joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b4d60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x180280040]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.18006fd80
mov rcx, qword [0x1803cabe0]
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
mov rdi, rax
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x1803cabe8]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1803cabf0]
mov ecx, send
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x1803cabe8], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x138], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_select
and al, 1
mov byte [rdi + 0x139], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13b], 0
mov byte [rdi + 0x13a], al
call fcn.18006fd80
mov rbx, rax
cmp byte [rax + 0x393], 0
je 0x1800b4ea3
cvttss2si ecx, dword [rax + 0x120]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], ecx
cvttss2si ecx, dword [rax + 0x124]
mov dword [rsp + 0x3c], ecx
mov rcx, qword [0x1803cabe0]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1800b4ea3
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x120], 0xff7fffff
mov dword [rbx + 0x124], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1800b4f22
mov rdx, qword [0x1803cabe0]
cmp rax, rdx
je 0x1800b4edb
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1800b4f22
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1800b4f22
mov rcx, qword [0x1803cabe0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1800b4f22
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x120], xmm0
movss dword [rbx + 0x124], xmm1
cmp byte [rdi + 0xc0], 0
je 0x1800b4f32
mov eax, 0xffffffff
jmp 0x1800b4f37
call fcn.18006feb0
cmp dword [0x18027e888], eax
je 0x1800b4f4a
mov dword [0x18027e888], eax
call fcn.1800b5270
call fcn.1800b4f70
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801e4790
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1800b9760
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1800b982c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1800b982c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1800b9845
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1800b981c
cmp byte [rax], 0x5c
jne 0x1800b9816
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1800b9816
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1800b9802
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1800b9813
test r8b, 0x10
jne 0x1800b9816
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1800b9816
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800bbcc0
test edi, edi
jne 0x1800b9780
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.1800bac30
int3

Function at 0x1800bc150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800bc184
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800bc170
ret

Function at 0x1800cc830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x1800cc93f
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x180000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x1800cc89a.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x1800cc89a.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x1800cc89a.8
cdqe
movzx eax, byte [rdi + rax + 0xcc954]
mov ecx, dword [rdi + rax*4 + 0xcc940]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x1800cc89a.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x1800cc8bd
and dl, 0xc7
jmp 0x1800cc8c3
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x1800cc89a.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x1800cc89a.8
mov rcx, rbx
call fcn.1800ccf60
jmp case.0x1800cc89a.8
cmp word [r10 + 0xa], 0
jne case.0x1800cc89a.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x1800cc8ff
test byte [rdx + 9], 0x18
je 0x1800cc8ff
mov rcx, rbx
call fcn.1800ccf60
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x1800cc89a.8
mov rcx, r10
call fcn.1800cbda0
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x1800cc853
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1800ce3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rdi, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
call fcn.1800e00a0
test eax, eax
je 0x1800ce418
xor r10d, r10d
mov r11d, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x1800ce40e
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x1800ce40e
mov rcx, rbx
call fcn.1800ccf60
add r10, 0x10
sub r11, 1
jne 0x1800ce3f0
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x1800ce46f
test byte [r10 + 8], 0xf
movzx eax, byte [r10 + 9]
jne 0x1800ce438
test al, 0x40
je 0x1800ce466
mov byte [r10 + 9], ntohs
jmp 0x1800ce466
test al, 0x40
je 0x1800ce44e
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x1800ce44e
mov rcx, rbx
call fcn.1800ccf60
test byte [r10 + 8], 0x40
je 0x1800ce466
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x1800ce466
mov rcx, rbx
call fcn.1800ccf60
add r10, 0x18
cmp r10, rsi
jb 0x1800ce421
movzx eax, byte [rdi + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x1800ce4ab
mov rcx, rdi
call fcn.1800cbda0
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], rdi
and byte [rdi + 9], 0xc7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x1800ce4b5
xor al, 2
mov byte [rdi + 9], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800cf2b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x180280040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.1800bd480
mov rcx, rbp
mov r15d, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
mov rcx, rbx
sub r15d, 1
jne 0x1800cf32e
mov r8d, 1
mov rdx, rbp
call fcn.1800cfb10
mov esi, eax
lea r14d, [r13 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x1800cf4c6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1800bf5f0
jmp 0x1800cf4e3
lea edx, [r15 + 0x14]
lea r8, str.too_many_arguments
call fcn.1800bf2c0
mov esi, 1
mov r14d, r13d
dec r15d
test esi, esi
je 0x1800cf30b
mov edx, r14d
mov rcx, rbx
call fcn.1800be720
mov edx, r14d
mov rcx, rbx
cmp eax, 3
jne 0x1800cf3f5
call fcn.1800bf080
mov rdi, rax
test rax, rax
jne 0x1800cf3a7
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ecx, eax
mov rdx, rbp
mov edi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
lea rdx, [0x180205501]
mov rcx, rbx
call fcn.1800bdb40
xor esi, esi
cmp edi, 0xffffffff
setne sil
jmp 0x1800cf4a4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800befe0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1800bffd0
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.1800bffe0
xor esi, esi
test rdi, rdi
setne sil
jmp 0x1800cf4a4
xor r8d, r8d
call fcn.1800bf110
movzx ecx, byte [rax]
cmp cl, 0x2a
jne 0x1800cf409
movzx ecx, byte [rax + 1]
cmp cl, 0x4c
je 0x1800cf494
cmp cl, 0x61
je 0x1800cf43a
cmp cl, 0x6c
je 0x1800cf432
cmp cl, 0x6e
mov rcx, rbx
jne 0x1800cf4b5
mov rdx, rbp
call fcn.1800cfc40
jmp 0x1800cf4a2
mov r8d, 1
jmp 0x1800cf497
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800befe0
nop word [rax + rax]
mov edx, 0x400
lea rcx, [rsp + 0x20]
call fcn.1800bffd0
mov r9, rbp
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
cmp rax, 0x400
je 0x1800cf450
lea rcx, [rsp + 0x20]
call fcn.1800bffe0
mov esi, 1
jmp 0x1800cf4a4
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.1800cfb10
mov esi, eax
inc r14d
test r15d, r15d
jne 0x1800cf346
jmp 0x1800cf30b
lea r8, str.invalid_format
mov edx, r14d
call fcn.1800beed0
jmp 0x1800cf4e3
test esi, esi
jne 0x1800cf4dd
lea edx, [rsi - 2]
mov rcx, rbx
call fcn.1800be250
mov rcx, rbx
call fcn.1800bdb10
sub r14d, r13d
mov eax, r14d
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1801e4790
add rsp, 0x450
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d3e40
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rsi
push r15
sub rsp, 0x478
mov rax, qword [0x180280040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov qword [r11 - 0x18], rbx
mov r15, rdx
mov qword [r11 - 0x20], rbp
lea rdx, str._s_s
mov qword [r11 - 0x28], rdi
mov rbx, r8
mov qword [r11 - 0x30], r14
mov rsi, rcx
mov r14, r9
lea r9, str._5_4
call fcn.1800bda20
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
jne 0x1800d3eb4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x1800d3fd9
lea r8, str.LUA_NOENV
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.1800bd1f0
mov edx, 0xffffffff
mov rcx, rsi
call fcn.1800be410
mov edx, 0xfffffffe
mov rcx, rsi
mov ebx, eax
call fcn.1800be250
test ebx, ebx
jne 0x1800d3fd9
lea rdx, [0x180216ecc]
mov rcx, rdi
call sub.VCRUNTIME140.dll_strstr
mov rbp, rax
test rax, rax
jne 0x1800d3f0b
mov rdx, rdi
jmp 0x1800d3fdc
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1800d3f12
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800befe0
cmp rdi, rbp
jae 0x1800d3f6e
mov r8, rbp
lea rcx, [rsp + 0x20]
sub r8, rdi
mov rdx, rdi
call fcn.1800bed90
mov rcx, qword [rsp + 0x30]
cmp rcx, qword [rsp + 0x28]
jb 0x1800d3f60
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.1800bffd0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov byte [rax + rcx], 0x3b
inc qword [rsp + 0x30]
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.1800bede0
lea rax, [rdi - 2]
add rax, rbx
cmp rbp, rax
jae 0x1800d3fcd
mov rcx, qword [rsp + 0x30]
cmp rcx, qword [rsp + 0x28]
jb 0x1800d3fa7
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.1800bffd0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
lea rdx, [rbp + 2]
sub rbx, rbp
mov byte [rax + rcx], 0x3b
lea rcx, [rsp + 0x20]
inc qword [rsp + 0x30]
lea r8, [rbx - 2]
add r8, rdi
call fcn.1800bed90
lea rcx, [rsp + 0x20]
call fcn.1800bffe0
jmp 0x1800d3fe4
mov rdx, r14
mov rcx, rsi
call fcn.1800bdb40
mov r8d, 0x105
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r14, qword [rsp + 0x458]
mov rdi, qword [rsp + 0x460]
mov rbp, qword [rsp + 0x468]
mov rbx, qword [rsp + 0x470]
test eax, eax
je 0x1800d407f
cmp eax, 0x105
je 0x1800d407f
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x1800d407f
xor r8d, r8d
mov byte [rax], 0
mov rcx, rsi
lea edx, [r8 - 1]
call fcn.1800be510
mov rdx, rax
lea r9, [rsp + 0x20]
lea r8, [0x180216e90]
mov rcx, rsi
call fcn.1800bf7a0
mov edx, 0xfffffffe
mov rcx, rsi
lea r8d, [rdx + 1]
call fcn.1800bde30
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.1800be250
jmp 0x1800d408e
lea rdx, str.unable_to_get_ModuleFileName
mov rcx, rsi
call fcn.1800bf4a0
mov r8, r15
mov edx, 0xfffffffd
mov rcx, rsi
call fcn.1800bdf20
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.1800be250
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1801e4790
add rsp, 0x478
pop r15
pop rsi
ret
Function at 0x1800d4ed0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x180280040]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.1800d42d0
mov r9, rax
test rax, rax
je 0x1800d4f29
mov r8, qword [rsp + 0x20]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800d50a9
lea rdx, [0x1802171b0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x1800d4f61
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x1800d50a7
cmp edi, 0x78
jne 0x1800d4f63
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800d5210
jmp 0x1800d4f71
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x20]
lea rbp, [0x180215c10]
cmp rax, rbx
je 0x1800d4fb4
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800d4fa2
nop dword [rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800d4f90
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x1800d5093
mov edx, 0x2e
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
mov rsi, rax
test rax, rax
je 0x1800d50a7
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1800d4fd4
cmp rcx, 0xc8
ja 0x1800d50a7
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800d5000
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub rsi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x1800d5037
call fcn.1800d5210
jmp 0x1800d503d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x1800d50a7
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800d5072
nop word [rax + rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800d5060
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x1800d50a7
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x1800d50a7
mov al, reloc.WS2_32.dll_send
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800d50a9
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1801e4790
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800d5210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor esi, esi
lea r11, [0x180215c10]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x1800d527f
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x1800d5270
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x1800d5296
mov r12d, ebp
jmp 0x1800d529f
cmp al, 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x1800d53f9
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x1800d53f9
movsd xmm2, qword [0x180217218]
lea r13, [0x180215c10]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x1800d52fb
test edi, edi
jne 0x1800d5350
mov edi, ebp
inc rdx
jmp 0x1800d52e0
test byte [r8 + r13 + 1], 0x10
je 0x1800d5350
test r10d, r10d
jne 0x1800d5313
cmp r8b, 0x30
jne 0x1800d5313
inc r14d
jmp 0x1800d5344
inc r10d
cmp r10d, 0x1e
jg 0x1800d5341
test byte [rcx + r13 + 1], 2
je 0x1800d5329
add ecx, 0xffffffd0
jmp 0x1800d532f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1800d5344
inc r9d
test edi, edi
je 0x1800d534b
dec r9d
inc rdx
jmp 0x1800d52e0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x1800d53f9
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x1800d53df
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x1800d5387
lea rdx, [r11 + 2]
jmp 0x1800d5391
cmp al, 0x2b
jne 0x1800d538f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x180215c10]
test byte [r8 + r11 + 1], 2
je 0x1800d53f9
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x1800d53b0
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x1800d53eb
xorps xmm1, xmmword [0x180207670]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x1800d53fc
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800db050
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r10, rcx
xor eax, r8d
test rdx, rdx
je 0x1800db081
nop dword [rax]
movzx r9d, byte [r10 + rdx - 1]
mov r8d, eax
shl r8d, 5
mov ecx, eax
add r9d, r8d
shr ecx, 2
add r9d, ecx
xor eax, r9d
sub rdx, 1
jne 0x1800db060
ret
Function at 0x1800db2f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x1800db315
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.1800dad80
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x1800db37d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, socket
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.1800cc230
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.1800d2e60
int3
Function at 0x1800e8600
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180280040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x1800e864f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1803d2b50]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x1800e868d
cmp rsi, r14
jb 0x1800e8685
cmp rsi, r15
jae 0x1800e8685
cmp qword [rsi + 8], 0
jne 0x1800e8857
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800e8670
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800e8722
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800e8719
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e8719
cmp dword [rsp + 0x40], 0x10000
je 0x1800e879b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x1800e8719
sub rbx, rbp
cmp rbx, r14
jae 0x1800e86e0
test rsi, rsi
jne 0x1800e8800
cmp rdi, r15
ja 0x1800e883f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800e883f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e883f
cmp dword [rsp + 0x40], 0x10000
je 0x1800e87d1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800e8752
jmp 0x1800e883f
test rbx, rbx
je 0x1800e8719
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800e8800
cmp rbx, r14
jae 0x1800e86c0
jmp 0x1800e8722
test rdi, rdi
je 0x1800e883f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800e8800
cmp rdi, r15
jbe 0x1800e8730
jmp 0x1800e883f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800e8810
mov rax, qword [0x1803d2b50]
mov qword [rsi], rax
mov qword [0x1803d2b50], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801e4790
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x1800e9080
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1803d2b4c]
mov ebx, edi
test ecx, ecx
je 0x1800e91bb
mov rax, qword [0x1803d2b40]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800e90d8
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800e90b0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800e91bb
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.1800e9420
mov r8d, dword [0x1803d2b4c]
cmp ebx, r8d
jae 0x1800e9148
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1803d2b40]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x1800e9141
mov edx, esi
mov ecx, ebx
call fcn.1800e92f0
mov edi, eax
test eax, eax
jne 0x1800e9148
mov r8d, dword [0x1803d2b4c]
inc ebx
cmp ebx, r8d
jb 0x1800e9110
cmp qword [rsp + 0x20], 0
je 0x1800e91bb
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800e91a7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800e9198
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800e9170
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1803cac30]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret