joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180061b10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov dword [r9], 0
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rsi + 0x1c]
mov r8d, edi
sub r8d, edx
add rdx, rbp
call fcn.18023f140
test eax, eax
jle 0x180061b5f
add dword [rbx], eax
cmp dword [rbx], edi
jb 0x180061b40
test eax, eax
jns 0x180061b80
call fcn.18023193c
mov ecx, dword [rax]
call fcn.180236b60
or edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.180061120
or eax, 0xffffffff
jmp 0x180061b8d
test eax, eax
jne 0x180061b8b
mov dword [rsi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180066570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x4020
call fcn.18023d0d0
sub rsp, rax
mov rdi, rcx
mov r9, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
lea r8d, [rax - 0x20]
mov edx, 1
call fcn.1802304fc
mov rcx, rdi
mov rbx, rax
call fcn.1802302b4
test eax, eax
jne 0x18006661c
test ebx, ebx
je 0x1800665f3
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, rsi
call fcn.180062130
cmp eax, ebx
jne 0x180066633
lea rcx, [rsp + 0x20]
mov r9, rdi
mov edx, 1
mov r8d, 0x4000
call fcn.1802304fc
mov rcx, rdi
mov ebx, eax
call fcn.1802302b4
test eax, eax
je 0x1800665b3
jmp 0x18006661c
mov rcx, rdi
call fcn.18023666c
mov rcx, rsi
call fcn.180060c10
test eax, eax
jne 0x18006664c
lea r11, [rsp + 0x4020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rcx, str.fread
call fcn.1802403cc
mov ecx, 1
call fcn.18023ca80
int3
lea rdx, [rsp + 0x4040]
mov rcx, rsi
call fcn.180060d90
mov rcx, rax
call fcn.180066530
int3
lea rcx, str.failed_gzclose
call fcn.180066530
int3

Function at 0x180066660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x4020
call fcn.18023d0d0
sub rsp, rax
mov rsi, rdx
lea r8d, [rax - 0x20]
lea rdx, [rsp + 0x20]
mov rdi, rcx
call fcn.180061570
mov ebx, eax
test eax, eax
js 0x1800666f7
test ebx, ebx
je 0x1800666ca
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov r9, rsi
mov edx, 1
call fcn.180230754
cmp eax, ebx
jne 0x180066710
lea rdx, [rsp + 0x20]
mov r8d, 0x4000
mov rcx, rdi
call fcn.180061570
mov ebx, eax
test eax, eax
jns 0x180066692
jmp 0x1800666f7
mov rcx, rsi
call fcn.18023666c
test eax, eax
jne 0x18006671d
mov rcx, rdi
call fcn.180060c10
test eax, eax
jne 0x18006672a
lea r11, [rsp + 0x4020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x4040]
mov rcx, rdi
call fcn.180060d90
mov rcx, rax
call fcn.180066530
int3
lea rcx, str.failed_fwrite
call fcn.180066530
int3
lea rcx, str.failed_fclose
call fcn.180066530
int3
lea rcx, str.failed_gzclose
call fcn.180066530
int3

Function at 0x18006f8f0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
call sym.extension.dll_Py_IsInitialized
test eax, eax
jne 0x18006f90b
call sym.extension.dll_PyEval_InitThreads
add rsp, 0x28
jmp sym.extension.dll_Py_Initialize
add rsp, 0x28
ret
Function at 0x180075180
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov eax, dword [0x18050e1a8]
test eax, eax
jne 0x1800751a5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov dword [0x18050e1a8], eax
movsxd rbx, eax
xor ecx, ecx
movabs rax, 0x2492492492492493
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
mul rbx
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 5
movsxd rax, ebx
imul rdx, rax, 0x38
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x180075206
test ebx, ebx
jle 0x180075206
mov rcx, qword [0x18050e1a0]
mov edx, ebx
nop dword [rax]
mov qword [rax], rcx
mov rcx, rax
add rax, 0x38
dec rdx
jne 0x1800751f0
mov qword [0x18050e1a0], rcx
add rsp, 0x50
pop rbx
ret
Function at 0x180083df0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x283c], 0
mov rbx, rcx
je 0x180083e26
xor edx, edx
mov dword [rcx + 0x283c], 0
cmp dword [rcx + 0x2830], edx
je 0x180083e1f
xor ecx, ecx
call sym.extension.dll_PyEval_SetTrace
jmp 0x180083e26
xor ecx, ecx
call sym.extension.dll_PyEval_SetProfile
cmp qword [rbx + 0x20], 0
jle 0x180083e3a
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180083e50
add rsp, 0x20
pop rbx
ret

Function at 0x180083e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x2828]
mov r8, qword [rcx + 0x20]
mov rbx, rcx
mov edx, 1
add rcx, 0x28
call fcn.180230754
mov r8, qword [rbx + 0x20]
mov rdi, rax
cmp rax, r8
jne 0x180083eb6
mov qword [rbx + 0x20], 0
test rax, rax
je 0x180083ea4
mov rcx, qword [rbx + 0x2828]
call fcn.18024093c
test eax, eax
jne 0x180083ed2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, [rbx + 0x28]
lea rcx, [rbx + 0x28]
sub r8, rax
add rdx, rax
call fcn.180230800
sub qword [rbx + 0x20], rdi
test rdi, rdi
jne 0x180083e94
mov rcx, qword [rbx + 0x18]
call sym.extension.dll_PyString_AsString
mov rcx, qword [sym.extension.dll_PyExc_IOError]
mov rdx, rax
call sym.extension.dll_PyErr_SetFromErrnoWithFilename
mov rcx, rbx
call fcn.180083df0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret

Function at 0x1800847f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x18050e398]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
sub rax, rbx
je 0x180084813
mov dword [0x18050e3a0], eax
mov dword [0x18050e3a4], 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x18008a830
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r15
sub rsp, 0x30
xor r15d, r15d
mov rbp, rcx
mov ecx, dword [rcx + 0x10]
mov esi, r15d
test ecx, ecx
jns 0x18008a857
call fcn.18008a520
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
call fcn.180041380
test eax, eax
jne 0x18008a875
mov rcx, qword [sym.extension.dll_PyExc_IOError]
call sym.extension.dll_PyErr_SetFromErrno
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
mov edx, 0x2000
xor ecx, ecx
call sym.extension.dll_PyString_FromStringAndSize
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x18008a894
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
call fcn.18008a7a0
movabs r14, 0x7fffffffffffffff
mov rbx, rax
cmp rax, r14
ja 0x18008a96f
mov r12d, 0x7fffffff
nop
test rbx, rbx
je 0x18008a96f
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], rbx
jge 0x18008a8f9
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sym.extension.dll__PyString_Resize
test eax, eax
js 0x18008a998
call sym.extension.dll_PyEval_SaveThread
mov rdi, rax
call fcn.18023193c
sub rbx, rsi
mov dword [rax], r15d
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x10]
cmp rbx, r12
cmovg rbx, r12
add rdx, 0x20
add rdx, rsi
mov r8d, ebx
call fcn.18023f140
mov rcx, rdi
movsxd rbx, eax
call sym.extension.dll_PyEval_RestoreThread
test rbx, rbx
je 0x18008aa10
jns 0x18008a955
call fcn.18023193c
cmp dword [rax], 4
jne 0x18008a9b7
call sym.extension.dll_PyErr_CheckSignals
test eax, eax
jne 0x18008a982
jmp 0x18008a958
add rsi, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.18008a7a0
mov rbx, rax
cmp rax, r14
jbe 0x18008a8d0
mov rcx, qword [sym.extension.dll_PyExc_OverflowError]
lea rdx, str.unbounded_read_returned_more_bytes_than_a_Python_string_can_hold
call sym.extension.dll_PyErr_SetString
mov rax, qword [rsp + 0x50]
dec qword [rax]
mov rcx, qword [rsp + 0x50]
jne 0x18008a998
mov rax, qword [rcx + 8]
call qword [rax + 0x30]
xor eax, eax
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop rsi
pop rbp
ret
call fcn.18023193c
cmp dword [rax], 0xb
jne 0x18008a9ec
test rsi, rsi
jg 0x18008aa10
mov rax, qword [rsp + 0x50]
dec qword [rax]
mov rcx, qword [rsp + 0x50]
jne 0x18008a9dc
mov rax, qword [rcx + 8]
call qword [rax + 0x30]
inc qword [sym.extension.dll__Py_NoneStruct]
lea rax, sym.extension.dll__Py_NoneStruct
jmp 0x18008a99a
mov rax, qword [rsp + 0x50]
dec qword [rax]
mov rcx, qword [rsp + 0x50]
jne 0x18008aa02
mov rax, qword [rcx + 8]
call qword [rax + 0x30]
mov rcx, qword [sym.extension.dll_PyExc_IOError]
call sym.extension.dll_PyErr_SetFromErrno
jmp 0x18008a998
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x10], rsi
jle 0x18008a99a
lea rcx, [rsp + 0x50]
mov rdx, rsi
call sym.extension.dll__PyString_Resize
test eax, eax
js 0x18008a998
mov rax, qword [rsp + 0x50]
jmp 0x18008a99a
Function at 0x180099070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call sym.extension.dll_PyEval_SaveThread
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rbx
mov rsi, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call sym.extension.dll_PyEval_RestoreThread
test ebx, ebx
jne 0x1800990ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x5aa
jne 0x1800990ea
mov rcx, qword [sym.extension.dll_PyExc_ValueError]
lea rdx, str.Cannnot_send__Id_bytes_over_connection
mov r8, rbp
call sym.extension.dll_PyErr_Format
or rax, 0xffffffffffffffff
jmp 0x1800990f5
neg ebx
sbb rax, rax
neg rax
dec rax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180099110
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov r14, r9
mov rbx, r8
mov r12, rdx
mov r15, rcx
mov qword [r9], r13
call sym.extension.dll_PyEval_SaveThread
mov r8d, dword [rsp + 0x80]
cmp rbx, qword [rsp + 0x80]
mov rcx, qword [r15 + 0x10]
lea r9, [rsp + 0x60]
cmovb r8d, ebx
mov rdx, r12
mov rdi, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call sym.extension.dll_PyEval_RestoreThread
test ebx, ebx
je 0x18009918c
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0xea
je 0x1800991c0
or rax, 0xffffffffffffffff
mov rdx, 0xfffffffffffffc16
cmp ecx, 0x6d
cmove rax, rdx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [r15 + 0x10]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1800991fc
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x68], rsi
mov esi, dword [rsp + 0x60]
add esi, dword [rsp + 0x70]
cmp rsi, qword [rsp + 0x80]
jbe 0x18009921c
mov rax, 0xfffffffffffffc14
jmp 0x18009928c
mov rcx, rsi
call sym.extension.dll_PyMem_Malloc
mov qword [r14], rax
test rax, rax
jne 0x180099235
mov rax, 0xfffffffffffffc17
jmp 0x18009928c
mov r8d, dword [rsp + 0x60]
mov rdx, r12
mov rcx, rax
call fcn.180230800
call sym.extension.dll_PyEval_SaveThread
mov edx, dword [rsp + 0x60]
add rdx, qword [r14]
mov r8d, dword [rsp + 0x70]
mov rcx, qword [r15 + 0x10]
lea r9, [rsp + 0x60]
mov rdi, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call sym.extension.dll_PyEval_RestoreThread
test ebx, ebx
je 0x180099280
mov rax, rsi
jmp 0x18009928c
mov rcx, qword [r14]
call sym.extension.dll_PyMem_Free
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18009a650
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r8, r8
je 0x18009a6be
nop dword [rax]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
movsxd rdx, eax
test eax, eax
jns 0x18009a6b3
call fcn.18023193c
cmp dword [rax], 4
jne 0x18009a6d0
call fcn.18009a610
test eax, eax
jns 0x18009a6b9
mov rax, 0xfffffffffffffc12
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
sub rbx, rdx
add rdi, rdx
test rbx, rbx
jne 0x18009a670
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, 0xfffffffffffffc13
add rsp, 0x20
pop rdi
ret
Function at 0x18009a6f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov rsi, rdx
mov r14, rcx
mov rdi, r8
test r8, r8
je 0x18009a762
nop dword [rax + rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x18009a755
call fcn.18023193c
cmp dword [rax], 4
jne 0x18009a77f
call fcn.18009a610
test eax, eax
jns 0x18009a75d
mov rax, 0xfffffffffffffc12
jmp 0x18009a764
je 0x18009a784
sub rdi, rbx
add rsi, rbx
test rdi, rdi
jne 0x18009a720
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x18009a764
xor eax, eax
cmp rdi, rbp
sete al
add rax, 0xfffffffffffffc15
jmp 0x18009a764

Function at 0x18009a9c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 0x10]
xorps xmm0, xmm0
xor edi, edi
mov rbx, rcx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rax
comisd xmm0, xmm1
jbe 0x18009aa33
nop dword [rax]
mov ecx, dword [rbx + 0x10]
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
inc ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x18009aaa9
call fcn.18023193c
cmp dword [rax], 4
je 0x18009a9f0
mov eax, 0xfffffc13
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
mov ecx, dword [rcx + 0x10]
cvttsd2si eax, xmm1
lea rdx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
inc ecx
mov dword [rsp + 0x258], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [0x180312c90]
addsd xmm1, qword [0x18030fe10]
cvttsd2si eax, xmm1
mov dword [rsp + 0x25c], eax
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x18009aaa9
call fcn.18023193c
cmp dword [rax], 4
jne 0x18009aa1d
xor eax, eax
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll___WSAFDIsSet
mov rbx, qword [rsp + 0x250]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x240
pop rdi
ret
Function at 0x18009be30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [rcx + 0x9d0], 0x270
mov r9, rcx
jl 0x18009bf05
xor r8d, r8d
lea r10, [0x1804be518]
mov edx, 0xe3
mov ecx, dword [r9 + r8*4 + 0x14]
inc r8
xor ecx, dword [r9 + r8*4 + 0xc]
btr ecx, 0x1f
xor ecx, dword [r9 + r8*4 + 0xc]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r10 + rax*4]
xor eax, ecx
xor eax, dword [r9 + r8*4 + 0x640]
mov dword [r9 + r8*4 + 0xc], eax
cmp r8, rdx
jl 0x18009be52
nop word [rax + rax]
mov ecx, dword [r9 + rdx*4 + 0x14]
inc rdx
xor ecx, dword [r9 + rdx*4 + 0xc]
btr ecx, 0x1f
xor ecx, dword [r9 + rdx*4 + 0xc]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r10 + rax*4]
xor eax, ecx
xor eax, dword [r9 + rdx*4 - 0x380]
mov dword [r9 + rdx*4 + 0xc], eax
cmp rdx, 0x26f
jl 0x18009be90
mov edx, dword [r9 + 0x9cc]
xor edx, dword [r9 + 0x10]
btr edx, 0x1f
xor edx, dword [r9 + 0x9cc]
mov eax, edx
shr edx, 1
and eax, 1
mov ecx, dword [r10 + rax*4]
xor ecx, dword [r9 + 0x640]
xor ecx, edx
mov dword [r9 + 0x9cc], ecx
mov dword [r9 + 0x9d0], 0
movsxd rcx, dword [r9 + 0x9d0]
mov edx, dword [r9 + rcx*4 + 0x10]
lea eax, [rcx + 1]
mov dword [r9 + 0x9d0], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x18009bfb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
mov dword [rcx + 0x10], edx
mov eax, 1
lea r9, [rcx + 0x14]
nop
mov r8d, dword [r9 - 4]
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, dword [r9 - 8]
imul ecx, r8d, 0x6c078965
add ecx, eax
inc eax
mov dword [r9 - 4], ecx
cmp eax, 0x270
jl 0x18009bfc0
mov dword [r10 + 0x9d0], eax
ret

Function at 0x1800a4640
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x240
movsd xmm1, qword [rcx + 0x30]
xorps xmm0, xmm0
mov esi, edx
comisd xmm0, xmm1
mov rbx, rcx
jbe 0x1800a4676
mov eax, 1
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rsi
ret
ucomisd xmm1, xmm0
jp 0x1800a4691
jne 0x1800a4691
xor eax, eax
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rsi
ret
cvttsd2si eax, xmm1
mov qword [rsp + 0x258], rdi
xor edi, edi
cmp dword [0x18050e798], edi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x250], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, qword [0x180312c90]
cvttsd2si eax, xmm1
mov dword [rsp + 0x254], eax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x38], rax
jbe 0x1800a46e6
call sym.extension.dll_PyEval_SaveThread
mov rdi, rax
mov ecx, dword [rbx + 0x10]
lea rax, [rsp + 0x250]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rax
test esi, esi
je 0x1800a4708
lea r8, [rsp + 0x30]
xor edx, edx
jmp 0x1800a4710
xor r8d, r8d
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_select]
cmp dword [0x18050e798], 0
mov ebx, eax
jbe 0x1800a4729
mov rcx, rdi
call sym.extension.dll_PyEval_RestoreThread
mov rdi, qword [rsp + 0x258]
test ebx, ebx
mov rbx, qword [rsp + 0x260]
mov eax, 5
mov ecx, 2
cmove eax, ecx
add rsp, 0x240
pop rsi
ret
Function at 0x1800ce0f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov rbp, rdx
mov r13, rcx
mov rdi, rcx
test r9, r9
je 0x1800ce245
mov rcx, qword [r9 + 8]
lea rdx, sym.extension.dll_PyFile_Type
cmp rcx, rdx
je 0x1800ce132
call sym.extension.dll_PyType_IsSubtype
test eax, eax
je 0x1800ce245
cmp dword [r15 + 0x58], 0
jne 0x1800ce158
mov r9, r12
mov r8, rbp
mov edx, 1
mov rcx, r13
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rbp
jmp fcn.1802304fc
mov qword [rsp + 0x50], rbx
mov ebx, dword [r15 + 0x5c]
mov qword [rsp + 0x58], rsi
mov esi, dword [r15 + 0x60]
test rbp, rbp
je 0x1800ce220
mov qword [rsp + 0x60], r14
nop dword [rax + rax]
mov r9, r12
mov r8, rbp
mov edx, 1
mov rcx, rdi
mov r14, rdi
call fcn.1802304fc
test rax, rax
je 0x1800ce21b
sub rbp, rax
mov edx, 0
setne dl
nop word [rax + rax]
movzx ecx, byte [r14]
dec rax
lea r14, [r14 + 1]
cmp cl, 0xd
jne 0x1800ce1cd
mov byte [rdi], 0xa
inc rdi
mov esi, 1
jmp 0x1800ce1f4
test esi, esi
je 0x1800ce1e5
cmp cl, 0xa
jne 0x1800ce1e0
xor esi, esi
or ebx, 4
inc rbp
jmp 0x1800ce1f4
or ebx, 1
jmp 0x1800ce1ed
cmp cl, 0xa
jne 0x1800ce1ed
or ebx, 2
mov byte [rdi], cl
inc rdi
xor esi, esi
test rax, rax
jne 0x1800ce1b0
test edx, edx
jne 0x1800ce208
test rbp, rbp
jne 0x1800ce180
jmp 0x1800ce21b
test esi, esi
je 0x1800ce21b
mov rcx, r12
call fcn.18023028c
test eax, eax
je 0x1800ce21b
or ebx, 1
mov r14, qword [rsp + 0x60]
sub rdi, r13
mov dword [r15 + 0x5c], ebx
mov rbx, qword [rsp + 0x50]
mov dword [r15 + 0x60], esi
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
call fcn.18023193c
mov dword [rax], 6
xor eax, eax
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret

Function at 0x1800e36a0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov eax, 1
test r8, r8
jle 0x1800e36d4
sub rdx, rcx
mov ecx, dword [rdx + r9]
lea r9, [r9 + 4]
xor ecx, 0x3fffffff
add eax, ecx
mov ecx, eax
shr eax, 0x1e
and ecx, 0x3fffffff
mov dword [r9 - 4], ecx
dec r8
jne 0x1800e36b0
ret
Function at 0x1800f2f60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rax, sym.extension.dll_PyString_Type
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 8], rax
je 0x1800f2fcd
call sym.extension.dll_PyObject_Str
mov rdi, rax
test rax, rax
jne 0x1800f2f9f
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8d, ebp
mov rdx, rbx
mov rcx, rax
call fcn.1800f2f60
dec qword [rdi]
mov ebx, eax
jne 0x1800f2fbe
mov rdx, qword [rdi + 8]
mov rcx, rdi
call qword [rdx + 0x30]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
lea rdi, [rcx + 0x20]
test bpl, 1
je 0x1800f305f
mov rbp, qword [rcx + 0x10]
call sym.extension.dll_PyEval_SaveThread
mov qword [rsp + 0x40], rax
cmp rbp, 0x7fffffff
jle 0x1800f3042
lea rsi, [rbp - 0x80000000]
movabs rax, 0x800040002001
mul rsi
sub rsi, rdx
shr rsi, 1
add rsi, rdx
shr rsi, 0x1e
inc rsi
imul rax, rsi, 0xffffffff80004000
add rbp, rax
mov r9, rbx
mov edx, 1
mov r8d, 0x7fffc000
mov rcx, rdi
call fcn.180230754
add rdi, 0x7fffc000
dec rsi
jne 0x1800f3020
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rdi
call fcn.180230754
mov rcx, qword [rsp + 0x40]
jmp 0x1800f3162
mov r8, qword [rcx + 0x10]
mov ebp, 0x27
mov rcx, rdi
mov edx, ebp
mov qword [rsp + 0x40], rdi
call fcn.1802311c4
test rax, rax
je 0x1800f3096
mov r8, qword [rsi + 0x10]
lea edx, [rbp - 5]
mov rcx, rdi
call fcn.1802311c4
test rax, rax
mov eax, 0x22
cmove ebp, eax
mov rsi, qword [rsi + 0x10]
call sym.extension.dll_PyEval_SaveThread
mov rdx, rbx
mov ecx, ebp
mov qword [rsp + 0x58], rax
call fcn.180241314
xor edi, edi
test rsi, rsi
jle 0x1800f3153
nop dword [rax]
mov rax, qword [rsp + 0x40]
movsx ecx, byte [rax + rdi]
mov r8d, ecx
cmp ecx, ebp
je 0x1800f3138
cmp cl, 0x5c
je 0x1800f3138
cmp cl, 9
jne 0x1800f30eb
lea rdx, [0x180337b00]
mov rcx, rbx
call fcn.1802367b8
jmp 0x1800f3147
cmp cl, 0xa
jne 0x1800f3101
lea rdx, [0x180337b04]
mov rcx, rbx
call fcn.1802367b8
jmp 0x1800f3147
cmp cl, 0xd
jne 0x1800f3117
lea rdx, [0x180337b08]
mov rcx, rbx
call fcn.1802367b8
jmp 0x1800f3147
lea eax, [rcx - 0x20]
cmp al, 0x5e
ja 0x1800f312b
mov rdx, rbx
mov ecx, r8d
call fcn.180241314
jmp 0x1800f3147
movzx r8d, cl
lea rdx, str.x_02x
jmp 0x1800f313f
lea rdx, [0x180337afc]
mov rcx, rbx
call fcn.1802367b8
inc rdi
cmp rdi, rsi
jl 0x1800f30c0
mov rdx, rbx
mov ecx, ebp
call fcn.180241314
mov rcx, qword [rsp + 0x58]
call sym.extension.dll_PyEval_RestoreThread
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret