joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180204dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
push r14
sub rsp, 0x38
mov r14, qword [rcx + 0x98]
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
mov r12, qword [rcx]
test r14, r14
je 0x180204fc2
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r13
xor r13d, r13d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x60], rbp
nop dword [rax]
movsxd rsi, dword [r14 + 0x10]
movzx eax, byte [rdi + 0x1f]
mov r15d, dword [r14 + 0x14]
shl rsi, 5
add rsi, qword [r12 + 0x20]
test al, al
jne 0x180204e21
inc dword [rdi + 0x38]
mov ebp, dword [rdi + 0x38]
jmp 0x180204e30
dec al
movzx eax, al
mov byte [rdi + 0x1f], al
mov ebp, dword [rdi + rax*4 + 0xd4]
movsxd rcx, dword [rbx + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rbx + 0x94], ecx
jg 0x180204e5d
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rbx
call fcn.18021bc70
jmp 0x180204e8b
lea eax, [rcx + 1]
mov dword [rbx + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rbx + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rsi + 0x18]
xor edx, edx
mov r8d, dword [r14 + 0x10]
mov rcx, rdi
mov dword [rsp + 0x20], 0x61
mov r9, qword [r9 + 0x68]
call fcn.1802518a0
mov eax, dword [rbx + 0x90]
add eax, 5
cmp eax, dword [rbx + 0x94]
jle 0x180204ecf
mov edx, 5
mov rcx, rbx
call fcn.18021bce0
test eax, eax
jne 0x180204fae
movsxd rax, dword [rbx + 0x90]
lea r8, [0x1800676aa]
mov r10d, 5
lea r11, [0x180068530]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x88]
lea rax, [rax + rcx*8]
mov r9, rax
nop dword [rax]
movzx ecx, byte [r8 - 2]
mov byte [rax], cl
movsx ecx, byte [r8 - 1]
mov dword [rax + 4], ecx
movsx edx, byte [r8]
mov dword [rax + 8], edx
movzx ecx, byte [r8 - 2]
test byte [rcx + r11], 1
je 0x180204f30
cmp byte [r8], r13b
jle 0x180204f30
add edx, dword [rbx + 0x90]
mov dword [rax + 8], edx
movsx ecx, byte [r8 + 1]
add r8, 4
mov dword [rax + 0xc], ecx
mov byte [rax + 1], r13b
mov qword [rax + 0x10], r13
mov word [rax + 2], r13w
add rax, 0x18
sub r10, 1
jne 0x180204f00
add dword [rbx + 0x90], 5
test r9, r9
je 0x180204fae
mov dword [r9 + 0x3c], ebp
lea ecx, [r15 + 1]
mov dword [r9 + 4], ecx
lea eax, [r15 - 1]
mov dword [r9 + 0x34], eax
mov eax, 8
mov word [r9 + 0x4a], ax
mov dword [r9 + 0x20], ecx
mov dword [r9 + 0x50], ebp
mov dword [r9 + 0x54], ecx
test ebp, ebp
je 0x180204fa2
movzx eax, byte [rdi + 0x1f]
cmp al, 8
jae 0x180204fa2
movzx eax, al
mov dword [rdi + rax*4 + 0xd4], ebp
inc byte [rdi + 0x1f]
mov r14, qword [r14]
test r14, r14
jne 0x180204e00
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x180213a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
sub rsp, 0x28
movzx eax, byte [rdx]
mov rbx, rdx
mov rbp, rcx
cmp al, 0xad
jne 0x180213aa8
movzx eax, byte [rdx + 2]
cmp al, 0xae
jne 0x180213ab4
mov rax, qword [rdx + 0x20]
mov ecx, dword [rax]
jmp 0x180213ac6
cmp al, 0x88
jne 0x180213b63
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x20]
mov ecx, dword [rcx]
cmp ecx, 1
je 0x180213b63
mov qword [rsp + 0x48], rdi
xor edi, edi
mov dword [r8], edi
cmp byte [rdx], 0x88
jne 0x180213af1
mov rcx, rbp
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
pop rbp
pop rbx
jmp fcn.180239720
mov eax, dword [rbp + 0x38]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], r15
movsxd r14, ecx
lea r15d, [rax + 1]
add eax, ecx
mov dword [rbp + 0x38], eax
test ecx, ecx
jle 0x180213b5e
mov qword [rsp + 0x40], rsi
mov esi, r15d
nop word [rax + rax]
mov rdx, qword [rbx + 0x20]
mov r8d, esi
mov rcx, rbp
mov rdx, qword [rdx + rdi + 8]
call fcn.180240490
inc esi
lea rdi, [rdi + 0x20]
sub r14, 1
jne 0x180213b20
mov rsi, qword [rsp + 0x40]
mov eax, r15d
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
pop rbp
pop rbx
ret
mov eax, r15d
jmp 0x180213b48
mov rcx, rbp
add rsp, 0x28
pop rbp
pop rbx
jmp fcn.180243170
Function at 0x18022ac70
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rsp + 0x20], ebx
mov r9, rdx
mov rsi, rcx
lea rdx, [0x18006f800]
call fcn.180251520
test ebx, ebx
jne 0x18022acb4
mov r8, rdi
lea rdx, [0x18006f8b0]
mov rcx, rsi
call fcn.180251520
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180233570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov r14, rcx
mov r15, qword [rcx]
mov rbx, qword [rcx + 0x10]
test rsi, rsi
je 0x180233728
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x30], r13
lea r13, [0x180068530]
nop dword [rax]
nop word [rax + rax]
movsxd r8, dword [rsi + 0x10]
xor edx, edx
mov rax, qword [r15 + 0x20]
mov r9, r8
mov edi, dword [rsi + 0x14]
mov rcx, r14
shl r9, 5
mov dword [rsp + 0x20], 0x60
mov r9, qword [r9 + rax + 0x18]
mov r9, qword [r9 + 0x68]
call fcn.1802518a0
mov r8, qword [rsi + 8]
lea ebp, [rdi - 1]
mov edx, ebp
mov rcx, rbx
mov r8, qword [r8]
call fcn.18026fb70
mov eax, dword [rbx + 0x90]
add eax, 0xc
cmp eax, dword [rbx + 0x94]
jle 0x180233627
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, rbx
call fcn.18021bce0
test eax, eax
jne 0x180233714
movsxd rax, dword [rbx + 0x90]
lea r8, [0x180067eba]
mov r10d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x88]
lea rax, [rax + rcx*8]
mov r9, rax
nop dword [rax]
movzx ecx, byte [r8 - 2]
mov byte [rax], cl
movsx ecx, byte [r8 - 1]
mov dword [rax + 4], ecx
movsx edx, byte [r8]
mov dword [rax + 8], edx
movzx ecx, byte [r8 - 2]
test byte [rcx + r13], 1
je 0x180233680
cmp byte [r8], r12b
jle 0x180233680
add edx, dword [rbx + 0x90]
mov dword [rax + 8], edx
movsx ecx, byte [r8 + 1]
add r8, 4
mov dword [rax + 0xc], ecx
mov byte [rax + 1], r12b
mov qword [rax + 0x10], r12
mov word [rax + 2], r12w
add rax, 0x18
sub r10, 1
jne 0x180233650
add dword [rbx + 0x90], 0xc
test r9, r9
je 0x180233714
mov eax, reloc.WSOCK32.dll_recv
mov dword [r9 + 8], edi
mov word [r9 + 0x4a], ax
lea ecx, [rdi + 2]
lea eax, [rdi + 1]
mov dword [r9 + 0xc], ecx
mov dword [r9 + 0x68], eax
mov dword [r9 + 0x3c], edi
mov dword [r9 + 0x4c], ebp
mov dword [r9 + 0x54], edi
mov dword [r9 + 0x84], edi
mov dword [r9 + 0x94], edi
mov dword [r9 + 0xb0], ecx
mov dword [r9 + 0xac], edi
mov dword [r9 + 0xf8], edi
cmp dword [r14 + 0x34], r12d
jne 0x180233708
mov dword [r14 + 0x34], 1
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1802335c0
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
Function at 0x180245fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x1802460d9
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, [0x18006c890]
mov qword [rsp + 0x20], r15
lea r15, [0x180068430]
nop
mov r9d, ebx
cmp ebx, 2
jge 0x18024601c
xor r9d, 1
mov rax, qword [rsi + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x180246051
mov r8, qword [rcx + rax]
mov r10, rdi
sub r10, r8
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx eax, byte [r10 + r8]
cmp ecx, eax
jne 0x18024608c
test ecx, ecx
jne 0x18024609a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.180215ab0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x180246070
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x180246010
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x18024609f
inc r8
jmp 0x180246040
test r9d, r9d
jne 0x180246069
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x1802460c5
test edx, edx
je 0x180246051
inc rax
jmp 0x1802460b0
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x180246069
inc rax
jmp 0x1802460b0
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1802728e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x38]
xor ebx, ebx
mov r14, qword [rcx + 0x40]
mov r15, r9
mov ebp, r8d
mov r13, rdx
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jne 0x180272978
movzx eax, word [r14 + 6]
imul ecx, eax, 0x38
mov rax, qword [r14 + 0x10]
add ecx, 0x50
test rax, rax
je 0x18027293a
mov edx, ecx
mov rcx, rax
call fcn.18023cbb0
jmp 0x18027293f
call fcn.180250dc0
mov rdi, rax
test rax, rax
jne 0x18027294c
mov rdi, rbx
jmp 0x180272963
lea rax, [rdi + 0x18]
mov qword [rdi], r14
mov qword [rdi + 8], rax
movzx eax, word [r14 + 6]
inc ax
mov word [rdi + 0x10], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x180272974
lea eax, [rdi + 7]
jmp 0x1802729fa
mov word [rdi + 0x10], bp
cmp byte [rsi + 0x58], bl
je 0x1802729b2
cmp byte [rsi + 0x59], bl
je 0x180272990
mov rax, qword [rsi + 0x10]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x1802729ba
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov r8, qword [rax + 0x28]
add rax, 0x14
jmp 0x1802729ba
mov rax, qword [rsi + 0x38]
lea r8, [rax + 0x10]
mov edx, dword [rax]
mov r9, rdi
mov rcx, r14
call fcn.1802721e0
test ebp, ebp
jle 0x1802729e2
mov rax, qword [rdi + 8]
add rax, 8
test byte [rax], 1
jne 0x180272a19
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x1802729d3
mov rdx, qword [r13 + 0x10]
xor r9d, r9d
mov ecx, dword [r13 + 0xc]
mov r8, rdi
call fcn.180271a30
mov dword [r15], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
mov dword [r15], 0xffffffff
jmp 0x1802729f8
Function at 0x1802838a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x1802838fd
mov rcx, qword [rcx]
call fcn.180285980
mov ecx, eax
test eax, eax
jne 0x18028391b
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x28], xmm0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x1802838e6
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x180283880]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.180261040
call fcn.180283560
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x18028391b
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
Function at 0x1802a0e40
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rsi, qword [rsp + 0x4b0]
test r8, r8
mov rdi, r9
mov rbx, rcx
lea r9, [0x1800935b8]
mov rax, r9
lea rcx, [0x180092bb0]
cmovne rax, r8
cmovne r9, rcx
mov r8, rdx
mov qword [rsp + 0x20], rax
lea rdx, [0x180073198]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1802a0f1d
test rdi, rdi
je 0x1802a0f0b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
inc eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1802a0f1f
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x470
pop rdi
pop rsi
pop rbx
ret

Function at 0x1802a1350
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov rbx, qword [rcx + 0x10]
test rbx, rbx
je 0x1802a13d1
mov edx, 8
lea r8d, [rdx + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x1802a13b2
lea rcx, [0x180073560]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [rsp + 0x40], 1
lea rdx, [0x1803f6360]
lea rcx, [rsp + 0x40]
call fcn.1802c76f0
int3
mov qword [rax + 8], rbx
mov qword [rsp + 0x50], rax
lea rdx, [0x180073540]
mov qword [rax], rdx
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
jmp 0x1802a1417
mov ecx, 0x20
call fcn.1802b8484
test rax, rax
jne 0x1802a13fa
mov dword [rsp + 0x40], 1
lea rdx, [0x1803f6360]
lea rcx, [rsp + 0x40]
call fcn.1802c76f0
int3
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rdx, [0x180073540]
mov qword [rax], rdx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1802a2460
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
dec rcx
mov r9d, edx
test edx, edx
je 0x1802a24a7
lea r10, [0x1803fbf10]
nop dword [rax]
nop dword [rax + rax]
movsx rdx, byte [rcx + 1]
lea rcx, [rcx + 1]
movzx eax, r8w
xor rdx, rax
shr r8w, 8
movzx eax, dl
movzx eax, word [r10 + rax*4]
xor r8w, ax
sub r9d, 1
jne 0x1802a2480
cmp r8w, 0xa
lea eax, [r8 + 0x39]
cmovae ax, r8w
ret
Function at 0x1802a2610
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
xor edx, edx
mov qword [rcx], rdx
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov word [rcx + 0x48], dx
mov qword [rcx + 0x60], rax
mov qword [rcx + 0x68], rax
mov dword [rcx + 0x70], eax
ret
Function at 0x1802a61d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x1802a6340
mov r11, rsp
push rsi
push r14
sub rsp, 0x78
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx], 0
mov r14d, edx
mov rsi, rcx
je 0x1802a632c
lea rax, [rcx + 1]
movzx ecx, byte [rcx + 1]
test cl, cl
je 0x1802a632c
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r15
xor r15d, r15d
mov qword [r11 - 0x18], rbp
cmp byte [rsi], 0x26
jne 0x1802a6302
cmp cl, 0x23
jne 0x1802a6302
movsx ecx, byte [rsi + 2]
lea rbx, [rsi + 2]
call fcn.1802d54bc
test eax, eax
je 0x1802a6260
nop word [rax + rax]
movsx ecx, byte [rbx + 1]
inc rbx
call fcn.1802d54bc
test eax, eax
jne 0x1802a6250
cmp byte [rbx], 0x3b
lea rdi, [rbx + 1]
lea rcx, [rsi + 2]
cmovne rdi, rbx
call fcn.1802d6ec0
mov word [rsp + 0x40], ax
lea r8, [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], rax
mov r9d, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 8
xor edx, edx
mov ecx, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x48]
mov rdx, rsi
sub rdx, rcx
lea rax, [rsp + 0x48]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1802a62c2
lea rcx, [rsp + 0x48]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1802a62e0
add rsi, rax
mov rcx, rsi
nop
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
mov byte [rcx], al
inc rcx
test al, al
jne 0x1802a62f0
jmp 0x1802a6305
mov rsi, rax
movzx ecx, byte [rsi + 1]
lea rax, [rsi + 1]
test cl, cl
jne 0x1802a6224
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x78
pop r14
pop rsi
ret
Function at 0x1802aa560
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r10, r8
mov rsi, rdx
mov r14, rcx
test rcx, rcx
je 0x1802aa7e1
test r8, r8
je 0x1802aa7e1
mov r15, qword [rsp + 0xa0]
test r15, r15
je 0x1802aa7e1
lea rcx, [rdx + 2]
movabs r13, 0xaaaaaaaaaaaaaaab
mov rax, r13
mul rcx
mov r8, rdx
shr r8, 1
shl r8, 2
lea rcx, [r8 + r8]
movabs rax, 0xd79435e50d79435f
mul rcx
shr rdx, 6
lea rax, [r8 + 2]
add rax, rdx
cmp r9, rax
jae 0x1802aa5f7
or eax, 0xffffffff
jmp 0x1802aa7e8
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], r9
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r11d, r11d
lea r12, [0x180074bc0]
mov qword [rsp + 0x38], r11
mov rax, r13
mul rsi
shr rdx, 1
cmp r11, rdx
jae 0x1802aa6f9
movzx ecx, byte [rdi + r14]
inc rdi
mov qword [rsp + 0x30], rdi
movzx r8d, byte [rdi + r14]
inc rdi
mov qword [rsp + 0x30], rdi
movzx edx, byte [rdi + r14]
inc rdi
mov qword [rsp + 0x30], rdi
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
and ecx, 3
shl ecx, 4
mov eax, r8d
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
and r8d, 0xf
shl r8d, 2
mov ecx, r8d
mov eax, edx
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
add ebx, 4
mov dword [rsp + 0x20], ebx
cmp ebx, 0x49
jl 0x1802aa6f1
mov byte [r9 + r10], recv
inc r9
mov qword [rsp + 0x28], r9
mov byte [r9 + r10], 0xa
inc r9
mov qword [rsp + 0x28], r9
xor ebx, ebx
mov dword [rsp + 0x20], ebx
inc r11
jmp 0x1802aa616
lea rax, [rdx + rdx*2]
sub rsi, rax
je 0x1802aa7bd
sub rsi, 1
je 0x1802aa770
cmp rsi, 1
jne 0x1802aa7d7
movzx ecx, byte [rdi + r14]
inc rdi
mov qword [rsp + 0x30], rdi
movzx edx, byte [rdi + r14]
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
and ecx, 3
shl ecx, 4
mov eax, edx
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
and edx, 0xf
shl edx, 2
movzx eax, byte [rdx + r12]
mov byte [r9 + r10], al
jmp 0x1802aa7a8
movzx ecx, byte [rdi + r14]
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
and ecx, 3
shl ecx, 4
movzx eax, byte [rcx + r12]
mov byte [r9 + r10], al
inc r9
mov qword [rsp + 0x28], r9
mov byte [r9 + r10], 0x3d
inc r9
mov qword [rsp + 0x28], r9
mov byte [r9 + r10], 0x3d
inc r9
mov qword [rsp + 0x28], r9
mov byte [r9 + r10], recv
inc r9
mov qword [rsp + 0x28], r9
mov byte [r9 + r10], 0xa
inc r9
mov qword [rsp + 0x28], r9
mov byte [r9 + r10], 0
mov qword [r15], r9
jmp 0x1802aa7e6
or eax, 0xffffffff
jmp 0x1802aa7e8
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1802ab5b0
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rdx
mov dword [rsp + 0x58], r8d
mov r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1802c7550
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1802ab5e6
test rax, rax
jne 0x1802ab601
movabs rax, 0x746c7561666564
mov qword [rbx], rax
add rsp, 0x30
pop rbx
ret

Function at 0x1802afdc0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r12d, r9d
mov r15, r8
mov rdi, rdx
mov r13, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x2e8]
mov qword [rsp + 0x48], r14
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp dword [rcx], ebx
je 0x1802aff13
test rdx, rdx
je 0x1802aff13
test r8, r8
je 0x1802aff13
test r13, r13
je 0x1802aff13
mov esi, ebx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
nop
mov dword [rsp + 0x60], ebx
mov edx, ebx
mov dword [rsp + 0x40], ebx
nop word [rax + rax]
cmp edx, ebx
jae 0x1802afe68
mov ecx, edx
mov rax, qword [rdi]
cmp qword [rsp + rcx*8 + 0x68], rax
je 0x1802afe68
inc edx
mov dword [rsp + 0x40], edx
jmp 0x1802afe50
test edx, edx
jne 0x1802afe7f
cmp ebx, 0x40
jae 0x1802afe7f
mov rcx, qword [rdi]
mov eax, edx
mov qword [rsp + rax*8 + 0x68], rcx
inc dword [rsp + 0x60]
mov ecx, dword [r13 + 4]
inc ecx
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x1802afee2
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1802afee2
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, qword [rdi]
call qword [sym.imp.WSOCK32.dll_recv]
mov ebx, eax
mov dword [rsp + 0x30], eax
test esi, esi
jne 0x1802aff07
lea eax, [rbx + 1]
test eax, 0xfffffffe
jne 0x1802aff07
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x1802aff07
test r14, r14
je 0x1802aff0f
mov dword [r14], esi
mov eax, ebx
jmp 0x1802aff15
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1802b85a0
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1802b0210
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov r10d, r9d
mov r11, r8
mov rdi, rdx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
test rdx, rdx
je 0x1802b029c
test r8, r8
je 0x1802b029c
test r9d, r9d
je 0x1802b029c
xor r9d, r9d
mov r8d, r10d
cmp dword [rsp + 0x70], r9d
je 0x1802b0273
lea rcx, [rdx + 0x90]
mov eax, dword [rdx + 0x110]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rdx, r11
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_sendto]
jmp 0x1802b0283
mov rcx, qword [rcx + 0x30]
mov rdx, r11
mov rcx, qword [rcx]
call qword [sym.imp.WSOCK32.dll_send]
mov ecx, 1
cmp eax, 0xffffffff
cmovne ebx, ecx
mov dword [rsp + 0x30], ebx
jmp 0x1802b0298
mov eax, ebx
jmp 0x1802b029e
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret