joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180088620
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x180356880]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1803fca58]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1800887de
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1800887de
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call fcn.1800536d0
xor ebx, ebx
mov qword [rsp + 0x28], rax
mov rdi, rax
test rax, rax
je 0x1800886aa
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
jmp 0x1800886ad
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov rax, qword [0x1803fca58]
mov dword [rdi + 0x28], 9
test rax, rax
je 0x1800886f7
mov rsi, qword [rax + 0x90]
jmp 0x1800886fa
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180088725
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1803fca58]
mov rcx, qword [rax + 0x4b30]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, [0x18021bf80]
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18008879e
inc rbx
cmp rbx, 5
jl 0x180088780
jmp 0x1800887ca
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x1800887e0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18011b930
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x18008a5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1803fca58]
mov rcx, qword [rax + 0x4e18]
mov r9, qword [rax + 0x4038]
movups xmm0, xmmword [r9 + 0x248]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.180077460

Function at 0x18008a680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1803fca58]
mov rcx, qword [rax + 0x4e18]
mov r10, qword [rax + 0x4038]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x248], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.180077460
Function at 0x1800abc00
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r9 + 8]
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov r11, qword [rdx + 8]
mov rbx, r11
cmp r11, r8
je 0x1800abcb4
mov rax, qword [r10]
mov rcx, qword [rdx]
cmp rax, qword [r11 + 0x10]
je 0x1800abcb6
cmp rbx, rcx
je 0x1800abcb4
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1800abca3
jmp 0x1800abcb6
xor ebx, ebx
test rbx, rbx
je 0x1800abd26
mov rax, qword [rdx]
cmp r11, rbx
jne 0x1800abcdb
cmp rax, rbx
jne 0x1800abcd1
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x1800abce6
mov r8, qword [rbx + 8]
mov qword [rdx + 8], r8
jmp 0x1800abce6
cmp rax, rbx
jne 0x1800abce6
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x60]
call fcn.180004ec0
lea rcx, [rbx + 0x30]
call fcn.180003490
mov edx, 0xa0
mov rcx, rbx
call fcn.18011bcfc
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800ac370
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.1800b37d0
mov qword [0x1803fcad8], rax
test rax, rax
je 0x1800ac52c
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800ac427
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800ac427
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x2d1d972b
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800ac422
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800ac400
cmp r8d, 0x5f1755cc
je 0x1800ac42c
test r9d, r9d
jne 0x1800ac3e0
mov rax, qword [rax]
jmp 0x1800ac3b0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x1803fcae8]
mov rcx, qword [0x1803fcad8]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800ac4e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800ac4e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x281b50b5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800ac4e2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800ac4c0
cmp r8d, 0x8c50600a
je 0x1800ac4ec
test r9d, r9d
jne 0x1800ac4a0
mov rax, qword [rax]
jmp 0x1800ac470
mov ecx, dword [rbx + 0x24]
lea r8, [0x1803fcae8]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 2
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [0x1803fcad8]
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x1803fca52], 1
add rsp, 0x28
ret
Function at 0x1800acf30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800acfc7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800acfc7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x32a40805
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800acfc2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800acfa0
cmp r8d, 0x9dd4f81d
je 0x1800acfcc
test r9d, r9d
jne 0x1800acf80
mov rax, qword [rax]
jmp 0x1800acf50
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [0x1803fcac8]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800ad077
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800ad077
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x2da1c18f
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800ad072
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800ad050
cmp r8d, 0xa34b6b8c
je 0x1800ad07c
test r9d, r9d
jne 0x1800ad030
mov rax, qword [rax]
jmp 0x1800ad000
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, qword [0x1803fca88]
add rax, r10
mov rcx, qword [0x1803fcab0]
call rax
mov rbx, qword [rsp + 0x30]
mov byte [0x1803fca53], 0
mov byte [0x1803fca52], 0
add rsp, 0x20
pop rdi
ret
Function at 0x1800b37d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180356880]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov dword [rsp + 0x40], ecx
movabs rdx, 0x7d52634b6c9c0139
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rcx, 0xe87fd356dd0e7586
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1800b3880
lea rcx, [rsp + 0x48]
cmp rdx, 7
ja 0x1800b38b2
mov qword [rsp + 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.1801522a0
mov word [rsp + rbx + 0x48], di
jmp 0x1800b38bc
lea r9, [rsp + 0x30]
call fcn.1800b3030
mov qword [rsp + 0x68], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800b3956
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800b3956
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x55090ac5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800b3951
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1800b3930
cmp r8d, 0x7e9f8abd
je 0x1800b395b
test r9d, r9d
jne 0x1800b3910
mov rax, qword [rax]
jmp 0x1800b38e0
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x40]
lea rcx, [0x1800b34a0]
call r8
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.180035890
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18011b930
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1800c0640
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1800c0722
call fcn.1800d9a90
test al, al
jne 0x1800c0722
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1800c0672
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1800e3550
test rax, rax
je 0x1800c06b7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1800e3550
mov rsi, rax
test rax, rax
je 0x1800c06b7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1800c06eb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1800d6410
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1800c06d0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800d29b0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1800d29da
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x18015f600]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18015f610]
mov rcx, rbx
mov r14, rax
call fcn.1801327c4
test rax, rax
je 0x1800d2a3b
mov rcx, rbx
test r14, r14
je 0x1800d2a28
xor edx, edx
mov r8d, 8
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x1800d2a72
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800d2a72
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x1800d2b3c
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x1800d2aa0
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x1800d2b2e
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800d2b2e
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1800d2ad3
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x1800d2ae5
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1800d2b00
mov rcx, rsi
test r14, r14
je 0x1800d2b25
xor edx, edx
mov r8d, 8
call r14
jmp 0x1800d2b2b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [fcn.18012d710]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800da8a0
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x1800da8b5
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.1800da2c0

Function at 0x1800daba0
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x180356880]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edi, edi
mov r14, rdx
mov rbp, rcx
cmp byte [rcx + 0xa4e], dil
je 0x1800dadc2
cmp byte [rdx + 0x18], dil
mov qword [rsp + 0xc8], rsi
lea rsi, [rdx + 0x18]
je 0x1800dadba
lea r8, [rsp + 0x20]
mov rdx, rsi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1800dadba
lea r8, [rsp + 0x70]
mov rdx, rsi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1800dadba
cmp byte [rsi], dil
lea rdx, str.Host__s:_d_was_resolved.
mov r9d, dword [r14 + 0x14]
mov rcx, rbp
mov qword [rsp + 0x100], rbx
mov rbx, qword [r14]
mov qword [rsp + 0xc0], r15
lea r15, str._none_
mov r8, r15
cmovne r8, rsi
call fcn.1800ceba0
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1800c0c80
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.1800c0c80
test rbx, rbx
je 0x1800dad27
mov r14d, 0x20
mov ecx, dword [rbx + 4]
cmp ecx, 0x17
je 0x1800dac94
cmp ecx, 2
jne 0x1800dad1a
xor eax, eax
mov byte [rsp + 0x80], 0
cmp ecx, 2
lea rsi, [rsp + 0x30]
cmovne rax, r14
add rsi, rax
cmp ecx, 2
je 0x1800dacc1
cmp ecx, 0x17
jne 0x1800dacdc
mov rdx, qword [rbx + 0x20]
add rdx, 8
jmp 0x1800dacc9
mov rdx, qword [rbx + 0x20]
add rdx, 4
mov r9d, 0x2e
lea r8, [rsp + 0x80]
call sub.WS2_32.dll_inet_ntop
mov rcx, rsi
call fcn.180027de0
test rax, rax
je 0x1800dad00
mov r8d, 2
lea rdx, [0x18017a71c]
mov rcx, rsi
call fcn.1800c0c40
mov edi, eax
test edi, edi
jne 0x1800dad42
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1800c0be0
mov edi, eax
test eax, eax
jne 0x1800dad42
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800dac83
lea rcx, [rsp + 0x50]
call fcn.180027de0
test rax, rax
je 0x1800dad53
lea rcx, [rsp + 0x50]
call fcn.180027df0
jmp 0x1800dad56
lea rdx, str.too_many_IP__cant_show
mov rcx, rbp
call fcn.1800ceba0
jmp 0x1800dad96
mov rax, r15
mov r8, rax
lea rdx, str.IPv6:__s
mov rcx, rbp
call fcn.1800ceba0
lea rcx, [rsp + 0x30]
call fcn.180027de0
test rax, rax
je 0x1800dad84
lea rcx, [rsp + 0x30]
call fcn.180027df0
mov r15, rax
mov r8, r15
lea rdx, str.IPv4:__s
mov rcx, rbp
call fcn.1800ceba0
lea rcx, [rsp + 0x30]
call fcn.1800c0c50
lea rcx, [rsp + 0x50]
call fcn.1800c0c50
mov r15, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18011b930
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret
Function at 0x1800e3cf0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1800c0a30
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.1800e3020
mov rcx, rdi
mov rsi, rax
call fcn.1800e3020
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1800e3da0
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1800c0a30
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1800c0ac0
cmp rax, 0x3e8
ja 0x1800e3dd1
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1800e3d50
test rsi, rsi
je 0x1800e3dad
mov rcx, rsi
call fcn.18012d710
test rbx, rbx
je 0x1800e3dba
mov rcx, rbx
call fcn.18012d710
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1800e3dde
mov rcx, rsi
call fcn.18012d710
test rbx, rbx
je 0x1800e3deb
mov rcx, rbx
call fcn.18012d710
mov eax, 1
jmp 0x1800e3dbc
Function at 0x1800e4350
Capabilities:
Resolve dns

Disassembly:
push rbp
push rdi
push r12
push r13
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor ebp, ebp
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1800e44ef
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x1800e44cf
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x1800e43be
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800e43b0
inc rbx
jmp 0x1800e43c0
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1800e43d0
mov r15d, reloc.WS2_32.dll_recv
jmp 0x1800e43df
cmp eax, 0x17
jne 0x1800e4478
mov r15d, 0x1c
cmp qword [rsi + 0x20], 0
je 0x1800e4478
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1800e4478
cmp rax, r15
jb 0x1800e4478
lea rcx, [rbx + 0x30]
add rcx, r15
call qword [section..data]
mov r14, rax
test rax, rax
je 0x1800e4487
mov ecx, dword [rsi]
mov r8, r15
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], r15d
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call fcn.1801522a0
test rbx, rbx
je 0x1800e4465
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, r15
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call fcn.1801522a0
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x1800e4475
mov qword [rbp + 0x28], r14
mov rbp, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1800e43a0
jmp 0x1800e448d
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x60]
test rcx, rcx
je 0x1800e44a7
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x1800e44ca
test rdi, rdi
je 0x1800e44c6
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.18012d710]
mov rdi, rbx
test rbx, rbx
jne 0x1800e44b1
xor edi, edi
jmp 0x1800e44de
test rdi, rdi
jne 0x1800e44de
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x58]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rbp
ret