joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037cb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x200]
cmp dword [rdx + 0x20], 0
je 0x180037cfd
cmp qword [rcx + 0x590], 0
je 0x180037cfd
add rcx, 0x508
lea rdx, str.REST__d
xor r8d, r8d
call fcn.18004a990
test eax, eax
jne 0x180037d07
lea edx, [rax + 0x1a]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800360b0
add rsp, 0x20
pop rbx
jmp fcn.1800379b0
add rsp, 0x20
pop rbx
ret

Function at 0x180037fa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x508
mov rax, qword [rbx]
mov rdx, qword [rax + 0x200]
cmp dword [rdx + 0x20], 1
jne 0x180037fec
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x180037fec
lea rdx, str.SIZE__s
call fcn.18004a990
test eax, eax
jne 0x180037ff9
lea edx, [rax + 0x17]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800360b0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180037cb0
add rsp, 0x20
pop rbx
ret

Function at 0x1800381e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov r10, qword [rcx]
mov r9, rcx
mov eax, dword [r10 + 0xe88]
bt eax, 0x1c
jae 0x18003823f
cmp qword [rcx + 0x590], 0
je 0x18003823f
shr eax, 0xb
and al, 1
movzx edx, al
call fcn.180036470
test eax, eax
je 0x18003823f
mov rax, qword [r10 + 0x200]
mov r8d, reloc.WS2_32.dll_send
mov rcx, r9
mov dword [rax + 0x20], 1
mov edx, dword [r10 + 0xe88]
shr edx, 0xb
and dl, 1
add rsp, 0x28
jmp fcn.1800363e0
mov rcx, r9
add rsp, 0x28
jmp fcn.180037fa0
Function at 0x18003d640
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1800a40f0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18003d686
mov r8d, eax
lea rdx, str.WSAStartup_failed___d_
mov rcx, rbx
call fcn.18001fac0
jmp 0x18003d6b0
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x18003d6a1
shr ax, 8
test al, al
jne 0x18003d6a1
xor eax, eax
jmp 0x18003d6b5
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.18001fac0
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180050590
add rsp, 0x1d0
pop rbx
ret
Function at 0x18003dde0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x200]
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x18003de64
sub r8d, 1
je 0x18003de3b
cmp r8d, 1
jne 0x18003de78
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x18003de5c
cmp ecx, r8d
jne 0x18003de78
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
jmp fcn.18003e000
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x18003de5c
cmp ecx, 1
jne 0x18003de78
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
jmp fcn.18003e000
ret

Function at 0x18003de80
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x200]
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x18003df27
sub r8d, 2
je 0x18003dee0
cmp r8d, 1
jne 0x18003df19
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x18003ded3
cmp ecx, r8d
jne 0x18003df19
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
ret
mov dword [r9 + r10*4 + 0xc08], 0
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x18003df1a
cmp ecx, 1
jne 0x18003df19
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
jmp fcn.18003e000
ret
mov dword [r9 + r10*4 + 0xc08], 1
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x18003df0c
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
jmp fcn.18003e000

Function at 0x18003df50
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x200]
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x18003dfe0
sub r8d, 1
je 0x18003dfb1
cmp r8d, 1
jne 0x18003dff7
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x18003dfd5
cmp ecx, r8d
jne 0x18003dff7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.18003e000
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x18003dfd5
cmp ecx, 1
jne 0x18003dff7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.18003e000
ret
Function at 0x18003e000
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x250]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x18003e05f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.18001fac0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.18003d7e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18003e3c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
movsxd r11, edx
mov r10, qword [rax + 0x200]
mov r9d, dword [r10 + r11*4 + 8]
cmp r8d, 1
jne 0x18003e416
test r9d, r9d
je 0x18003e400
sub r9d, 2
je 0x18003e428
cmp r9d, r8d
jne 0x18003e456
cmp dword [r10 + r11*4 + 0x408], 0
jne 0x18003e456
mov dword [r10 + r11*4 + 0x408], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 2
mov edx, 0xfb
jmp fcn.18003e000
sub r9d, 1
je 0x18003e440
sub r9d, 1
je 0x18003e3e8
cmp r9d, 1
jne 0x18003e456
cmp dword [r10 + r11*4 + 0x408], 1
jne 0x18003e456
mov dword [r10 + r11*4 + 0x408], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 3
mov edx, 0xfc
jmp fcn.18003e000
ret

Function at 0x18003e460
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
movsxd r11, edx
mov r10, qword [rax + 0x200]
mov r9d, dword [r10 + r11*4 + 0xc08]
cmp r8d, 1
jne 0x18003e4bc
test r9d, r9d
je 0x18003e4a3
sub r9d, 2
je 0x18003e4ce
cmp r9d, r8d
jne 0x18003e4ff
cmp dword [r10 + r11*4 + 0x1008], 0
jne 0x18003e4ff
mov dword [r10 + r11*4 + 0x1008], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 2
mov edx, 0xfd
jmp fcn.18003e000
sub r9d, 1
je 0x18003e4e6
sub r9d, 1
je 0x18003e48b
cmp r9d, 1
jne 0x18003e4ff
cmp dword [r10 + r11*4 + 0x1008], 1
jne 0x18003e4ff
mov dword [r10 + r11*4 + 0x1008], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 3
mov edx, 0xfe
jmp fcn.18003e000
ret
Function at 0x18003f6b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1800a40f0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, qword [rcx + 0x508]
lea rax, [rsp + 0x30]
mov rsi, qword [rcx]
mov r15, rcx
mov dword [rsp + 0x30], Ordinal_133
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rdi + 0x15c]
lea r14, [rdi + 0x168]
mov rdx, qword [r14]
add r8d, 4
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rdi + 0x150], 0
mov dword [rdi + 0x154], eax
jne 0x18003f74d
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.180052ac0
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x150], eax
mov r9d, dword [rdi + 0x154]
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rbp
cmp r9d, 4
jge 0x18003f7b7
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.18001fac0
mov dword [rdi + 0xc], 7
xor eax, eax
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180050590
mov rsi, qword [rsp + 0x108]
add rsp, 0xd0
pop r15
pop r14
pop rdi
ret
mov rcx, r14
call fcn.18003f1f0
movzx r8d, ax
mov dword [rdi + 0xc], r8d
sub r8d, 3
je 0x18003f866
sub r8d, 1
je 0x18003f8d5
sub r8d, 1
je 0x18003f822
cmp r8d, 1
je 0x18003f802
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x1800990d4]
call fcn.18001fac0
jmp 0x18003f8d5
mov rdx, qword [r14]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rdi
call fcn.18003f400
test eax, eax
je 0x18003f8d5
jmp 0x18003f782
mov rbp, qword [r14]
lea eax, [r9 - 4]
mov rcx, r14
movsxd rbx, eax
call fcn.18003f1d0
movzx r9d, ax
lea rcx, [rbp + 4]
mov rdx, rbx
mov dword [rdi + 8], r9d
call fcn.18003f190
cmp rax, rbx
jae 0x18003f8d5
lea r8, [rbp + 4]
mov rcx, rsi
lea rdx, str.TFTP_error:__s_n
call fcn.18001fbd0
jmp 0x18003f8d5
cmp r9d, 4
jle 0x18003f8d5
mov rcx, r14
call fcn.18003f1d0
movzx ecx, word [rdi + 0x48]
inc ecx
cmp cx, ax
jne 0x18003f8d5
mov r8, qword [r14]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, r15
call fcn.18001f9e0
mov ebx, eax
test eax, eax
je 0x18003f8b4
mov edx, 5
mov rcx, rdi
call fcn.1800401a0
mov eax, ebx
jmp 0x18003f782
mov eax, dword [rdi + 0x154]
mov rcx, rsi
sub eax, 4
cdqe
add qword [rsi + 0x118], rax
mov rdx, qword [rsi + 0x118]
call fcn.18002bc30
mov rcx, r15
call fcn.18002be80
test eax, eax
je 0x18003f780
mov edx, 5
mov rcx, rdi
call fcn.1800401a0
mov eax, Ordinal_46
jmp 0x18003f782
Function at 0x180041710
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1800a40f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1800638cc
mov byte [rsp + 0x20], 0
test rax, rax
je 0x180041776
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x180041776
lea rcx, [rsp + 0x20]
call qword [fcn.180057950]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180050590
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180050590
add rsp, 0x148
ret
jmp 0x180041710

Function at 0x180041790
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1800a40f0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1800638cc
mov byte [rsp + 0x20], 0
test rax, rax
je 0x180041776
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x180041776
lea rcx, [rsp + 0x20]
call qword [fcn.180057950]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180050590
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180050590
add rsp, 0x148
ret
jmp 0x180041710

Function at 0x18004b860
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18004b8a3
mov rcx, qword [rbx]
lea rax, [rbx + 8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
add rsp, 0x30
pop rbx
ret
Function at 0x18004cc90
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x18004ccb0
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x50], rdi
cmp rbx, rax
ja 0x18004cdb9
test rbx, rbx
je 0x18004cce2
lea rcx, [rbx + rbx]
call qword [section..data]
jmp 0x18004ccef
lea rcx, [0x180098f8b]
call qword [fcn.180057950]
mov rdi, rax
test rax, rax
je 0x18004cdb9
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.18004a490
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18004cda4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18004cd97
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [fcn.1800572c4]
xor eax, eax
jmp 0x18004cdbe
mov eax, reloc.WLDAP32.dll_Ordinal_27
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x18004d070
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800a40f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov dword [rsp + 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18004d13c
mov qword [rsp + 0xa0], rbp
lea rdx, [rsp + 0x64]
xor ebp, ebp
mov dword [rsp + 0x58], 0x208
mov rcx, rsi
mov qword [rsp + 0x64], rbp
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
call fcn.18004d1b0
lea rcx, [rsp + 0x64]
lea edx, [rbp + 8]
call fcn.18004f090
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8d, [rbp + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x18004d140
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x18004d18a
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180050590
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x18004d9e0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x18004ef50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x18004ef92
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x18004efd9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + ioctlsocket]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x18004f032
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + ioctlsocket]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + ioctlsocket]
sub rbp, 1
jne 0x18004eff0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x18004f073
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x180089fb9]
mov r8d, 1
call qword [rbx + ioctlsocket]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x180089fba]
mov r8d, 1
call qword [rbx + ioctlsocket]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x18004f040
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1800709a4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x180070981
call fcn.180060a98
mov dword [rax], socket
call fcn.18005722c
or eax, 0xffffffff
jmp 0x18007099e
sub dword [rcx + 0x10], 1
jns 0x180070990
add rsp, 0x28
jmp fcn.1800700b0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x180070960
Function at 0x140004280
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400042dd
lea rbx, [0x14006b710]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400042c4
cmp r10, 2
jb 0x1400042c4
cmp byte [r9], r8b
jne 0x1400042c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400042a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000431f
lea rbx, [0x14006b710]
cmp r8b, 0x23
jne 0x140004303
cmp byte [r9], r8b
jne 0x140004303
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400042f0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000447a
mov qword [r8], 0
lea rdx, [0x14006b324]
call fcn.140004330
mov rbx, rax
test rax, rax
jne 0x14000449a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140004571
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004571
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140004571
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004571
cmp rdi, 0xffffffffffffffff
je 0x140004571
mov rax, qword [0x14009fba0]
test rax, rax
je 0x14000450e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140004571
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000455e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14009fba0]
test rax, rax
je 0x140004553
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000457a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000456c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000457c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140006c50
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14006b710]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x14009fba0]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ebc], ebx
jne 0x140006ce6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140018f20
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140006cf0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x14006b710]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret