joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bfbf0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180224750]
xorps xmm0, xmm0
add rcx, 1
js 0x1800bfc0b
cvtsi2ss xmm0, rcx
jmp 0x1800bfc20
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180224740]
call fcn.18017b240
movss xmm1, dword [0x180200410]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800bfc52
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800bfc52
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x180224778]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x1800bfc8b
cmp rdx, 0x200
jae 0x1800bfc88
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x1800bfc8b
mov rdx, rcx
add rsp, 0x28
jmp 0x1800bfcc0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800bfe6e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180224748]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180224758]
lea rdx, [rdi + rdi]
call fcn.1800b3340
mov rax, qword [0x180224748]
lea r9, [rdi - 1]
mov qword [0x180224770], r9
mov qword [0x180224778], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800bfe63
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180224758]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800bfdaf
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800bfe24
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800bfdec
mov r10, qword [rdx]
cmp r10, rax
je 0x1800bfde6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800bfe24
cmp r9, rdx
je 0x1800bfe00
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800bfe38
cmp r9, rdx
jne 0x1800bfdf1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800bfe5e
mov r9, qword [0x180224770]
jmp 0x1800bfd60
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800bfe24
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18011acb0
int3
Function at 0x1800bfcc0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x180224750]
xorps xmm0, xmm0
add rcx, 1
js 0x1800bfc0b
cvtsi2ss xmm0, rcx
jmp 0x1800bfc20
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180224740]
call fcn.18017b240
movss xmm1, dword [0x180200410]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800bfc52
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800bfc52
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x180224778]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x1800bfc8b
cmp rdx, 0x200
jae 0x1800bfc88
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x1800bfc8b
mov rdx, rcx
add rsp, 0x28
jmp 0x1800bfcc0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800bfe6e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180224748]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180224758]
lea rdx, [rdi + rdi]
call fcn.1800b3340
mov rax, qword [0x180224748]
lea r9, [rdi - 1]
mov qword [0x180224770], r9
mov qword [0x180224778], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800bfe63
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180224758]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800bfdaf
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800bfe24
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800bfdec
mov r10, qword [rdx]
cmp r10, rax
je 0x1800bfde6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800bfe24
cmp r9, rdx
je 0x1800bfe00
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800bfe38
cmp r9, rdx
jne 0x1800bfdf1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800bfe5e
mov r9, qword [0x180224770]
jmp 0x1800bfd60
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800bfe24
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18011acb0
int3
Function at 0x1800c1110
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c1330
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800c1217
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800c1174
mov rax, qword [0x18021e008]
cmp qword [rsp + 0x20], rax
ja 0x1800c1174
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c1136
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180145b10
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800c11a3
jmp 0x1800c1217
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c11fa
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c11fa
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c11e8
mov rax, qword [rsp + 0x28]
jmp 0x1800c1219
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c1212
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800c1330
mov qword [rsp + 0x20], rax
jmp 0x1800c1136
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800c1220
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800c1370
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800c1323
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800c127b
mov rax, qword [0x18021e008]
cmp qword [rsp + 0x20], rax
ja 0x1800c127b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800c123d
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180145b10
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800c12aa
jmp 0x1800c1323
cmp dword [rsp + 0x50], 0x10000
jne 0x1800c1301
cmp qword [rsp + 0x48], 0x10000
jb 0x1800c1301
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800c12ef
mov rax, qword [rsp + 0x28]
jmp 0x1800c1325
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800c131e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800c1370
mov qword [rsp + 0x20], rax
jmp 0x1800c123d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800c3a70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
add rax, 0x10000
mov qword [rsp + 0x30], rax
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.180145b10
jmp 0x1800c3ab8
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov r8d, Ordinal_50
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x1800c3ad8
jmp 0x1800c3b75
cmp dword [rsp + 0x68], 0x1000
jne 0x1800c3afd
mov eax, dword [rsp + 0x6c]
and eax, 0xff
cmp eax, 1
je 0x1800c3afd
mov eax, dword [rsp + 0x6c]
and eax, 0x100
test eax, eax
je 0x1800c3aff
jmp 0x1800c3aa3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1800c3b35
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x60]
ja 0x1800c3b35
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1800c3b3a
jmp 0x1800c3aa3
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x1800c3aa3
mov rax, qword [rsp + 0x20]
jmp 0x1800c3b77
xor eax, eax
add rsp, 0x88
ret
Function at 0x1800da6f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800da732
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800da8d0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x18021e0b0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x238]
mov r14, qword [rcx + r8*8 + 0x1f0]
add rbx, rax
mov rax, qword [rcx + 0x410]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1800da9dc
lea rax, [0x1800da780]
cmp qword [rcx + r8*8 + 0x218], rax
jne 0x1800da9dc
cmp qword [rbx], 0
je 0x1800da961
test rdi, rdi
je 0x1800da9dc
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1800ecdc0
cmp eax, 0xffffffff
je 0x1800da9dc
test al, 1
je 0x1800da9dc
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800da9bb
mov eax, dword [rbp + 0x6f4]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.180151d88]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x1800daa16
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1800da9dc
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x1800daa55
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x1800daa25
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x1800daa55
mov dword [rsi], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x1800daa58
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800c8990
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.1800da460
mov dword [rbp + 0xda4], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180142d00
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800daf50
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x288], 0
je 0x1800daf6d
call fcn.1800d4150
test eax, eax
je 0x1800daf99
mov al, 1
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1f0]
cmp rcx, 0xffffffffffffffff
je 0x1800daf99
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1800db1e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x18021e0b0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1800db293
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.1800c8990
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1800da460
jmp 0x1800db35b
movzx ecx, word [rsp + 0x30]
mov edx, ecx
sub edx, 1
je 0x1800db330
sub edx, 1
je 0x1800db2da
cmp edx, 0x15
jne 0x1800db2e1
lea rdx, [rsp + 0x38]
mov r8, rbx
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call fcn.18010a3c0
test rax, rax
je 0x1800db2e1
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
jmp 0x1800db35b
lea rdx, [rsp + 0x34]
jmp 0x1800db2b2
mov byte [rbx], 0
mov dword [rdi], 0
call fcn.180150f50
mov dword [rax], 0x273f
call fcn.180150f50
mov ebx, dword [rax]
call fcn.180150f50
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1800c8990
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1800da460
jmp 0x1800db35b
cmp dword [rsp + 0x20], 2
jle 0x1800db352
lea r9, [rsp + 0x32]
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea r8, [0x1801c9dcc]
mov rcx, rbx
call fcn.1800dfdc0
jmp 0x1800db355
mov byte [rbx], 0
mov dword [rdi], 0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180142d00
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800dbba0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x180220d80]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x1800dbc04
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.18010ac50
test al, al
je 0x1800dbbf8
mov dword [0x180220d80], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x180220d80], 1
jmp 0x1800dbc09
cmp eax, 2
je 0x1800dbc5b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1800dbc3a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x1800dbc5b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1800dd0a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.180166a74
cdqe
add rsp, 0x28
ret

Function at 0x1800dd3a0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1801874d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1800dd3ca
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801874f0]
mov rcx, rbx
mov r14, rax
call fcn.18015ce70
test rax, rax
je 0x1800dd42d
mov rcx, rbx
test r14, r14
je 0x1800dd417
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1800dd465
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800dd465
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1800dd528
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1800dd490
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.180151d88]
mov rdi, rax
test rax, rax
je 0x1800dd51a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800dd51a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1800dd4c0
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x1800dd4d4
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1800dd4f0
mov rcx, rdi
test r14, r14
je 0x1800dd511
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1800dd517
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.180150fbc]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800dd540
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x18021e0b0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x1800dd5a6
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800dd589
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1800dd583
shr ax, 8
cmp al, 2
je 0x1800dd5a6
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180142d00
add rsp, 0x1e8
ret
call fcn.18010bdb0
test eax, eax
jne 0x1800dd7b0
mov qword [rsp + 0x200], rsi
lea rcx, [0x1801874d0]
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1800dd5e6
mov qword [0x180220d90], rsi
jmp 0x1800dd76d
mov qword [rsp + 0x1f0], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x1801874f0]
call fcn.18015ce70
test rax, rax
je 0x1800dd64a
mov rcx, rbx
test rbp, rbp
je 0x1800dd63c
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x1800dd72c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x1800dd72c
test rbp, rbp
je 0x1800dd679
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800dd679
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x1800dd72c
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x1800dd724
lea ecx, [rax + 1]
add rcx, 0xc
call qword [fcn.180151d88]
mov rdi, rax
test rax, rax
je 0x1800dd71b
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800dd71b
mov rcx, 0xffffffffffffffff
mov rax, rcx
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x1800dd6c5
mov edx, 0x5c
mov word [rax + rdi], dx
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], sil
jne 0x1800dd6e0
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1800dd6f2
mov rcx, rdi
test rbp, rbp
je 0x1800dd712
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x1800dd718
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.180150fbc]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x180220d90], rsi
test rsi, rsi
je 0x1800dd76d
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180220d88]
test rax, rax
cmovne rcx, rax
mov qword [0x180220d88], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.18010ac50
test al, al
lea rcx, [0x180224818]
setne byte [0x180224810]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180142d00
add rsp, 0x1e8
ret
Function at 0x1800df470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, rdx
movzx edx, byte [rcx]
test dl, dl
je 0x1800df4a5
lea r9, [0x1801877f0]
movzx eax, byte [r8]
test al, al
je 0x1800df4a5
movzx eax, byte [rax + r9]
movzx edx, dl
cmp byte [rdx + r9], al
jne 0x1800df4b7
movzx edx, byte [rcx + 1]
inc rcx
inc r8
test dl, dl
jne 0x1800df481
xor edx, edx
mov eax, edx
cmp byte [rcx], al
sete al
cmp byte [r8], dl
setne dl
xor eax, edx
ret
xor eax, eax
ret
Function at 0x1800eee50
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1800e44d0
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x1800cf1d9.0
mov rcx, rdi
mov rsi, rax
call case.0x1800cf1d9.0
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1800eef00
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1800e44d0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1800e4560
cmp rax, 0x3e8
ja 0x1800eef31
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1800eeeb0
test rsi, rsi
je 0x1800eef0d
mov rcx, rsi
call fcn.180150fbc
test rbx, rbx
je 0x1800eef1a
mov rcx, rbx
call fcn.180150fbc
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1800eef3e
mov rcx, rsi
call fcn.180150fbc
test rbx, rbx
je 0x1800eef4b
mov rcx, rbx
call fcn.180150fbc
mov eax, 1
jmp 0x1800eef1c