joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004deb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18004df11
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18004ded0
mov ecx, dword [r9]
jmp 0x18004dffb
cmp ecx, 0x4e0
jb 0x18004dffb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18004df30
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18004df80
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800630d0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov rdi, rcx
mov qword [rcx], rsi
mov rbx, rdx
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov qword [rdi], 0xffffffffffffffff
mov qword [rdi + 0x10], rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x1800631ec
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rdi]
xor r9d, r9d
mov eax, eax
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r8d, 2
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
jne 0x18006319d
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800631bf
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rdi + 0x18], rsi
jmp 0x1800631bf
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x180063231
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800631d2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rsi
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x1800631e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0xffffffffffffffff
mov qword [rdi + 0x10], rsi
xorps xmm0, xmm0
mov byte [rsp + 0x60], 1
lea rax, [0x1800d400e]
lea rbx, vtable.std::exception.0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x58]
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800c6fb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180063260
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x1800632b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180063290
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmova rsi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rdi
jae 0x180067811
mov rcx, qword [rcx + 0x30]
sub rdi, rax
lea rdx, [rax + rcx]
mov rcx, r14
cmp rsi, rdi
ja 0x1800677f8
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x18006782c
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rsi, 0x1000
jae 0x1800678d9
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jns 0x180067887
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180067860
mov r15, qword [rsp + 0x20]
test rdi, rdi
jle 0x1800678a5
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rdi, rsi
jg 0x1800678b7
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
jmp 0x180063260
Function at 0x1800632e0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x48], rcx
lea edi, [rcx + 1]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x18006334f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180063320
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800c6fb0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x1800633b0
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x468
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx eax, word [rcx]
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp ax, 2
je 0x1800633e8
cmp ax, 0x17
jne 0x18006345d
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsi], eax
mov r8d, 0x401
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x40]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x18006345d
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180063442
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18004cd30
mov al, 1
jmp 0x18006345f
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800c6fb0
add rsp, 0x468
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180067650
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rcx + 8]
mov rdi, rcx
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x48], rax
lea esi, [rax + 1]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
nop dword [rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, esi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x1800676cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1800676a0
test ebx, ebx
jle 0x180067771
mov rdi, qword [rdi + 8]
xor eax, eax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 1
nop dword [rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea ecx, [rdi + 1]
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x18006771f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x1800676f0
test ebx, ebx
je 0x18006776d
jns 0x180067730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 9
je 0x180067771
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov r9d, 2
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x180067769
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180067740
test ebx, ebx
jle 0x180067771
mov al, 1
jmp 0x180067773
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800c6fb0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800677a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x1800632b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180063290
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmova rsi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rdi
jae 0x180067811
mov rcx, qword [rcx + 0x30]
sub rdi, rax
lea rdx, [rax + rcx]
mov rcx, r14
cmp rsi, rdi
ja 0x1800677f8
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x18006782c
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rsi, 0x1000
jae 0x1800678d9
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jns 0x180067887
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180067860
mov r15, qword [rsp + 0x20]
test rdi, rdi
jle 0x1800678a5
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rdi, rsi
jg 0x1800678b7
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
jmp 0x180063260
Function at 0x180067900
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x180067939
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x180067966
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180067942
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180067a00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x180067a59
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.1800633b0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800c6fb0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x18006ba10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x18006bb90
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
xor r14d, r14d
mov r8d, r14d
mov qword [rsp + 0x78], r14
mov rcx, qword [rbx + 0x3d8]
test rcx, rcx
je 0x18006ba7a
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax]
mov r8, rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x18], r14
test r8, r8
je 0x18006bacd
lea rax, [rsp + 0x40]
cmp r8, rax
jne 0x18006bac4
mov rax, qword [r8]
lea rdx, [rbp - 0x50]
mov rcx, r8
call qword [rax + 8]
mov qword [rbp - 0x18], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18006bacd
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x18006bac8
mov qword [rbp - 0x18], r8
mov qword [rsp + 0x78], r14
movzx eax, byte [rbx + 0x39c]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1800e4020]
movdqu xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x80], 0
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], al
mov r9d, dword [rbx + 0x398]
mov r8d, edi
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.18007b850
mov rsi, rax
lea rcx, [rbp - 0x80]
call fcn.180040750
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18006bb3d
mov r8, qword [rcx]
lea rax, [rsp + 0x40]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov qword [rsp + 0x78], r14
xchg qword [rbx + 0x48], rsi
mov rax, qword [rbx + 0x48]
cmp rax, 0xffffffffffffffff
je 0x18006bb90
test edi, edi
jne 0x18006bb8c
mov dword [rbp - 0x58], 0x80
mov rcx, qword [rbx + 0x48]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x50]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x18006bb90
movzx eax, word [rbp - 0x50]
cmp ax, 2
je 0x18006bb7d
cmp ax, 0x17
jne 0x18006bb90
movzx ecx, word [rbp - 0x4e]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
jmp 0x18006bb95
mov eax, edi
jmp 0x18006bb95
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1800c6fb0
add rsp, 0x140
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180075d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180075db4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180075da0
ret
Function at 0x180085630
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov ecx, 8
call fcn.1800c7724
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18008df60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1800856a9
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800c6fb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800858d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov rbp, rcx
sar rdi, 2
test rdi, rdi
je 0x180085aaf
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x60], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x180085920
mov eax, listen
jmp 0x18008594e
cmp rdi, 0x44
jb 0x18008592d
mov eax, 7
jmp 0x18008594e
cmp rdi, 0x27
jb 0x18008593a
mov eax, 5
jmp 0x18008594e
cmp rdi, 7
jb 0x180085947
mov eax, 3
jmp 0x18008594e
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x180085967
mov r15, rdi
mov r8, rdi
mov edx, 0x8b8b8b8b
shl r8, 2
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x180085a1f
mov qword [rsp + 0x58], r12
nop dword [rax + rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea r12, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [r12]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x1800859dd
mov rax, rbx
jmp 0x1800859f2
cmp rcx, rbx
ja 0x1800859ef
mov rax, qword [rbp]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x1800859f2
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [r12], r8d
cmp rcx, r15
jb 0x180085990
mov r12, qword [rsp + 0x58]
add r15, rdi
cmp rcx, r15
jae 0x180085a9b
inc r14
lea rbp, [rcx - 1]
inc r13
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x180085a31
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x18008c060
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x18008c125
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x18008c125
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x18008c13e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x18008c115
cmp byte [rcx], 0x5c
jne 0x18008c10e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x18008c10e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x18008c0fc
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x18008c10b
test r8b, 0x10
jne 0x18008c10e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x18008c10e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.180084fa0
test edi, edi
jne 0x18008c080
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.180084f90
int3
Function at 0x1800a7db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
xor ebx, ebx
mov qword [rsp + 0x38], rbx
nop dword [rax]
nop dword [rax + rax]
mov r9d, ebx
mov r8, qword [0x1801c55f0]
mov rdx, qword [rsi]
mov rcx, rbp
call fcn.180095260
movss dword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x30]
cmp rdx, qword [rsp + 0x38]
je 0x1800a7e23
movss dword [rdx], xmm0
add qword [rsp + 0x30], 4
jmp 0x1800a7e32
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1800a7f00
inc ebx
cmp ebx, 0x10
jl 0x1800a7df0
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
mov dword [rdi], eax
mov eax, dword [rcx + 4]
mov dword [rdi + 4], eax
mov eax, dword [rcx + 8]
mov dword [rdi + 8], eax
mov eax, dword [rcx + 0xc]
mov dword [rdi + 0xc], eax
mov eax, dword [rcx + 0x10]
mov dword [rdi + 0x10], eax
mov eax, dword [rcx + 0x14]
mov dword [rdi + 0x14], eax
mov eax, dword [rcx + 0x18]
mov dword [rdi + 0x18], eax
mov eax, dword [rcx + 0x1c]
mov dword [rdi + 0x1c], eax
mov eax, dword [rcx + 0x20]
mov dword [rdi + 0x20], eax
mov eax, dword [rcx + 0x24]
mov dword [rdi + 0x24], eax
mov eax, dword [rcx + 0x28]
mov dword [rdi + 0x28], eax
mov eax, dword [rcx + 0x2c]
mov dword [rdi + 0x2c], eax
mov eax, dword [rcx + 0x30]
mov dword [rdi + 0x30], eax
mov eax, dword [rcx + 0x34]
mov dword [rdi + 0x34], eax
mov eax, dword [rcx + 0x38]
mov dword [rdi + 0x38], eax
mov eax, dword [rcx + 0x3c]
mov dword [rdi + 0x3c], eax
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a7ed0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a7ed0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800c721c
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800c6fb0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret