joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004f2a2
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
movsxd rbx, dword [rcx + 0x20]
mov rsi, rcx
lea r14, [rax + 8]
test rax, rax
cmove r14, rax
test rbx, rbx
je 0x18004f2fc
mov edi, ebx
shl rbx, 3
xor r15d, r15d
mov rcx, qword [r14 + r15]
call fcn.18004ee0a
add rdi, rax
or eax, 1
add r15, 8
lzcnt eax, eax
xor eax, 0x1f
lea eax, [rax + rax*8 + 0x49]
shr eax, 6
add rdi, rax
cmp rbx, r15
jne 0x18004f2d1
jmp 0x18004f2fe
xor edi, edi
mov eax, dword [rsi + 0x10]
test al, 3
je 0x18004f333
lea rcx, [rdi + 9]
test al, 1
cmovne rdi, rcx
test al, 2
je 0x18004f333
movsxd rax, dword [rsi + 0x38]
or rax, 1
lzcnt rax, rax
xor rax, 0x3f
lea rax, [rax + rax*8 + 0x89]
shr rax, 6
add rdi, rax
mov rax, qword [rsi + 8]
test al, 1
je 0x18004f343
and rax, 0xfffffffffffffffc
add rdi, qword [rax + 0x18]
mov rcx, rsi
mov edx, edi
call fcn.180030316
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180066578
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov ebx, dword [rcx + 0x18]
mov rsi, rcx
add rcx, 0x28
lea r14d, [rbx*4]
call fcn.18007e4c0
mov edi, dword [rsi + 0x28]
mov ecx, dword [rsi + 0x40]
add rax, rbx
add rax, r14
add rdi, rcx
add rdi, rax
test ecx, ecx
jle 0x1800665e1
mov rax, qword [rsi + 0x48]
xor edx, edx
mov r8, qword [rax + rdx*8 + 8]
inc rdx
mov r8, qword [r8 + 0x10]
add rdi, r8
or r8d, 1
lzcnt r8d, r8d
xor r8d, 0x1f
lea r8d, [r8 + r8*8 + 0x49]
shr r8d, 6
add rdi, r8
cmp rcx, rdx
jne 0x1800665b4
mov ebx, dword [rsi + 0x10]
test bl, 0x7f
je 0x1800666ad
test bl, 1
je 0x180066617
mov rax, qword [rsi + 0x50]
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
add rdi, rax
or eax, 1
lzcnt eax, eax
xor eax, 0x1f
lea eax, [rax + rax*8 + 0x49]
shr eax, 6
lea rdi, [rax + rdi + 1]
test bl, 2
je 0x180066641
mov rax, qword [rsi + 0x58]
and rax, 0xfffffffffffffffc
mov rax, qword [rax + 0x10]
add rdi, rax
or eax, 1
lzcnt eax, eax
xor eax, 0x1f
lea eax, [rax + rax*8 + 0x49]
shr eax, 6
lea rdi, [rax + rdi + 1]
test bl, 4
je 0x180066668
mov rcx, qword [rsi + 0x60]
call fcn.180065948
add rdi, rax
or eax, 1
lzcnt eax, eax
xor eax, 0x1f
lea eax, [rax + rax*8 + 0x49]
shr eax, 6
lea rdi, [rax + rdi + 1]
lea rax, [rdi + 9]
test bl, 8
cmove rax, rdi
test bl, 0x10
je 0x180066697
movsxd rcx, dword [rsi + 0x70]
or rcx, 1
lzcnt rcx, rcx
xor rcx, 0x3f
lea rcx, [rcx + rcx*8 + 0x49]
shr rcx, 6
lea rax, [rax + rcx + 1]
lea rcx, [rax + 5]
test bl, 0x20
cmove rcx, rax
test bl, 0x40
lea rdi, [rcx + 5]
cmove rdi, rcx
mov rax, qword [rsi + 8]
test al, 1
je 0x1800666bd
and rax, 0xfffffffffffffffc
add rdi, qword [rax + 0x18]
mov rcx, rsi
mov edx, edi
call fcn.180030316
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x180087c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor edi, edi
xor r9d, r9d
mov rsi, rdx
mov r11, rcx
movabs rbp, 0x8080808080808080
movabs r14, 0x2525252525252525
movabs r15, 0x3f3f3f3f3f3f3f3f
movabs r12, 0x2020202020202020
cmp rdx, 7
jbe 0x180087cb6
mov r10d, 7
mov rax, rcx
sub r10, rcx
nop word [rax + rax]
mov r8, qword [rax]
lea rax, [rax + 8]
mov rcx, r8
add r9, 8
and rcx, rbp
or rdi, rcx
lea rcx, [r8 + r15]
lea rdx, [r8 + r14]
xor rdx, rcx
lea rcx, [r10 + rax]
shr rdx, 2
and rdx, r12
xor rdx, r8
mov qword [rax - 8], rdx
cmp rcx, rsi
jb 0x180087c80
cmp r9, rsi
jae 0x180087d1d
sub rsi, r9
mov qword [rsp + 0x50], rbx
lea rbx, [r9 + r11]
mov qword [rsp + 0x58], 0
mov rdx, rbx
lea rcx, [rsp + 0x58]
mov r8, rsi
call fcn.180282cf0
mov r8, qword [rsp + 0x58]
mov rcx, rbx
mov rax, r8
and rax, rbp
or rdi, rax
lea rax, [r8 + r15]
lea rdx, [r8 + r14]
xor rdx, rax
shr rdx, 2
and rdx, r12
xor r8, rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], r8
mov r8, rsi
call fcn.180282cf0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
test rdi, rdi
sete al
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18009af80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18009afb1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18009b02b
mov rdi, r14
mov rcx, rbx
call fcn.180099c00
test rax, rax
jle 0x18009b003
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.180282cf0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18009b01b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x18009b023
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18009afc5
sub r14, rdi
jmp 0x18009b10f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18009b042
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18009b044
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18009b076
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180282cf0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18009b10c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18009b0b1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18009b0ed
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18029e5dc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18009b10c
cmp rbp, rax
ja 0x18009b0c0
test rbp, rbp
je 0x18009b10c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18029e5dc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18009df80
Capabilities:
Encode data using xor

Disassembly:
mov byte [rsp + 0x18], 0
mov r9, rdx
test r8, r8
je 0x18009dfad
sub rcx, rdx
movzx edx, byte [rcx + r9]
xor dl, byte [r9]
lea r9, [r9 + 1]
movzx eax, byte [rsp + 0x18]
or dl, al
mov byte [rsp + 0x18], dl
sub r8, 1
jne 0x18009df90
movzx ecx, byte [rsp + 0x18]
lea eax, [rcx - 1]
not cl
shr al, 7
shr cl, 7
and al, cl
neg al
ret
Function at 0x1800aa9f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
cmp qword [rdx + 0x110], 0xffffffffffffffff
mov ebp, r9d
mov rdi, r8
mov dword [rsp + 0x30], 1
mov rbx, rdx
mov rsi, rcx
je 0x1800aaa2c
mov eax, 0xfffff00e
jmp 0x1800aab92
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1800aaa4f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800aab92
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1800aaa6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800aab92
mov rdx, qword [rsi + 0x38]
xor r9d, r9d
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x1800aaa93
cmp dword [rsp + 0x70], eax
je 0x1800aaa63
or dword [rbx + 0x58], 0x80000
mov ecx, dword [0x18043c060]
cmp ebp, 0x17
mov eax, dword [rbx + 0x58]
cmove ecx, dword [0x18043c064]
bt eax, 0x13
jb 0x1800aaac9
test ecx, ecx
jne 0x1800aaac9
mov dl, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x1800aaa63
or dword [rbx + 0x58], 0x20000
mov eax, dword [rbx + 0x58]
bt eax, 0x18
jae 0x1800aab09
mov edx, 6
mov dword [rsp + 0x58], 1
lea r9, [rsp + 0x58]
mov dword [rsp + 0x20], 4
mov rcx, rdi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1800aab09
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x1800aab92
test dword [rbx + 0x58], 0x2000000
je 0x1800aab7d
lea r9, [rsp + 0x58]
mov dword [rsp + 0x38], 0x3c
mov edx, 0xffff
mov dword [rsp + 0x58], 1
mov r8d, 8
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800aab73
cmp dword [rsp + 0x58], 0
je 0x1800aab7d
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov rcx, rdi
lea r8d, [rdx - 3]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1800aab7d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x1800aab92
mov qword [rbx + 0x110], rdi
cmp ebp, 0x17
jne 0x1800aab90
or dword [rbx + 0x58], 0x400000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1800ab010
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
xorps xmm0, xmm0
lea rbx, [rdx + 0x80]
movups xmmword [rbx + 0x40], xmm0
lea r14, [rbx + 0x40]
xor r15d, r15d
movups xmmword [r14 + 0x10], xmm0
or dword [rdx + 0x58], 0x40000
lea rax, [0x18043b1d8]
movups xmmword [r14], xmm0
mov rbp, rdx
mov rdi, rcx
movups xmmword [r14 + 0x10], xmm0
test dword [rdx + 0x58], 0x80000
lea rsi, [rbx + 0x70]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r15d
je 0x1800ab079
mov rax, qword [rsi]
or rax, 1
mov qword [rbx + 0x58], rax
mov rcx, qword [rbp + 0x110]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x90]
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x88], r15d
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [rbp + 0x58]
inc dword [rbp + 0x78]
bts ecx, 0x10
mov dword [rbp + 0x58], ecx
test eax, eax
jne 0x1800ab100
bt ecx, 0x11
jae 0x1800ab13d
mov eax, dword [rsp + 0x90]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x68], r15
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x1800ab1aa
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rdi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x1800ab1ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1800ab139
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x1800ab124
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cdqe
mov qword [r14], rax
jmp 0x1800ab0da
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [r14], rax
jmp 0x1800ab0da
lea rsi, [rbx + 0x70]
test dword [rbp + 0x58], 0x80000
je 0x1800ab1b2
cmp qword [rbx + 0x78], 0xffffffffffffffff
lea rcx, [rbx + 0x78]
jne 0x1800ab1b2
mov rdx, qword [rsi]
lea r8, [0x1800aacd0]
mov dword [rsp + 0x28], 4
mov r9, rbx
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1800ab1b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1800ab192
call qword [sym.imp.KERNEL32.dll_GetLastError]
cdqe
mov qword [r14], rax
jmp 0x1800ab0da
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [r14], rax
jmp 0x1800ab0da
mov qword [rbx + 0x68], rbx
mov qword [rdi + 0x48], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800b2830
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1800b2912
call fcn.180120060
test al, al
jne 0x1800b2912
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1800b2862
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.18012df70
test rax, rax
je 0x1800b28a7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.18012df70
mov rsi, rax
test rax, rax
je 0x1800b28a7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1800b28db
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1800c5f80
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1800b28c0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800b3a80
Capabilities:
Convert ip address from string

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
je 0x1800b3ab9
cmp byte [rdx], 0
je 0x1800b3ab9
lea r8, [rsp + 0x38]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x1800b3ab3
mov eax, 0x2b
add rsp, 0x20
pop rbx
ret
mov ecx, dword [rsp + 0x38]
jmp 0x1800b3abf
xor ecx, ecx
mov dword [rsp + 0x38], ecx
cmp qword [rbx + 0x20], 0
je 0x1800b3adb
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rbx + 0x20]
mov edx, eax
mov rcx, qword [rcx + 0x70]
call fcn.18012f1e0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800b3af0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
test rdx, rdx
je 0x1800b3b31
cmp byte [rdx], 0
je 0x1800b3b31
lea r8, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x1800b3b4e
mov eax, 0x2b
jmp 0x1800b3b67
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x60], al
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800b3b65
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x20]
call fcn.18012f220
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800a5910
add rsp, 0x80
pop rbx
ret
Function at 0x1800b8840
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rdx + 0x10]
mov rbx, rcx
mov rax, qword [rdx + 0x18]
lea rcx, str.SSL_PROXY
cmp qword [rdx], rcx
jne 0x1800b8887
mov rdi, qword [rax + 0x128]
mov rsi, qword [rax + 0x130]
mov ebp, dword [rax + 0x138]
jmp 0x1800b889b
mov rdi, qword [rax + 0xa0]
mov rsi, qword [rax + 0xa8]
mov ebp, dword [rax + 0x630]
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x1800b8a5b
mov r9, qword [rbx]
test r9, r9
je 0x1800b88db
mov r8, r9
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800b88d3
inc rax
test ecx, ecx
jne 0x1800b88c0
test edx, edx
je 0x1800b8a5b
mov rcx, qword [rbx + 8]
cmp rcx, r9
je 0x1800b88ea
call qword [fcn.18029e85c]
mov rcx, qword [rbx + 0x10]
call qword [fcn.18029e85c]
mov rcx, qword [rbx]
call qword [fcn.18029e85c]
xor r15d, r15d
mov rcx, rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
call qword [case.0x1800bb9ff.1]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x1800b895e
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800b8932
call qword [fcn.18029e85c]
mov rcx, qword [rbx + 0x10]
call qword [fcn.18029e85c]
mov rcx, qword [rbx]
call qword [fcn.18029e85c]
mov eax, 0x1b
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov byte [rbx + 0x18], r15b
jmp 0x1800b8a61
test rsi, rsi
je 0x1800b89a2
mov r8, rsi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rdi]
movzx eax, byte [rdi + r8]
sub edx, eax
jne 0x1800b8983
inc rdi
test eax, eax
jne 0x1800b8970
test edx, edx
je 0x1800b89a2
mov rcx, rsi
call qword [case.0x1800bb9ff.1]
mov qword [rbx + 8], rax
test rax, rax
jne 0x1800b89a6
cmp qword [rbx], r15
je 0x1800b8932
xor ecx, ecx
jmp 0x1800b892c
mov qword [rbx + 8], rcx
mov rdi, qword [rbx]
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x1800b89e7
cmp byte [rdi], r15b
je 0x1800b89e7
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x1800b89e3
lea r8, [rsp + 0x20]
mov rdx, rdi
lea ecx, [rax + 0x17]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1800b89e7
mov cl, 1
jmp 0x1800b89e9
xor cl, cl
mov rax, qword [rbx]
mov byte [rbx + 0x18], cl
cmp byte [rax], r15b
je 0x1800b8a5b
test cl, cl
jne 0x1800b8a5b
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], r15b
jne 0x1800b8a00
test rdi, rdi
je 0x1800b8a18
cmp byte [rax + rdi - 1], 0x2e
jne 0x1800b8a18
dec rdi
cmp rdi, 0xffff
jae 0x1800b8a5b
lea rdx, [rdi + 1]
mov ecx, 1
call qword [fcn.18029d644]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1800b8a45
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx]
jmp 0x1800b892a
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rax
call fcn.1800c5fd0
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax], r15b
mov dword [r14 + 0x50], ebp
xor eax, eax
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800a5910
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c3d60
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1800c3d8a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x1803d4d48]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1803c7fec]
mov rcx, rbx
mov r14, rax
call fcn.1802a4f30
test rax, rax
je 0x1800c3de9
mov rcx, rbx
test r14, r14
je 0x1800c3dd6
xor edx, edx
lea r8d, [rdx + 8]
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x1800c3e20
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800c3e20
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x1800c3eea
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x1800c3e50
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [fcn.1802a0554]
mov rsi, rax
test rax, rax
je 0x1800c3edc
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800c3edc
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1800c3e83
mov dword [rsi + rax*2], 0x5c
cmp word [rsi + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x1800c3e95
lea rcx, [rdi + rdi]
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1800c3eb0
mov rcx, rsi
test r14, r14
je 0x1800c3ed3
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1800c3ed9
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [fcn.18029e85c]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800cb7d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rbp, rcx
je 0x1800cb820
mov qword [rdx + 0x238], 0
lea rcx, [0x1800cb5a0]
mov rdx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
jmp 0x1800cb8b3
lea rcx, [rdi + 0x40]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
test dword [rdx + 0x58], 0x80000
je 0x1800cb843
mov rax, qword [rdi + 0x70]
or rax, 1
mov qword [rdi + 0x58], rax
mov qword [rsp + 0x20], rcx
lea rdx, [0x18043b550]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800cb873
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1800cb8b7
test dword [rbx + 0x58], 0x80000
je 0x1800cb916
cmp qword [rdi + 0x78], 0xffffffffffffffff
lea rcx, [rdi + 0x78]
jne 0x1800cb916
mov rdx, qword [rdi + 0x70]
lea r8, [0x1800aacd0]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1800cb916
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1800cb8c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800cb8d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
mov rdx, rdi
mov ecx, 0x40
cdqe
mov qword [rcx + rdx], rax
mov qword [rdi + 0x68], 0
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1800cb90c
mov rax, qword [rax + 0x68]
mov qword [rdi + 0x68], rax
mov rax, qword [rbp + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rbp + 0x48], rdi
jmp 0x1800cb935
mov qword [rdi + 0x68], rdi
mov qword [rbp + 0x48], rdi
jmp 0x1800cb935
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x1800cb935
xor r9d, r9d
lea rdx, [0x1800cafc0]
lea r8d, [r9 + 0x32]
call fcn.1800ac960
or dword [rbx + 0x58], 0x10000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800cc790
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edx, dword [rcx + 0x58]
mov rbx, rcx
mov ecx, edx
btr ecx, 0xc
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x1800cc7e1
test cl, 1
jne 0x1800cc7e1
test dl, 4
je 0x1800cc7e1
mov eax, edx
and eax, 0xffffeffb
mov dword [rbx + 0x58], eax
test al, 8
je 0x1800cc7e1
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x88], rdi
bt eax, 0x10
jae 0x1800cc873
bt eax, 0x19
jae 0x1800cc83c
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x40]
xor eax, eax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x70], eax
xorps xmm0, xmm0
mov eax, reloc.WS2_32.dll_recv
movups xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x60], ax
lea r8d, [rax - 0xf]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1800cc873
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800cc875
bt eax, 0x15
jb 0x1800cc873
lea rcx, [0x18043b5a8]
xor edi, edi
call fcn.1800c95c0
mov eax, 2
xchg dword [0x18043b560], eax
cmp eax, 1
je 0x1800cc89b
lea rcx, [0x18043b5a8]
call fcn.1800c9590
or dword [rbx + 0x58], 0x200000
xor eax, eax
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800a5910
add rsp, 0x90
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0xb0], rsi
lea rcx, str.conout_
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov qword [rsp + 0x80], r14
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800cc8fe
lea rdx, [0x18043b568]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1800cc8fe
lock or dword [0x18043b564], 1
mov ebp, 1
mov dword [rsp + 0x50], 0xd0001
mov r14d, reloc.WS2_32.dll_listen
mov word [rsp + 0x48], bp
mov ecx, r14d
mov dword [rsp + 0x4c], ebp
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x44]
mov r8d, ebp
mov word [rsp + 0x54], ax
lea rdx, [rsp + 0x48]
mov word [rsp + 0x56], r14w
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov r14, qword [rsp + 0x80]
test eax, eax
jne 0x1800cc962
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rsi, 0xffffffffffffffff
je 0x1800cc971
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xb0]
test edi, edi
je 0x1800cc86c
mov eax, edi
jmp 0x1800cc875