joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001c610
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
movzx eax, byte [rax + 0x41]
test eax, eax
je 0x18001c775
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x50], 0
je 0x18001c694
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x90]
cmp dword [rax + 0x58], ecx
jae 0x18001c694
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.180084aa0
mov rax, qword [rsp + 0x80]
mov qword [rax + 0x50], 0
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x50], 0
jne 0x18001c6dd
mov eax, dword [rsp + 0x90]
shl eax, 1
mov eax, eax
mov ecx, eax
call fcn.180084d44
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x50], rcx
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x90]
mov dword [rax + 0x58], ecx
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov rdi, qword [rcx + 0x50]
mov rsi, qword [rsp + 0x88]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x30], 0
jmp 0x18001c710
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x30], eax
jae 0x18001c764
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x50]
mov rdx, qword [rsp + 0x80]
add rdx, 0x44
mov qword [rsp + 0x50], rdx
movzx edx, byte [rcx + rax]
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.18001ba40
mov ecx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x50]
mov byte [rdx + rcx], al
jmp 0x18001c706
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x30], 0
je 0x18001c80f
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x38]
add eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
cmp eax, dword [rcx + 0x3c]
jb 0x18001c7bd
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x24], 0x30000
xor eax, eax
jmp 0x18001c862
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov ecx, dword [rcx + 0x38]
mov rdx, qword [rsp + 0x80]
add rcx, qword [rdx + 0x30]
mov rdi, rcx
mov rsi, qword [rsp + 0x38]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x38]
add eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x38], eax
mov eax, dword [rsp + 0x90]
jmp 0x18001c862
mov rax, qword [rsp + 0x80]
cmp qword [rax + 8], 0
je 0x18001c851
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x34]
jmp 0x18001c862
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x24], 0x1000000
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x18001d180
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xb8], 0
je 0x18001d285
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0xc0]
cmp dword [rax + 0xc4], ecx
jb 0x18001d1c7
xor eax, eax
jmp 0x18001d328
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0xc4]
mov eax, dword [rax + 0xc0]
sub eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x30], eax
jbe 0x18001d1f5
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0xc4]
mov rdx, qword [rsp + 0x60]
add rcx, qword [rdx + 0xb8]
mov rdi, qword [rsp + 0x68]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0xc4]
add eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0xc4], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x9c]
add eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x9c], eax
mov eax, dword [rsp + 0x30]
mov r8d, eax
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0xa0]
call fcn.18001b660
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x30]
jmp 0x18001d328
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xa8], 0
je 0x18001d31a
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x18001d2d1
xor eax, eax
jmp 0x18001d328
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x9c]
add eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x9c], eax
mov eax, dword [rsp + 0x34]
mov r8d, eax
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0xa0]
call fcn.18001b660
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x34]
jmp 0x18001d328
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x24], 0x1000000
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x18001eb10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1800c33e0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x60], 0x48
mov byte [rsp + 0x61], 0xb8
mov byte [rsp + 0x62], 0x64
mov byte [rsp + 0x63], send
mov byte [rsp + 0x64], 0xcb
mov byte [rsp + 0x65], 0xa1
mov byte [rsp + 0x66], 0x19
mov byte [rsp + 0x67], 0x24
mov byte [rsp + 0x68], 0xde
mov byte [rsp + 0x69], 0x44
mov byte [rsp + 0x70], 0x48
mov byte [rsp + 0x71], 0xb8
mov byte [rsp + 0x72], 0x1e
mov byte [rsp + 0x73], 0x77
mov byte [rsp + 0x74], 0x19
mov byte [rsp + 0x75], 0x2b
mov byte [rsp + 0x76], 0xfc
mov byte [rsp + 0x77], 0xa8
mov byte [rsp + 0x78], 0x79
mov byte [rsp + 0x79], reloc.WS2_32.dll_recv
movabs rax, 0x41ba0a9a6c516562
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec11
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x18001ebe9
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec39
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
jmp 0x18001ec11
mov rax, qword [rsp + 0x28]
add rax, 0x11
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x40
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jmp 0x18001eca7
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rax
je 0x18001ece9
mov eax, dword [rsp + 0x20]
movzx eax, byte [rsp + rax + 0x80]
mov rcx, qword [rsp + 0x48]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 7
mov dword [rsp + 0x20], eax
jmp 0x18001ec9a
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180084a40
add rsp, 0x98
ret
Function at 0x18003cc98
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp + 0x570], rax
xor r12d, r12d
mov edi, edx
mov qword [rsp + 0x30], rcx
mov r15d, r8d
mov dword [rsp + 0x40], r12d
mov r14, rcx
mov dword [rbp + 0x150], r12d
mov esi, r12d
mov dword [rbp + 0x360], r12d
lea r13d, [r12 + 1]
mov r9d, r12d
mov r10d, r12d
mov r8d, r12d
test edx, edx
je 0x18003cdfe
mov r11, rcx
mov ebx, edi
mov r14d, 0x300
mov rdx, qword [r11]
movsxd rax, esi
cmp rdx, rax
jbe 0x18003cd1c
mov esi, edx
test word [r11 + 8], r14w
je 0x18003cd5b
mov ecx, r12d
test r9d, r9d
je 0x18003cd3c
mov eax, ecx
cmp qword [rsp + rax*8 + 0x48], rdx
je 0x18003cd3c
add ecx, r13d
cmp ecx, r9d
jb 0x18003cd2b
cmp ecx, r9d
jne 0x18003cd5b
cmp r9d, 0x40
jae 0x18003cd5b
mov eax, ecx
mov qword [rsp + rax*8 + 0x48], rdx
mov r9d, dword [rsp + 0x40]
add r9d, r13d
mov dword [rsp + 0x40], r9d
test byte [r11 + 8], 0x10
je 0x18003cda4
mov ecx, r12d
test r10d, r10d
je 0x18003cd7e
mov eax, ecx
cmp qword [rbp + rax*8 + 0x158], rdx
je 0x18003cd7e
add ecx, r13d
cmp ecx, r10d
jb 0x18003cd6a
cmp ecx, r10d
jne 0x18003cda4
cmp r10d, 0x40
jae 0x18003cda4
mov eax, ecx
mov qword [rbp + rax*8 + 0x158], rdx
mov r10d, dword [rbp + 0x150]
add r10d, r13d
mov dword [rbp + 0x150], r10d
test byte [r11 + 8], r13b
je 0x18003cdec
mov ecx, r12d
test r8d, r8d
je 0x18003cdc6
mov eax, ecx
cmp qword [rbp + rax*8 + 0x368], rdx
je 0x18003cdc6
add ecx, r13d
cmp ecx, r8d
jb 0x18003cdb2
cmp ecx, r8d
jne 0x18003cdec
cmp r8d, 0x40
jae 0x18003cdec
mov eax, ecx
mov qword [rbp + rax*8 + 0x368], rdx
mov r8d, dword [rbp + 0x360]
add r8d, r13d
mov dword [rbp + 0x360], r8d
add r11, 0x10
sub rbx, r13
jne 0x18003cd0f
mov r14, qword [rsp + 0x30]
mov eax, 0x10624dd3
lea r9, [rbp + 0x360]
imul r15d
mov ecx, r15d
lea r8, [rbp + 0x150]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x40]
sub ecx, eax
imul eax, ecx, 0x3e8
lea ecx, [rsi + 1]
cmp r15d, 0xffffffff
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
cmove rax, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
js 0x18003cec5
test edi, edi
je 0x18003cec3
lea rbx, [r14 + 0xa]
mov r15d, 0x300
mov r14d, reloc.WS2_32.dll_recv
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x40]
mov word [rbx], r12w
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18003ce8b
or word [rbx], r15w
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x150]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18003cea3
or word [rbx], r14w
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x360]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18003cebb
or word [rbx], r13w
add rbx, r14
sub rdi, r13
jne 0x18003ce71
mov eax, esi
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.180084a40
mov rbx, qword [rsp + 0x6c8]
add rsp, 0x680
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003e1f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x18003e243
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18003e208
jmp 0x18003e250
cmp dword [rcx], 0x4e0
jb 0x18003e250
call fcn.18003e4fc
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x18003e4fc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r9, rcx
lea r10, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r10]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x18003e50c
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov edx, dword [r10]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10]
lea r10, [r10 + 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x18003e551
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], r11d
ret
Function at 0x180045268
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov rbp, rcx
add rcx, 0x70
mov qword [rax + 8], rcx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
je 0x1800452a8
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov al, byte [rsp + 0x60]
mov byte [rsp + 0x20], al
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.180044554
mov al, byte [rsp + 0x60]
mov byte [rsp + 0x20], al
mov r9, rbx
mov r8, rdi
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.180044370
mov al, byte [rbp + 0x20]
test al, al
je 0x180045319
xor edx, edx
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x180045319
mov r9, qword [rsp + 0x88]
mov rax, qword [rbp + 0x60]
sub rax, r8
mov rcx, rdx
and ecx, 3
mov cl, byte [rcx + r9]
xor byte [rax + rdx], cl
inc rdx
cmp rdx, r8
jne 0x1800452fd
mov rcx, qword [rsp + 0x60]
call sub.MSVCP140.dll__Mtx_unlock
test eax, eax
je 0x18004532f
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x180047898
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rdx
mov r10, rcx
cmp byte [rdx + 8], r8b
je 0x1800478ce
cmp qword [rdx + 0x18], r8
je 0x1800478ce
mov edx, dword [r9]
mov rax, r8
mov rcx, qword [r10 + 0x40]
add rdx, r8
and eax, 3
inc r8
mov al, byte [rax + r9 + 0x20]
xor byte [rdx + rcx], al
cmp r8, qword [r9 + 0x18]
jne 0x1800478ad
ret

Function at 0x1800486d4
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
movsxd rcx, dword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
add rsp, 0x28
ret

Function at 0x1800486ec
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
movsxd rcx, dword [rcx + 8]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cdqe
add rsp, 0x28
ret

Function at 0x18004b1ec
Capabilities:
Encode data using base64

Disassembly:
mov r8, rcx
lea r9, [rcx + 1]
mov r10d, 6
lea r11, [0x18008dbc0]
movzx eax, byte [r9 - 1]
shr rax, 2
mov al, byte [rax + r11]
mov byte [rdx], al
lea rdx, [rdx + 4]
movzx ecx, byte [r9 - 1]
movzx eax, byte [r9]
and ecx, 3
shr rax, 4
shl ecx, 4
or rcx, rax
mov al, byte [rcx + r11]
mov byte [rdx - 3], al
movzx ecx, byte [r9]
movzx eax, byte [r9 + 1]
lea r9, [r9 + 3]
shr rax, 6
and ecx, 0xf
shl ecx, 2
or rcx, rax
mov al, byte [rcx + r11]
mov byte [rdx - 2], al
movzx eax, byte [r9 - 2]
and eax, 0x3f
mov al, byte [rax + r11]
mov byte [rdx - 1], al
sub r10, 1
jne 0x18004b200
movzx eax, byte [r8 + 0x12]
shr rax, 2
mov al, byte [rax + r11]
mov byte [rdx], al
movzx ecx, byte [r8 + 0x12]
movzx eax, byte [r8 + 0x13]
and ecx, 3
shr rax, 4
shl ecx, 4
or rcx, rax
mov al, byte [rcx + r11]
mov byte [rdx + 1], al
movzx eax, byte [r8 + 0x13]
and eax, 0xf
shl eax, 2
mov al, byte [rax + r11]
mov byte [rdx + 2], al
mov byte [rdx + 3], 0x3d
ret
Function at 0x18004c6bc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1320]
mov eax, 0x1420
call fcn.180085770
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1440], rbx
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp + 0x1310], rax
movsxd rsi, r8d
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], recv
mov byte [rsp + 0x40], dil
lea rdx, str.0123456789ABCDEFGHabcdefgh
lea rcx, [rsp + 0x40]
call fcn.1800032a0
nop
movdqa xmm0, xmmword [0x18008c1d0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], dil
lea rdx, [0x18008c110]
lea rcx, [rsp + 0x60]
call fcn.1800032a0
nop
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
nop
lea rcx, [rsp + 0x60]
call fcn.180002890
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov ecx, eax
or dword [rbp + 0x1304], 0xffffffff
mov dword [rbp - 0x7c], eax
lea edx, [rdi + 1]
mov r8d, edx
mov r9d, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, r8d
mov dword [rbp + rdx*4 - 0x7c], ecx
inc r8d
inc rdx
cmp rdx, r9
jl 0x18004c77f
mov dword [rbp - 0x80], r9d
mov dword [rsp + 0x28], edi
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x2c], eax
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], recv
mov byte [rbx], dil
mov dword [rsp + 0x20], 1
cmp rsi, qword [rbx + 0x10]
ja 0x18004c7e4
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18004c7de
mov rax, qword [rbx]
mov byte [rax + rsi], dil
jmp 0x18004c7f5
mov rdx, rsi
sub rdx, rdi
xor r8d, r8d
mov rcx, rbx
call fcn.180028af0
test rsi, rsi
jle 0x18004c838
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x28]
call fcn.1800498d8
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18004c826
mov r8, qword [rbx]
movsxd rcx, eax
mov dl, byte [rcx + rdx]
mov byte [rdi + r8], dl
inc rdi
cmp rdi, rsi
jl 0x18004c7fa
lea rcx, [rsp + 0x40]
call fcn.180002890
mov rax, rbx
mov rcx, qword [rbp + 0x1310]
xor rcx, rsp
call fcn.180084a40
mov rbx, qword [rsp + 0x1440]
add rsp, 0x1420
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004c868
Capabilities:
Contain obfuscated stackstrings
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov rbx, rdx
cmp qword [rcx + 0x18], 0x10
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
mov byte [rbp + 0x3f], al
jb 0x18004c8a6
mov rcx, qword [rcx]
mov rdx, rcx
mov r8d, 0x18
lea rcx, [rbp + 0x27]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r8d, r8d
mov dword [rbp - 0x39], 0x67452301
mov byte [rbp + 0x3f], r8b
mov qword [rbp - 0x19], r8
mov qword [rbp - 0x11], r8
mov qword [rbp - 9], r8
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
mov dword [rbp - 0x29], 0xc3d2e1f0
mov dword [rbp - 1], 0x32353845
mov dword [rbp + 3], 0x41464135
mov dword [rbp + 7], 0x2d453931
mov dword [rbp + 0xb], 0x342d3437
mov dword [rbp + 0xf], 0x44412d39
mov dword [rbp + 0x13], 0x3543412d
mov dword [rbp + 0x17], 0x43354142
mov dword [rbp + 0x1b], 0x30444338
mov dword [rbp + 0x1f], 0x35423131
mov dword [rbp + 0x23], 0x80000000
movzx eax, byte [rbp + r8 + 0x28]
movsx edx, byte [rbp + r8 + 0x27]
shl edx, 8
or edx, eax
movzx eax, byte [rbp + r8 + 0x29]
shl edx, 8
or edx, eax
movsx eax, byte [rbp + r8 + 0x2a]
shl edx, 8
movzx ecx, al
or edx, ecx
mov dword [rbp + r8 - 0x19], edx
add r8, 4
cmp r8, 0x18
jl 0x18004c935
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.18004cb28
xor edx, edx
lea rcx, [rbp - 0x19]
lea r8d, [rdx + 0x3c]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x19]
mov dword [rbp + 0x23], 0x1e0
lea rcx, [rbp - 0x39]
call fcn.18004cb28
lea r8, [rbp - 0x37]
mov r9d, 5
mov ecx, dword [r8 - 2]
mov eax, ecx
shr eax, 8
mov byte [r8], al
mov eax, ecx
mov byte [r8 + 1], cl
lea r8, [r8 + 4]
shr eax, 0x10
shr ecx, 0x18
mov byte [r8 - 5], al
mov byte [r8 - 6], cl
sub r9, 1
jne 0x18004c9a8
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.18004b1ec
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180084a40
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rbp
ret

Function at 0x18004ced0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov edx, 6
movsxd rbx, ecx
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], 1
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x30
pop rbx
ret
Function at 0x18004f18c
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, r8
mov ebx, edx
mov rsi, rcx
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rbp - 0x19]
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x19], 0x408
xor edi, edi
mov dword [rbp - 0x11], 1
mov edx, ebx
lea rcx, [rbp + 0x17]
call fcn.18004eb1c
nop
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rdx, qword [rbp + 0x17]
cmp qword [rsi + 0x18], 0x10
jb 0x18004f208
mov rsi, qword [rsi]
lea r9, [rbp - 0x29]
lea r8, [rbp - 0x19]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x18004f25a
mov qword [rsp + 0x30], rdi
mov r9d, 0x400
mov dword [rsp + 0x28], r9d
lea rbx, [0x1800c44c0]
mov qword [rsp + 0x20], rbx
mov r8d, eax
xor edx, edx
mov ecx, 0x12ff
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdx, rbx
mov rcx, r14
call fcn.1800032a0
mov qword [rbp - 0x29], rdi
jmp 0x18004f25e
mov rdi, qword [rbp - 0x29]
lea rcx, [rbp + 0x17]
call fcn.180002890
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180084a40
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret