joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1540]
mov eax, 0x1640
call fcn.180073760
sub rsp, rax
mov rax, qword [0x1800ff400]
xor rax, rsp
mov qword [rbp + 0x1530], rax
mov dword [rbp + 0x1510], 0x64692e
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov dword [rsp + 0x20], 1
mov edi, 0x40
mov r9d, edi
mov r8d, 0x20
lea rdx, [rbp + 0x1510]
lea rcx, [rbp + 0x50]
call fcn.180001f60
nop
lea rsi, vtable.std::ios_base.0
cmp qword [rbp + 0xe0], 0
je 0x1800052a4
mov r8d, 0x20
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x50]
call fcn.180004e60
jmp 0x1800053e7
call fcn.1800718bc
mov edx, eax
movabs rax, 0x5555555555555555
mov qword [rbp + 0x1508], rax
mov qword [rbp + 0x188], rdx
mov ecx, 1
movabs r8, 0x5851f42d4c957f2d
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rbp + rcx*8 + 0x188], rdx
inc rcx
cmp rcx, 0x138
jb 0x1800052d2
mov dword [rbp + 0x180], 0x138
lea rbx, [rbp + 0x160]
nop dword [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.180002e10
mov rcx, rax
mov eax, 0x100
mul rcx
mov ecx, edi
and ecx, 0x3f
shr rdx, cl
mov byte [rbx], dl
inc rbx
lea rax, [rbp + 0x180]
cmp rbx, rax
jne 0x180005310
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, 0x20
lea rdx, [rbp + 0x1510]
lea rcx, [rsp + 0x40]
call fcn.180002190
nop
cmp qword [rbp - 0x38], 0
je 0x180005382
mov r8d, 0x20
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x40]
call fcn.1800058a0
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [0x1800a6790]
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
lea rcx, [rsp + 0x48]
call fcn.1800029e0
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x3c], edx
mov qword [rbp - 0x18], rsi
lea rcx, [rbp - 0x18]
call fcn.1800717c4
nop
lea rdx, [rbp + 0x160]
mov rcx, qword [0x180103218]
call fcn.18001fc90
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [0x1800a6780]
mov qword [rbp + rcx + 0x50], rax
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x4c], edx
lea rcx, [rbp + 0x60]
call fcn.1800029e0
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [0x1800a6700]
mov qword [rbp + rcx + 0x50], rax
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x4c], edx
mov qword [rbp + 0x100], rsi
lea rcx, [rbp + 0x100]
call fcn.1800717c4
nop
mov rcx, qword [rbp + 0x1530]
xor rcx, rsp
call fcn.1800737c0
lea r11, [rsp + 0x1640]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180005ee0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x180001390]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [0x180103220], rax
mov edx, 0xffffffff
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
Function at 0x180020d10
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x1800ff400]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, qword [rdx]
xorps xmm0, xmm0
mov r15, qword [rdx + 8]
xor edi, edi
movabs rax, 0x6a09e667f3bcc908
mov qword [rbp + 0x27], rdi
mov qword [rsp + 0x20], rax
mov r14, rcx
movabs rax, 0xbb67ae8584caa73b
mov ecx, edi
mov qword [rsp + 0x28], rax
lea rsi, [rbx + r15]
mov qword [rbp + 0x2f], rcx
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rbp - 0x79], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp - 0x71], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbp - 0x69], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp - 0x61], rax
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
cmp rbx, rsi
je 0x180020e38
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rbp + rcx - 0x59], al
mov rcx, qword [rbp + 0x2f]
inc rcx
mov qword [rbp + 0x2f], rcx
cmp rcx, 0x80
jne 0x180020e2c
lea rcx, [rsp + 0x20]
call fcn.180020860
mov rcx, rdi
mov qword [rbp + 0x2f], rcx
inc rbx
cmp rbx, rsi
jne 0x180020e00
mov rdi, qword [rbp + 0x27]
add rdi, r15
lea rdx, [rsp + 0x20]
mov rcx, r14
mov qword [rbp + 0x27], rdi
call fcn.180020e80
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800737c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180024da0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1800ff400]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
xor edi, edi
mov qword [rbp - 0x79], rdi
mov qword [rbp - 0x71], rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x69], xmm0
mov word [rbp - 0x59], di
mov qword [rbp - 0x51], rdi
movups xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], di
mov qword [rbp - 0x31], rdi
movdqa xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 9], xmm0
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x28], 1
call fcn.180070f18
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp - 0x79], rdx
mov qword [rbp - 0x71], 1
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.180036ea0
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x69], xmm0
mov rcx, rbx
call fcn.180036f00
mov word [rbp - 0x59], ax
mov qword [rbp - 0x51], 1
lea rdx, [rbp + 7]
mov rcx, rbx
call fcn.180036e90
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x49], xmm0
mov rcx, rbx
call fcn.180005490
mov word [rbp - 0x39], ax
mov rax, qword [rbx + 0x38]
mov qword [rbp - 0x31], rax
lea rax, [0x1800abc10]
mov qword [rbp + 7], rax
movdqa xmm6, xmmword [reloc.WS2_32.dll_shutdown]
movdqu xmmword [rbp + 0xf], xmm6
mov edx, reloc.WS2_32.dll_shutdown
lea rcx, [rbp - 0x29]
call fcn.18001f680
movups xmm0, xmmword [rbp + 7]
movaps xmmword [rbp + 7], xmm0
unpckhpd xmm6, xmm6
movsd qword [rbp + 0x17], xmm6
mov r8, qword [rbp - 0x29]
mov eax, edi
mov edx, edi
mov r9d, edi
lea r11, [0x1800a6b10]
mov r10, qword [rbp + 7]
movzx ecx, byte [r10 + rax]
and edx, 0x1f
movzx eax, byte [rdx + r11]
xor al, cl
mov byte [r8], al
lea r8, [r8 + 1]
lea rax, [r9 + 1]
mov rdx, rax
mov r9, rax
cmp rax, 0x16
jne 0x180024ee1
mov qword [rbp + 7], 1
mov rdx, qword [rbp - 9]
cmp rdx, qword [rbp - 1]
je 0x180024f27
mov qword [rdx], 1
add qword [rbp - 9], 8
jmp 0x180024f34
lea r8, [rbp + 7]
lea rcx, [rbp - 0x11]
call fcn.1800212b0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180022e90
nop
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x180024f88
mov rdx, qword [rbp - 1]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024f77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180024fe4
call fcn.1800732d8
mov qword [rbp - 0x11], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180024fbe
mov rdx, qword [rbp - 0x19]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024fb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180024fe4
call fcn.1800732d8
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800737c0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call fcn.180081934
int3
Function at 0x180030340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], r12
lea rsi, [r8 - 1]
sar rsi, 1
mov r14, r9
mov qword [rsp + 0x58], r13
mov r12, r8
mov rdi, rdx
mov rbp, rcx
mov r15, rdx
cmp rdx, rsi
jge 0x1800303dd
nop word [rax + rax]
lea rbx, [rdx + rdx]
lea rcx, [rbx + 2]
lea rcx, [rcx + rcx*2]
shl rcx, 4
add rcx, rbp
lea rdx, [rcx - 0x30]
call fcn.180031620
movzx edx, al
lea rax, [rdi + rdi*2]
add rax, rax
xor rdx, 1
inc rdx
add rdx, rbx
mov rdi, rdx
lea rcx, [rdx + rdx*2]
add rcx, rcx
movups xmm0, xmmword [rbp + rcx*8]
movups xmmword [rbp + rax*8], xmm0
movups xmm1, xmmword [rbp + rcx*8 + 0x10]
movups xmmword [rbp + rax*8 + 0x10], xmm1
movups xmm0, xmmword [rbp + rcx*8 + 0x20]
movups xmmword [rbp + rax*8 + 0x20], xmm0
cmp rdx, rsi
jl 0x180030380
jne 0x180030416
test r12b, 1
jne 0x180030416
lea rax, [rdi + rdi*2]
lea rcx, [r12 + r12*2]
add rcx, rcx
lea rdi, [r12 - 1]
add rax, rax
movups xmm0, xmmword [rbp + rcx*8 - 0x30]
movups xmmword [rbp + rax*8], xmm0
movups xmm1, xmmword [rbp + rcx*8 - 0x20]
movups xmmword [rbp + rax*8 + 0x10], xmm1
movups xmm0, xmmword [rbp + rcx*8 - 0x10]
movups xmmword [rbp + rax*8 + 0x20], xmm0
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
cmp r15, rdi
jge 0x18003047a
nop word [rax + rax]
lea rbx, [rdi - 1]
mov rdx, r14
sar rbx, 1
lea rsi, [rbx + rbx*2]
shl rsi, 4
add rsi, rbp
mov rcx, rsi
call fcn.180031620
test al, al
je 0x18003047a
movups xmm0, xmmword [rsi]
lea rax, [rdi + rdi*2]
mov rdi, rbx
add rax, rax
movups xmmword [rbp + rax*8], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + rax*8 + 0x10], xmm1
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rbp + rax*8 + 0x20], xmm0
cmp r15, rbx
jl 0x180030430
movups xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x60]
lea rax, [rdi + rdi*2]
add rax, rax
movups xmmword [rbp + rax*8], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbp + rax*8 + 0x10], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbp + rax*8 + 0x20], xmm0
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180036760
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0xffffffffffffffff
mov rdi, r8
mov eax, edx
mov rbx, rcx
je 0x180036785
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 1
mov r8d, 6
mov ecx, eax
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x1800367a7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rbx]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18003680d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x18003680d
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov qword [rbx], 0xffffffffffffffff
mov dword [rbx + 0xc], eax
mov byte [rbx + 0x20], al
mov word [rbx + 0x22], ax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rbx + 0x20], 1
mov eax, dword [rdi + 4]
mov dword [rbx + 0xc], eax
movzx ecx, word [rdi + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x22], ax
mov dword [rbx + 8], 1
call fcn.180070f18
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov al, 1
mov qword [rbx + 0x28], rdx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180036870
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1800ff400]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
mov ecx, WSACleanup
call fcn.18007329c
test rax, rax
je 0x1800368c2
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov qword [rax], 0xffffffffffffffff
mov ecx, dword [0x1801053d0]
mov qword [rbx], rax
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180103278], ecx
jg 0x180036944
mov ecx, WSACleanup
call fcn.18007329c
test rax, rax
je 0x180036921
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
mov qword [rax], 0xffffffffffffffff
mov qword [rbx], rax
jmp 0x180036928
mov qword [rbx], 0
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800737c0
add rsp, 0x1d0
pop rbx
ret
lea rcx, [0x180103278]
call fcn.180073d60
cmp dword [0x180103278], 0xffffffff
jne 0x1800368e8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [0x1800a5ae0]
call fcn.180073638
lea rcx, [0x180103278]
call fcn.180073cf4
jmp 0x1800368e8
Function at 0x180036cc0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800ff400]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
mov rdx, r9
add rcx, 0x30
movzx edi, r8w
call fcn.180036a20
xorps xmm0, xmm0
mov eax, reloc.WS2_32.dll_socket
xor ebp, ebp
mov word [rsp + 0x28], ax
movzx ecx, di
mov qword [rsp + 0x3c], rbp
movdqu xmmword [rsp + 0x2c], xmm0
call qword [sym.imp.WS2_32.dll_htons]
movups xmm0, xmmword [rbx]
mov rbx, qword [rsi]
movzx ecx, word [rsp + 0x28]
mov word [rsp + 0x2a], ax
movups xmmword [rsp + 0x30], xmm0
cmp qword [rbx], 0xffffffffffffffff
jne 0x180036dae
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x180036d52
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rbx]
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x28]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180036db2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x180036db2
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
mov dword [rbx + 0xc], ebp
mov byte [rbx + 0x20], bpl
mov word [rbx + 0x22], bp
xor al, al
jmp 0x180036e01
mov byte [rbx + 0x20], bpl
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm0
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbx + 0x22], ax
mov dword [rbx + 8], 1
call fcn.180070f18
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov al, 1
mov qword [rbx + 0x28], rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800737c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x180036f10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x180036f56
cmp dword [rax + 8], 2
jne 0x180036f56
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x180036f5b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180036f4e
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.180036e40
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x180036f70
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov rdx, rcx
lea r8, [rsp + 0x38]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x180036fce
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x180036fb8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + 0x20]
mov edx, dword [rax + 4]
mov dword [rsp + 0x38], edx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180036fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x180037026
cmp dword [rax + 8], 2
jne 0x180037026
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x18003702b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x18003701e
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.180036e40
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x180037040
Capabilities:
Get socket status

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1800ff400]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rcx, qword [rcx]
cmp dword [rcx + 8], 1
jne 0x1800371c9
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x288], rdi
xor edx, edx
xor edi, edi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], rdi
mov ecx, dword [rcx]
inc ecx
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jne 0x18003710d
mov rcx, qword [rbx]
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x38], edi
lea r9, [rsp + 0x38]
mov dword [rsp + 0x3c], 4
mov edx, 0xffff
mov r8d, 0x1007
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x180037152
cmp dword [rsp + 0x38], edi
jne 0x180037152
mov rax, qword [rbx]
mov dword [rax + 8], 2
mov rax, qword [rbx]
mov rcx, qword [rax + 0x68]
test rcx, rcx
je 0x1800371c1
mov byte [rsp + 0x30], 1
jmp 0x180037196
test eax, eax
jne 0x180037146
call fcn.180070f18
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rbx]
sub rdx, qword [rax + 0x28]
cmp rdx, 5
jb 0x1800371c1
jmp 0x180037152
call fcn.180087018
mov ecx, dword [rax]
call fcn.1800871b4
mov rax, qword [rbx]
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x180037185
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbx]
mov qword [rax], 0xffffffffffffffff
mov rax, qword [rbx]
mov dword [rax + 8], edi
mov rax, qword [rbx]
mov rcx, qword [rax + 0x68]
test rcx, rcx
je 0x1800371c1
mov byte [rsp + 0x30], dil
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rbx]
add rbx, 0x30
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1800371c1
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rdi
mov rdi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800737c0
add rsp, 0x270
pop rbx
ret
Function at 0x18003a190
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x18003a1c7
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x18003a1b0
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x18003a2b8
sub rcx, r10
cmp r9, 8
jb 0x18003a299
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x18003a220
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x18003a2b8
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x18003a2a0
test r8d, r8d
sete al
ret
Function at 0x18003a2c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x18003a464
cmp r9, 4
jb 0x18003a30a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x18003a2f0
xor r11d, r11d
test r9, r9
je 0x18003a464
cmp r9, 8
jb 0x18003a43d
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x18003a33c
cmp rdx, r8
jae 0x18003a43d
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x18003a351
cmp rdx, r10
jae 0x18003a43d
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x18003a3f7
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x18003a390
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x18003a42f
mov rdx, r9
and rdx, 0xfffffffffffffff8
mov rbx, r10
lea rax, [r11 + r8]
sub rbx, r8
mov rdi, rcx
sub rdi, r8
nop
movq xmm1, qword [rax + rbx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rdx
jb 0x18003a410
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x18003a464
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18003a450
add rsp, 8
ret