joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141d38058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141d381df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141d38089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d3806f
add dl, dl
jne 0x141d38096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d380f6
xor eax, eax
add dl, dl
jne 0x141d380a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141d381ad
add dl, dl
jne 0x141d380b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d380c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d380d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d380dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141d380ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141d3807e
mov eax, 1
add dl, dl
jne 0x141d38106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141d38113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d380fb
sub eax, ebx
mov ebx, 1
jne 0x141d3814c
mov ecx, 1
add dl, dl
jne 0x141d3812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141d3813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d38123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d3807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141d38168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141d38175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141d3815d
cmp eax, 0x7d00
jae 0x141d3819b
cmp eax, 0x500
jb 0x141d38196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d3807e
cmp eax, 0x7f
ja 0x141d3819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141d3807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141d381d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141d3807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180011390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ed900]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x5919
mov dword [rsp + 0x20], 0x59695976
mov dword [rsp + 0x24], 0x596b597c
mov dword [rsp + 0x28], 0x59375978
mov dword [rsp + 0x2c], 0x5961597c
mov qword [rsp + 0x30], 0x5919597c
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057fc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad750
add rsp, 0x130
pop rbp
ret
Function at 0x18001c520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001c554
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001c540
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x180029ae0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rcx
cmp edx, 1
jne 0x180029d00
xor esi, esi
mov ebx, esi
lea rdi, [0x1800ec560]
mov dword [rsp + 0x30], ebx
cmp ebx, 5
jge 0x180029b47
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdi
call fcn.1800585a0
test al, al
jne 0x180029b57
inc ebx
jmp 0x180029b23
call fcn.180058960
test al, al
jne 0x180029b57
xor eax, eax
jmp 0x180029d05
call fcn.180058960
test al, al
je 0x180029b6a
mov eax, 1
jmp 0x180029d05
mov qword [0x1800ec4c8], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800ec4c0], eax
mov rcx, r14
call fcn.180029900
call fcn.180029d30
or rdi, 0xffffffffffffffff
cmp word [rax], 0
jne 0x180029b99
mov r8, rsi
jmp 0x180029bab
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180029ba0
mov rdx, rax
lea rcx, [0x180004338]
call fcn.1800125f0
mov rcx, r14
call fcn.1800596d0
nop
lea rcx, [0x1800ec5c0]
call fcn.1800585a0
test al, al
je 0x180029bd8
call fcn.1800480b0
lea rcx, [0x1800ec6e0]
call fcn.1800585a0
test al, al
je 0x180029bed
call fcn.1800480b0
lea rcx, [0x1800ec680]
call fcn.1800585a0
test al, al
je 0x180029c5b
call fcn.180058250
test al, al
je 0x180029c0d
xor eax, eax
jmp 0x180029d05
call fcn.1800480b0
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180029330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x180029c51
call fcn.180059ab0
jmp 0x180029c51
mov eax, 1
jmp 0x180029d05
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x180029330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1800738f0
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180029ca8
mov rsi, qword [rax]
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x180029cbf
call fcn.180059ab0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x180029d00
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180029d00
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x180029d00
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x180029d00
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ad750
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180047ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee458]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x2851
mov dword [rsp + 0x20], 0x2822283f
mov dword [rsp + 0x24], 0x28232821
mov dword [rsp + 0x28], 0x287f2865
mov dword [rsp + 0x2c], 0x283d2835
mov qword [rsp + 0x30], 0x2851283d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057fc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad750
add rsp, 0x130
pop rbp
ret

Function at 0x180047ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee4b8]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x3c12
mov dword [rsp + 0x20], 0x3c613c7c
mov dword [rsp + 0x24], 0x3c603c62
mov dword [rsp + 0x28], 0x3c3c3c26
mov dword [rsp + 0x2c], 0x3c7e3c76
mov qword [rsp + 0x30], 0x3c123c7e
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057fc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad750
add rsp, 0x130
pop rbp
ret
Function at 0x1800580f0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x180058154
xor al, al
jmp 0x1800581d7
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800738f0
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x18005818f
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1800581d3
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x1800581d3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x1800581d3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800ad750
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18005a520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800ee840]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x4558
mov dword [rsp + 0x20], 0x452c4536
mov dword [rsp + 0x24], 0x4534453c
mov dword [rsp + 0x28], 0x45764534
mov dword [rsp + 0x2c], 0x4534453c
mov qword [rsp + 0x30], 0x45584534
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.180057fc0
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800ad750
add rsp, 0x130
pop rbp
ret
Function at 0x18005b3c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18005b403
xor eax, eax
jmp 0x18005b606
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18005b43d
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18005b43d
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
mov eax, esi
jmp 0x18005b606
cmp qword [rbx + 0x90], 0
jne 0x18005b44f
or eax, 0xffffffff
jmp 0x18005b606
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x80]
cmp qword [r8], rax
jne 0x18005b479
mov rdx, qword [rbx + 0x70]
mov rcx, qword [rbx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x18005b49d
movsx ecx, sil
mov rdx, qword [rbx + 0x90]
call fcn.1800af2cc
or ebx, 0xffffffff
cmp eax, ebx
cmovne ebx, esi
jmp 0x18005b604
mov byte [rbp - 1], sil
xor r15d, r15d
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], r15b
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp + 7]
call fcn.1800270f0
nop
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
nop word [rax + rax]
lea rdx, [rbp + 7]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp + 7]
cmovae r8, r10
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x18005b5e1
cmp eax, 1
jg 0x18005b5c2
lea rax, [rbp + 7]
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
cmovae rax, r10
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x18005b589
lea rcx, [rbp + 7]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.1800afbe4
cmp rdi, rax
jne 0x18005b5e1
mov r9, qword [rbp + 0x1f]
mov r10, qword [rbp + 7]
mov byte [rbx + 0x81], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x18005b5be
test rdi, rdi
jne 0x18005b4e0
cmp qword [rbp + 0x17], 0x20
jae 0x18005b5e1
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.180018ac0
jmp 0x18005b4cd
mov ebx, esi
jmp 0x18005b5e4
cmp eax, 3
jne 0x18005b5e1
movsx ecx, byte [rbp - 1]
mov rdx, qword [rbx + 0x90]
call fcn.1800af2cc
or ebx, 0xffffffff
cmp eax, ebx
cmovne ebx, esi
jmp 0x18005b5e4
or ebx, 0xffffffff
cmp qword [rbp + 0x1f], 0x10
jb 0x18005b5f4
mov rcx, qword [rbp + 7]
call fcn.18008b820
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], 0
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800ad750
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005c2f0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x18005c467
cmp byte [rcx + 0x81], 0
je 0x18005c467
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x18005c34c
xor al, al
jmp 0x18005c469
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.1800270f0
nop
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x18005c3c0
dec eax
jne 0x18005c437
jmp 0x18005c3c7
mov byte [rdi + 0x81], 0
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x18005c411
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.1800afbe4
cmp rbx, rax
jne 0x18005c43c
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x81], 0
je 0x18005c440
test rbx, rbx
jne 0x18005c380
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.180018ac0
jmp 0x18005c378
sub eax, 2
je 0x18005c440
xor bl, bl
jmp 0x18005c442
mov bl, 1
cmp qword [rbp - 0x18], 0x10
jb 0x18005c452
mov rcx, qword [rbp - 0x30]
call fcn.18008b820
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
movzx eax, bl
jmp 0x18005c469
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800ad750
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180061b40
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], 0
call fcn.180061a50
mov dword [rsp + 0x68], 0
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1800619b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rcx, rdi
call fcn.1800738f0
mov dword [rsp + 0x30], 1
mov rax, qword [rdi]
test rax, rax
je 0x180061c06
cmp qword [rax], 0
je 0x180061c06
lea rbx, [0x1800ec918]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, rdi
call fcn.180061e70
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
jmp 0x180061c33
lea rax, str.wtf__cannot_create_the_thread
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.1800ae048
lea rdx, [0x180151ba0]
lea rcx, [rsp + 0x50]
call fcn.1800b3c18
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800ad750
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x180061c60
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.180061a50
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.180061ad0
nop
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x50], rdi
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
je 0x180061ce6
mov rcx, qword [rbx]
test rcx, rcx
je 0x180061ccd
mov rcx, qword [rcx]
mov edx, 0x29a
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rbx, 0x10
cmp rbx, rdi
jne 0x180061cc2
mov qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x180061d53
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
je 0x180061d39
nop
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x180061d26
lock dec dword [rbx + 8]
jne 0x180061d26
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock dec dword [rbx + 0xc]
jne 0x180061d26
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 0x10
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jne 0x180061d00
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.18008b820
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800ad750
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180074bd0
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp], rax
mov rdi, r8
mov rbx, rdx
xor esi, esi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x40], 0x6a09e667
mov dword [rbp - 0x3c], 0xbb67ae85
mov dword [rbp - 0x38], 0x3c6ef372
mov dword [rbp - 0x34], 0xa54ff53a
mov dword [rbp - 0x30], 0x510e527f
mov dword [rbp - 0x2c], 0x9b05688c
mov dword [rbp - 0x28], 0x1f83d9ab
mov dword [rbp - 0x24], 0x5be0cd19
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x180074c52
mov rcx, qword [rcx]
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.180098340
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.180098420
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], sil
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x28], eax
movzx eax, word [rbp - 0x1c]
mov word [rsp + 0x2c], ax
mov qword [rsp + 0x38], 6
lea rax, [rsp + 0x28]
cmp r14, 0x10
cmovae rax, qword [rsp + 0x28]
mov byte [rax + 6], sil
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov eax, dword [rbp - 0x1a]
mov dword [rsp + 0x48], eax
movzx eax, word [rbp - 0x16]
mov word [rsp + 0x4c], ax
mov qword [rsp + 0x58], 6
lea rax, [rsp + 0x48]
cmovae rax, qword [rsp + 0x48]
mov byte [rax + 6], 0
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180074b10
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180074b10
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180074d26
mov rcx, qword [rsp + 0x48]
call fcn.18008b820
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
cmp qword [rsp + 0x40], 0x10
jb 0x180074d47
mov rcx, qword [rsp + 0x28]
call fcn.18008b820
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], 0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1800ad750
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret