d8
ret
Function at 0x1800d5db0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x739], 0
mov r14, r9
mov rax, qword [rsp + 0x130]
mov rbp, r8
mov esi, edx
mov rdi, rcx
je 0x1800d5ef8
test rax, rax
je 0x1800d5ef8
mov rdx, qword [rax + 0xd8]
test rdx, rdx
je 0x1800d5ef8
mov ecx, esi
lea r9, str.Data
sub ecx, 1
je 0x1800d5e3b
sub ecx, 1
je 0x1800d5e2b
sub ecx, 1
je 0x1800d5e42
cmp ecx, 1
je 0x1800d5e32
jmp 0x1800d5ef8
lea r9, str.Header
lea rax, [0x18015a4d8]
jmp 0x1800d5e49
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
mov edx, 0xa0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.1800e3240
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800d5e72
cmp qword [rdi + 0x2b8], 0
je 0x1800d5ec2
mov dl, 1
mov rcx, rdi
call fcn.1800c6110
mov rax, qword [rdi + 0x208]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x2b8]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1800c6110
test ebx, ebx
je 0x1800d5ef8
mov eax, ebx
jmp 0x1800d5f08
mov r9, qword [rdi + 0x200]
lea rcx, [0x180136970]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.180115cb8
mov r9, qword [rdi + 0x200]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call fcn.180115cb8
mov r9, r14
mov r8, rbp
mov edx, esi
mov rcx, rdi
call fcn.1800d6b10
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180107470
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800d6220
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800d625b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800d65b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor eax, eax
mov rdi, r9
cmp rdx, qword [rcx + 0x240]
mov rsi, r8
mov r14, rcx
sete al
mov edx, eax
mov rbx, qword [rcx + rdx*8 + 0x238]
call fcn.1800d6a10
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
cmp rdi, 0xffffffffffffffff
jne 0x1800d6650
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1800d6624
mov rcx, qword [rsp + 0x50]
lea eax, [rdi + 0x52]
mov qword [rcx], 0
jmp 0x1800d665a
mov edx, ebx
mov rcx, r14
call fcn.1800e6010
mov rcx, qword [r14]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1800d5f30
mov rax, qword [r14]
mov dword [rax + 0x4c94], ebx
mov eax, gethostname
jmp 0x1800d6652
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800d6a10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movsxd rcx, edx
mov rax, qword [rsi + 0x3f0]
lea rbx, [rcx + 0x14]
mov rbp, qword [rsi + rcx*8 + 0x238]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1800d6aec
lea rax, [0x1800d62a0]
cmp qword [rsi + rcx*8 + 0x260], rax
jne 0x1800d6aec
cmp qword [rbx], 0
je 0x1800d6a76
test rdi, rdi
je 0x1800d6aec
or r8, 0xffffffffffffffff
xor r9d, r9d
or rdx, r8
mov rcx, rbp
call fcn.1800d59d0
cmp eax, 0xffffffff
je 0x1800d6aec
test al, 1
je 0x1800d6aec
cmp qword [rbx], 0
jne 0x1800d6acb
mov rax, qword [rsi]
mov ecx, dword [rax + 0x6f8]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [fcn.180115264]
mov rdi, qword [rbx + 8]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
test rax, rax
jne 0x1800d6acb
mov qword [rbx + 8], rcx
jmp 0x1800d6aec
mov rdx, qword [rbx]
xor r9d, r9d
add rdx, qword [rbx + 0x10]
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1800d6aec
add qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800d6b10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x2b8], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1800d6b6e
mov dl, 1
call fcn.1800c6110
mov rax, qword [rdi + 0x208]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x2b8]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1800c6110
mov eax, ebx
jmp 0x1800d6bb0
cmp ebx, 2
ja 0x1800d6bae
mov r9, qword [rdi + 0x200]
lea rdx, [0x180136970]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.180115cb8
mov r9, qword [rdi + 0x200]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.180115cb8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800d6ce0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2c0], 0
je 0x1800d6cfd
call fcn.1800cefc0
test eax, eax
jne 0x1800d6d28
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x238]
cmp rcx, 0xffffffffffffffff
je 0x1800d6cf6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x1800d6d28
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
Function at 0x1800d7720
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
lea r9, [rsp + 0x40]
mov rax, rdx
mov dword [rsp + 0x40], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rdi, rcx
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1800d778b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
call fcn.1800e6010
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
call fcn.1800d6030
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.1800d6030
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800d78c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x140
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0xbc], 2
mov rbx, rdx
mov rbp, qword [rcx]
mov rsi, rcx
je 0x1800d7aa9
cmp byte [rcx + 0x3aa], 0
mov qword [rsp + 0x170], rdi
jne 0x1800d7a99
cmp byte [rcx + 0x3c6], 0
jne 0x1800d7a99
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1800d7963
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rsi
mov ebx, eax
call fcn.1800e6010
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rbp
call fcn.1800d5f30
jmp 0x1800d7aa1
xor edx, edx
mov dword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rcx, [rsp + 0x30]
call fcn.18010a4e0
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1800d79c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rsi
mov ebx, eax
call fcn.1800e6010
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rbp
call fcn.1800d5f30
jmp 0x1800d7aa1
lea rbx, [rsi + 0x186]
mov rdx, rbx
lea r8, [rsi + 0x1b4]
lea rcx, [rsp + 0xb0]
call fcn.1800d6f00
test al, al
jne 0x1800d7a16
call fcn.18010c27c
mov rbx, rax
call fcn.18010c27c
mov edx, dword [rbx]
mov rcx, rsi
mov rdi, rax
call fcn.1800e6010
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.1800d5f30
jmp 0x1800d7aa1
movups xmm0, xmmword [rbx]
mov eax, dword [rbx + 0x28]
lea r8, [rsi + 0x1e8]
movups xmm1, xmmword [rbx + 0x10]
lea rdx, [rsi + 0x1b8]
movups xmmword [rsi + 0x88], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rbx + 0x20]
movups xmmword [rsi + 0x98], xmm1
movsd qword [rsi + 0xa8], xmm0
mov dword [rsi + 0xb0], eax
movzx eax, word [rbx + 0x2c]
mov word [rsi + 0xb4], ax
call fcn.1800d6f00
test al, al
jne 0x1800d7a99
call fcn.18010c27c
mov rbx, rax
call fcn.18010c27c
mov edx, dword [rbx]
mov rcx, rsi
mov rdi, rax
call fcn.1800e6010
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.1800d5f30
jmp 0x1800d7aa1
mov rcx, rsi
call fcn.1800d7470
mov rdi, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180107470
add rsp, 0x140
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d8310
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0x99c], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1800d837f
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, rbx
call fcn.1800d6030
jmp 0x1800d840e
mov ecx, dword [rbx + 0x9a0]
mov dword [rsp + 0x58], 1
call fcn.1800d8610
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0x9a4]
call fcn.1800d8610
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, ntohl
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1800d840e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r9d, eax
mov rcx, rbx
call fcn.1800d6030
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800d85d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.18011e2cc
cdqe
add rsp, 0x28
ret
Function at 0x1800e5270
Capabilities:
Resolve dns

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r9
mov qword [r9], r13
mov ebx, r13d
lea r9, [rsp + 0x68]
mov r15d, r13d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x1800e5434
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
test rsi, rsi
je 0x1800e5414
mov qword [rsp + 0x50], rbp
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1800e52cd
lea ebp, [rax + 0xe]
jmp 0x1800e52d9
cmp eax, 0x17
jne 0x1800e5381
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], r13
je 0x1800e5381
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1800e5381
cmp rax, rbp
jb 0x1800e5381
mov ecx, Ordinal_50
call qword [fcn.180115264]
mov rdi, rax
test rax, rax
je 0x1800e53bc
mov ecx, dword [rsi]
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
mov rcx, rbp
mov dword [rax + 0x10], ebp
mov qword [rax + 0x20], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
call qword [fcn.180115264]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1800e53ab
mov rdx, qword [rsi + 0x20]
mov r8, rbp
mov rcx, rax
call fcn.180109e10
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1800e536e
call qword [case.0x1800ca7a6.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1800e5390
test rbx, rbx
cmove rbx, rdi
test r15, r15
je 0x1800e537e
mov qword [r15 + 0x28], rdi
mov r15, rdi
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1800e52c0
jmp 0x1800e53c2
mov rcx, qword [rdi + 0x20]
mov r14d, 8
call qword [fcn.180112a30]
mov rcx, rdi
call qword [fcn.180112a30]
jmp 0x1800e53c2
mov rcx, rdi
mov r14d, 8
call qword [fcn.180112a30]
jmp 0x1800e53c2
mov r14d, 8
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
test rcx, rcx
je 0x1800e53d7
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x1800e540f
test rbx, rbx
je 0x1800e540a
mov rcx, qword [rbx + 0x20]
call qword [fcn.180112a30]
mov rcx, qword [rbx + 0x18]
call qword [fcn.180112a30]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [fcn.180112a30]
mov rbx, rdi
test rdi, rdi
jne 0x1800e53e1
mov rbx, r13
jmp 0x1800e5423
test rbx, rbx
jne 0x1800e5423
mov r14d, 0x2af9
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r14d
mov rsi, qword [rsp + 0x58]
mov qword [r12], rbx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x1800e6fc0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x18013a9f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1800e6fea
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18013aa18]
mov rcx, rbx
mov r14, rax
call fcn.1801197a8
test rax, rax
je 0x1800e704d
mov rcx, rbx
test r14, r14
je 0x1800e7037
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1800e7085
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800e7085
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1800e7148
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1800e70b0
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.180115264]
mov rdi, rax
test rax, rax
je 0x1800e713a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800e713a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1800e70e0
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x1800e70f4
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1800e7110
mov rcx, rdi
test r14, r14
je 0x1800e7131
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1800e7137
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.180112a30]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x1800e9720
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.180119e8c
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1800e9786
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1800e9786
lea rcx, [rsp + 0x20]
call qword [case.0x1800ca7a6.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180107470
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180107470
add rsp, 0x148
ret
jmp 0x1800e9720
Function at 0x1800e97a0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.180119e8c
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1800e9786
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1800e9786
lea rcx, [rsp + 0x20]
call qword [case.0x1800ca7a6.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180107470
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180107470
add rsp, 0x148
ret
jmp 0x1800e9720

Function at 0x1800ec390
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rcx + 0x240]
lea r8, [rsp + 0x20]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x20], 0x80
mov rcx, rbp
or rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1800ec407
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.1800d6bd0
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x1800ec42c
lea rdx, str.Error_accept__ing_server_connect
call fcn.1800d5f30
lea eax, [rbx + 0x1f]
jmp 0x1800ec4a5
lea rdx, str.Connection_accepted_from_server_n
call fcn.1800d6030
mov byte [rdi + 0x3b4], 0
mov edx, 1
mov rcx, rbx
mov qword [rdi + 0x240], rbx
call fcn.1800fd310
mov byte [rdi + 0x259], 1
cmp qword [rsi + 0x2c8], 0
je 0x1800ec4a3
mov dl, 1
mov rcx, rsi
call fcn.1800c6110
mov rcx, qword [rsi + 0x2d0]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x2c8]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.1800c6110
test ebx, ebx
je 0x1800ec4a3
mov rcx, rdi
call fcn.1800ec9f0
mov eax, Ordinal_46
jmp 0x1800ec4a5
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800ed650
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x7e2], 0
lea r9, [rcx + 0x750]
mov rbx, rcx
jne 0x1800ed6fc
xor edx, edx
mov dword [r9 + 0xb4], edx
mov rax, qword [rcx]
mov ecx, edx
cmp dword [rax + 0x724], 2
sete cl
mov dword [r9 + 0xb8], ecx
mov rax, qword [rbx]
cmp dword [rax + 0x720], 2
jne 0x1800ed6a1
cmp dword [r9 + 0x94], edx
je 0x1800ed6f9
cmp byte [rbx + 0x3aa], dl
je 0x1800ed6bb
mov r8, qword [r9 + 0x70]
test r8, r8
je 0x1800ed6bb
mov dword [r9 + 0x94], edx
jmp 0x1800ed6d6
cmp dword [r9 + 0x80], edx
je 0x1800ed6f9
mov r8, qword [r9 + 0x78]
mov dword [r9 + 0x94], 1
mov r8, qword [r8]
lea rdx, str.CWD__s
mov rcx, r9
call fcn.180101c80
test eax, eax
jne 0x1800ed706
mov dword [rbx + 0x80c], 0x10
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800edaf0
add rsp, 0x20
pop rbx
ret