joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801841d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x1801841e7
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801841fb
test al, 0x10
je 0x1801841fb
mov dil, 1
jmp 0x1801841fe
xor dil, dil
mov rcx, rbx
call fcn.18000aef0
mov rbx, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret

Function at 0x180184220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x180184237
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180184252
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180184252
mov dil, 1
jmp 0x180184255
xor dil, dil
mov rcx, rbx
call fcn.18000aef0
mov rbx, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret

Function at 0x180184270
Capabilities:
Get file size

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1803bc678]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [r11 - 0x20], rcx
cmp qword [rcx + 0x18], 8
jb 0x1801842a8
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x180184327
mov rdi, rbx
cmp qword [rbx + 0x18], 8
jb 0x1801842f5
mov rdi, qword [rbx]
call fcn.180177ad0
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r9, str.File_not_exists:__s
lea r8, [0x18022a78c]
mov edx, Ordinal_50
call fcn.180177be0
nop
mov rcx, rbx
call fcn.18000aef0
xor eax, eax
jmp 0x18018433b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rbx
call fcn.18000aef0
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e5c70
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x180185790
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov eax, 0x40
mov edx, dword [rdx]
mov rdi, rcx
and edx, 0x3f
mov byte [rdx + rbx + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x1801857e9
mov r8d, eax
lea rcx, [rbx + 0x18]
mov eax, edx
xor edx, edx
add rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
lea rdx, [rbx + 0x18]
mov rcx, rbx
call fcn.1801859b0
xor edx, edx
mov eax, 0x40
add eax, 0xfffffff8
lea rcx, [rbx + 0x18]
mov r8d, eax
mov eax, edx
xor edx, edx
add rcx, rax
call sub.VCRUNTIME140.dll_memset
shl dword [rbx], 3
lea rdx, [rbx + 0x18]
mov eax, dword [rbx]
mov r8d, 0x40
mov byte [rbx + 0x50], al
mov rcx, rbx
mov eax, dword [rbx]
shr eax, 8
mov byte [rbx + 0x51], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x52], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x53], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x54], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [rbx + 0x55], al
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x56], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0x57], al
call fcn.1801859b0
movzx eax, byte [rbx + 8]
xor edx, edx
mov byte [rdi], al
mov r8d, 0x98
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [rdi + 1], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 0xb]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 4], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 8], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xc], al
mov eax, dword [rbx + 0x14]
shr eax, 8
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xf], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp sub.VCRUNTIME140.dll_memset
Function at 0x180186480
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x100
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x138], rbx
mov rax, qword [0x1803bc678]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], dil
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x48], 0x67452301
mov dword [rsp + 0x4c], 0xefcdab89
mov dword [rsp + 0x50], 0x98badcfe
mov dword [rsp + 0x54], 0x10325476
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x40]
call fcn.1801858e0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.180185790
lea ebp, [rdi + 0x57]
nop word [rax + rax]
movzx esi, byte [rsp + rdi + 0xe0]
movzx eax, sil
shr al, 4
mov ecx, gethostbyname
cmp al, 0xa
cmovae ecx, ebp
add cl, al
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rdx, r8
jae 0x180186566
lea rax, [rdx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r8, 0x10
jb 0x18018655c
mov rax, qword [rbx]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x18018657b
xor eax, eax
movzx r9d, cl
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rbx
call fcn.180185630
and sil, 0xf
mov eax, gethostbyname
cmp sil, 0xa
cmovae eax, ebp
add al, sil
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rdx, r8
jae 0x1801865b9
lea rcx, [rdx + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp r8, 0x10
jb 0x1801865af
mov rcx, qword [rbx]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x1801865ce
xor ecx, ecx
movzx r9d, al
movzx r8d, cl
lea edx, [rcx + 1]
mov rcx, rbx
call fcn.180185630
inc rdi
cmp rdi, 0x10
jb 0x180186520
mov rax, rbx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1801e5c70
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x180186890
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x350], rbx
mov rax, qword [0x1803bc678]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r13, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x48], 0x67452301
mov dword [rsp + 0x4c], 0xefcdab89
mov dword [rsp + 0x50], 0x98badcfe
mov dword [rsp + 0x54], 0x10325476
mov ebx, r15d
mov dword [rsp + 0x40], ebx
mov r14d, r15d
mov dword [rsp + 0x44], r15d
mov r9, rdx
lea edx, [r15 + 1]
mov r8d, 0x200
lea rcx, [rbp - 0x10]
call qword [0x180225ce8]
mov rsi, rax
test rax, rax
je 0x180186a0c
nop dword [rax]
nop word [rax + rax]
lea r12, [rbp - 0x10]
lea eax, [rbx + rsi]
and eax, 0x1fffffff
mov dword [rsp + 0x40], eax
cmp eax, ebx
jae 0x180186957
inc r14d
mov eax, esi
shr eax, 0x1d
add r14d, eax
mov dword [rsp + 0x44], r14d
and ebx, 0x3f
je 0x1801869af
mov r14d, 0x40
sub r14d, ebx
mov eax, ebx
lea rcx, [rsp + 0x58]
lea rdx, [rbp - 0x10]
add rcx, rax
cmp esi, r14d
jb 0x1801869d6
mov ebx, r14d
mov r8d, r14d
call sub.VCRUNTIME140.dll_memcpy
lea r12, [rbp - 0x10]
add r12, rbx
sub esi, r14d
mov r8d, 0x40
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.1801859b0
cmp esi, 0x40
jb 0x1801869ce
mov r8d, esi
and r8d, 0xffffffc0
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1801859b0
mov r12, rax
and esi, 0x3f
mov rdx, r12
lea rcx, [rsp + 0x58]
mov r8d, esi
call sub.VCRUNTIME140.dll_memcpy
mov r9, r13
mov edx, 1
mov r8d, 0x200
lea rcx, [rbp - 0x10]
call qword [0x180225ce8]
mov rsi, rax
test rax, rax
je 0x180186a0c
mov r14d, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x40]
jmp 0x180186940
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.180185790
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], r15b
mov dword [rsp + 0x20], 1
mov esi, 0x57
nop word [rax + rax]
movzx ebx, byte [rbp + r15 - 0x20]
movzx eax, bl
shr al, 4
mov ecx, gethostbyname
cmp al, 0xa
cmovae ecx, esi
add cl, al
mov rdx, qword [rdi + 0x10]
mov r8, qword [rdi + 0x18]
cmp rdx, r8
jae 0x180186a83
lea rax, [rdx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp r8, 0x10
jb 0x180186a79
mov rax, qword [rdi]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x180186a98
xor eax, eax
movzx r9d, cl
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rdi
call fcn.180185630
and bl, 0xf
mov ecx, gethostbyname
cmp bl, 0xa
cmovae ecx, esi
add cl, bl
mov rdx, qword [rdi + 0x10]
mov r8, qword [rdi + 0x18]
cmp rdx, r8
jae 0x180186ad3
lea rax, [rdx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp r8, 0x10
jb 0x180186ac9
mov rax, qword [rdi]
mov byte [rax + rdx], cl
mov byte [rax + rdx + 1], 0
jmp 0x180186ae8
xor eax, eax
movzx r9d, cl
movzx r8d, al
lea edx, [rax + 1]
mov rcx, rdi
call fcn.180185630
inc r15
cmp r15, 0x10
jb 0x180186a40
mov rax, rdi
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1801e5c70
mov rbx, qword [rsp + 0x350]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180189000
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov eax, r9d
mov rdi, r8
mov r9, qword [rcx]
mov rsi, rdx
add r9, 0x208
cmp qword [r9 + 0x18], 8
jb 0x180189025
mov r9, qword [r9]
cmp qword [r8 + 0x18], 8
mov rdx, rdi
jb 0x180189032
mov rdx, qword [r8]
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x18018903f
mov rcx, qword [rsi]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov rcx, rsi
mov ebx, eax
call fcn.18000aef0
mov rcx, rdi
call fcn.18000aef0
mov eax, ebx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x1801892e0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1803bc678]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, r9
mov r15, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov r14, qword [rsp + 0xc0]
mov qword [rsp + 0x48], r14
lea rdi, [rcx + 8]
xor edx, edx
mov r8d, 0x200
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
add rbx, 0x208
cmp qword [rbx + 0x18], 8
jb 0x18018934d
mov rbx, qword [rbx]
mov r8, r14
cmp qword [r14 + 0x18], 8
jb 0x18018935a
mov r8, qword [r14]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180189367
mov rdx, qword [rsi]
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180189374
mov rcx, qword [r15]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x200
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 7
mov word [rbp], ax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], ax
jne 0x1801893a3
mov rdx, rdi
mov rcx, rbp
call fcn.18000aad0
nop
mov rcx, r15
call fcn.18000aef0
nop
mov rcx, rsi
call fcn.18000aef0
nop
mov rcx, r14
call fcn.18000aef0
mov rax, rbp
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e5c70
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18019e0c0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x1803bc678]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
cmp dword [0x1803ea7b8], 0
jne 0x18019e185
mov rax, qword [0x180225ae8]
mov qword [fcn.1801e7acc], rax
mov rax, qword [0x180225ad8]
mov qword [0x1803bc5a0], rax
mov rax, qword [0x180225ae0]
mov qword [0x1803bc5a8], rax
mov rax, qword [0x180225d40]
mov qword [case.0x1801a65c6.0], rax
mov rax, qword [0x180225af8]
mov qword [case.0x1801a65c6.1], rax
mov dword [0x1803ea7b8], 1
call fcn.1801abdd0
test eax, eax
je 0x18019e1bd
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x18019e1bd
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x18019e1b7
shr ax, 8
cmp al, 2
jne 0x18019e1b7
call fcn.1801aa780
test eax, eax
jne 0x18019e1bd
call fcn.1801a6a30
test eax, eax
jne 0x18019e1bd
mov dword [0x1803ea7bc], 3
call fcn.1801b5e60
lea rcx, [rsp + 0x20]
call fcn.1801adc00
mov rcx, qword [rsp + 0x20]
xor edx, edx
test eax, eax
cmovne rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1801e5c70
add rsp, 0x1e8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1801e5c70
add rsp, 0x1e8
ret
Function at 0x1801a75e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x1801a75ec
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
add rdx, 4
mov r8, rax
mov ecx, 2
jmp fcn.1801c3c30
Function at 0x1801b3730
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1801b3767
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov dword [rbx], eax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1801b3c00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov r15, r8
mov rcx, qword [rcx + 0x240]
mov eax, 0x238
cmp rdx, rcx
mov r8d, 0x240
mov ebx, 0x280
mov r14, r9
cmove eax, r8d
mov rbp, qword [rax + rdi]
mov eax, 0x2a0
cmove ebx, eax
mov rax, qword [rdi + 0x3f0]
add rbx, rdi
xor r12d, r12d
mov rsi, qword [rbx + 8]
sub rsi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1801b3d15
cmp rdx, rcx
mov eax, 0x260
mov r8d, 0x268
lea rcx, [0x1801b37b0]
cmove eax, r8d
cmp qword [rax + rdi], rcx
jne 0x1801b3d15
cmp qword [rbx], r12
je 0x1801b3c9d
test rsi, rsi
je 0x1801b3d15
or r8, 0xffffffffffffffff
xor r9d, r9d
or rdx, r8
mov rcx, rbp
call fcn.1801b2bc0
cmp eax, 0xffffffff
je 0x1801b3d15
test al, 1
je 0x1801b3d15
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1801b3cef
mov rax, qword [rdi]
mov ecx, dword [rax + 0x6f0]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [fcn.1801e7acc]
mov rsi, qword [rbx + 8]
mov rcx, rax
mov qword [rbx], rax
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
test rax, rax
je 0x1801b3d11
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1801b3d15
cdqe
add qword [rbx + 0x10], rax
jmp 0x1801b3d15
mov qword [rbx + 8], r12
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1801b3d7d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1801b3d4a
mov rax, qword [rsp + 0x60]
mov dword [rax], r12d
lea eax, [rsi + 0x52]
jmp 0x1801b3d87
mov edx, ebx
mov rcx, rdi
call fcn.1801d9b30
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1801b3450
mov rax, qword [rdi]
mov dword [rax + 0x4c7c], ebx
mov rax, qword [rsp + 0x60]
mov dword [rax], esi
mov eax, gethostname
jmp 0x1801b3d87
mov rcx, qword [rsp + 0x60]
mov eax, r12d
mov dword [rcx], esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1801b4060
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2c0], 0
je 0x1801b407d
call fcn.1801ab500
test eax, eax
jne 0x1801b40a8
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x238]
cmp rcx, 0xffffffffffffffff
je 0x1801b4076
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x1801b40a8
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
Function at 0x1801c3b10
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
lea r8, [rsp + 0x40]
mov rdi, rcx
mov rdx, rcx
xor ebx, ebx
lea ecx, [rbx + 2]
call fcn.1801c35f0
test eax, eax
jle 0x1801c3b5d
mov r9d, esi
lea rdx, [rsp + 0x40]
mov r8, rdi
lea ecx, [rbx + 2]
call fcn.1801c38c0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1801c3b78
mov edx, esi
mov rcx, rax
call fcn.1801c3760
mov rbx, rax
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1801c3ba0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
cmovbe rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1801c4030
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1801c405a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180232c78]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbspbrk]
test rax, rax
je 0x1801c40be
mov rcx, rbx
test r14, r14
je 0x1801c40a8
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1801c40f6
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801c40f6
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1801c41b8
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1801c4120
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.1801e7acc]
mov rdi, rax
test rax, rax
je 0x1801c41aa
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1801c41aa
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1801c4150
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x1801c4164
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1801c4180
mov rcx, rdi
test r14, r14
je 0x1801c41a1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1801c41a7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [0x1803bc5a0]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x1801c68b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1803bc678]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1801c6917
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1801c6917
lea rcx, [rsp + 0x20]
call qword [case.0x1801a65c6.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801e5c70
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801e5c70
add rsp, 0x148
ret
Function at 0x1801c8a70
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x238]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1801c8acf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1801b3450
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1801c8600
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1801c8c80
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1801c8e2d
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1f8]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1801c8cce
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
jmp 0x1801c8cd1
mov rax, rsi
cmp rax, rbx
jae 0x1801c8cea
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1801c8cea
mov byte [rax], Ordinal_33
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1801c8d21
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1801c8d77
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801c8d77
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801c8d77
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801c8d77
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1801c8d77
mov byte [r9], 0xf0
inc qword [rbx]
mov r9, qword [rbx]
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1801c8730
mov rcx, qword [r14 + 0x238]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1801c8dd9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1801b3450
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1801c8b00
mov rcx, qword [r14 + 0x238]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1801c8e25
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1801b3450
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret