joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180049aa0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [0x180136b28], rcx
mov ecx, 3
call fcn.1800986c0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov ecx, 8
call fcn.1800d2498
xor ecx, ecx
mov qword [0x180136b08], rax
lea rdx, [0x180114678]
mov qword [rax], rcx
sub rax, rdx
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049b10
mov r8d, 0x208
lea rdx, [rsp + 0x30]
lea rcx, str.Hook64_Path
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov rdi, rbx
cmp byte [rax + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x180049b45
lea rcx, [rdi + 1]
call fcn.1800d2498
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov qword [0x180136b00], rsi
sub rsi, rax
lea rdx, [rsp + 0x30]
nop
movzx ecx, byte [rdx]
mov byte [rsi + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049b80
lea rdx, [rsp + 0x30]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rax, [rsp + 0x30]
mov rdi, rbx
nop word [rax + rax]
cmp byte [rax + rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x180049bb0
lea rcx, [rdi + 1]
call fcn.1800d2498
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov qword [0x180136ae8], rsi
sub rsi, rax
lea r8, [rsp + 0x30]
nop dword [rax]
movzx ecx, byte [r8]
mov byte [rsi + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x180049bf0
mov r9, qword [0x180136b00]
lea rax, str.Settings.ini
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x208
lea rcx, [rsp + 0x30]
call fcn.1800046e0
lea rax, [rsp + 0x30]
nop
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x180049c30
lea rcx, [rbx + 1]
call fcn.1800d2498
lea r8, [rbx + 1]
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov qword [0x180136af0], rdi
sub rdi, rax
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx ecx, byte [rdx]
mov byte [rdi + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180049c70
call fcn.18004a2b0
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800d2160
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18004b090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
mov rdi, qword [rdx]
lea eax, [r8 - 0x80000000]
mov ebp, 0x80000000
mov rbx, rdx
cmp r8d, ebp
movabs r11, 0x5851f42d4c957f2d
lea r14d, [r8 + rbp]
cmovae r14d, eax
lea ecx, [r9 + rbp]
cmp r9d, ebp
lea eax, [r9 - 0x80000000]
cmovae ecx, eax
sub ecx, r14d
cmp ecx, 0xffffffff
jne 0x18004b10e
mov rcx, qword [rdx + 8]
mov rax, rcx
imul rax, r11
add rax, rdi
mov qword [rdx + 8], rax
mov rdx, rcx
mov rax, rcx
shr rdx, 0x2d
shr rax, 0x1b
xor edx, eax
shr rcx, 0x3b
ror edx, cl
jmp 0x18004b1a3
lea r8d, [rcx + 1]
mov qword [rsp + 0x10], rsi
mov rcx, qword [rdx + 8]
mov r9, rcx
mov esi, r8d
mov rax, rcx
imul r9, r11
shr rax, 0x1b
add r9, rdi
mov qword [rdx + 8], r9
mov rdx, rcx
shr rcx, 0x3b
shr rdx, 0x2d
xor edx, eax
ror edx, cl
mov ecx, edx
imul rcx, rsi
cmp ecx, r8d
jae 0x18004b198
xor edx, edx
mov eax, r8d
neg eax
div r8d
cmp ecx, edx
jae 0x18004b198
nop dword [rax + rax]
mov r8, r9
mov rax, r9
mov r10, r9
shr r8, 0x2d
shr r9, 0x3b
movzx ecx, r9b
shr rax, 0x1b
xor r8d, eax
ror r8d, cl
imul r10, r11
mov ecx, r8d
add r10, rdi
imul rcx, rsi
mov r9, r10
cmp ecx, edx
jb 0x18004b160
mov qword [rbx + 8], r10
mov rsi, qword [rsp + 0x10]
shr rcx, 0x20
mov edx, ecx
mov rbx, qword [rsp + 0x18]
add edx, r14d
mov rdi, qword [rsp + 0x28]
cmp edx, ebp
lea eax, [rdx + rbp]
mov rbp, qword [rsp + 0x20]
lea ecx, [rdx - 0x80000000]
cmovae eax, ecx
pop r14
ret
Function at 0x180059c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x28
mov qword [rsp + 0x70], rbx
mov r12, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor edi, edi
lea r13, [0x18010d970]
xorps xmm1, xmm1
mov r10d, edi
mov esi, edi
mov r9d, edi
mov r8, qword [rax]
mov r11d, edi
movsx r14d, byte [r8]
mov qword [r12], rbx
movzx eax, byte [rbx]
test byte [rax + r13 + 1], 8
je 0x180059cbf
nop dword [rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r13 + 1], 8
jne 0x180059cb0
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x180059cd6
mov r15d, ebp
jmp 0x180059cdf
cmp al, 0x2b
mov r15d, edi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x70]
jne 0x180059e18
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180059e18
movsd xmm2, qword [0x1801192b8]
add rdx, 2
nop word [rax + rax]
movzx r8d, byte [rdx]
movsx rcx, r8b
cmp ecx, r14d
jne 0x180059d2a
test r11d, r11d
jne 0x180059d7f
mov r11d, ebp
inc rdx
jmp 0x180059d10
test byte [r8 + r13 + 1], 0x10
je 0x180059d7f
test r10d, r10d
jne 0x180059d41
cmp r8b, 0x30
jne 0x180059d41
inc esi
jmp 0x180059d72
inc r10d
cmp r10d, 0x1e
jg 0x180059d6f
test byte [rcx + r13 + 1], 2
je 0x180059d57
add ecx, 0xffffffd0
jmp 0x180059d5d
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x180059d72
inc r9d
test r11d, r11d
je 0x180059d7a
dec r9d
inc rdx
jmp 0x180059d10
lea eax, [rsi + r10]
test eax, eax
je 0x180059e18
mov qword [r12], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x180059dfe
movzx ecx, byte [rdx + 1]
cmp cl, 0x2d
jne 0x180059db0
mov eax, 2
jmp 0x180059dbe
cmp cl, 0x2b
mov rax, rdi
mov ebp, edi
sete al
inc rax
lea r8, [rdx + rax]
movzx edx, byte [rdx + rax]
test byte [rdx + r13 + 1], 2
je 0x180059e18
nop
movsx eax, dl
lea edi, [rdi + rdi*4]
inc r8
lea edi, [rdi - 0x18]
lea edi, [rax + rdi*2]
movzx eax, byte [r8]
movzx edx, al
test byte [rax + r13 + 1], 2
jne 0x180059dd0
mov eax, edi
mov qword [r12], r8
neg eax
test ebp, ebp
cmove eax, edi
add r9d, eax
test r15d, r15d
je 0x180059e0a
xorps xmm1, xmmword [0x180119590]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x180059e1b
xorps xmm0, xmm0
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18005c070
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
mov r10, rcx
cmp r8, 0x28
ja 0x18005c08c
add rsp, 0x30
pop rbx
jmp fcn.18005bef0
lea rax, [r8 + 1]
movabs rcx, 0x7fffffffffffffe7
cmp rax, rcx
ja 0x18005c0c2
mov rax, qword [r10 + 0x18]
mov r9d, reloc.WS2_32.dll_sendto
mov ecx, dword [rax + 0x50]
mov dword [rsp + 0x20], ecx
mov rcx, r10
call fcn.18005be50
mov qword [rax + 0x10], rbx
add rsp, 0x30
pop rbx
ret
mov rcx, r10
call fcn.180071860
int3
Function at 0x18006ce30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x2060
call fcn.1800d3020
sub rsp, rax
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor ecx, ecx
lea rsi, [rsp + 0x50]
mov r8d, 0x2000
mov qword [rsp + 0x40], rcx
mov r14, rdx
mov qword [rsp + 0x30], rsi
mov ebx, ecx
mov qword [rsp + 0x38], r8
mov r10d, ecx
mov r11d, ecx
mov ebp, ecx
mov edx, ecx
mov r9d, ecx
mov rax, r8
sub rax, rbx
cmp rax, 0x2000
jae 0x18006cf31
lea rax, [r8 + r8]
mov rcx, rax
lea rbx, [r11 + 0x2000]
sub rcx, r10
cmp rcx, 0x2000
cmovae rbx, rax
cmovae rdx, rbp
cmp rbx, rdx
jb 0x18006d046
mov rax, rbx
sub rax, r9
cmp rax, 0x2000
jb 0x18006d046
mov rdx, rbx
mov rcx, rdi
call fcn.18004e880
mov r8, qword [rsp + 0x40]
mov rcx, rax
mov rdx, qword [rsp + 0x30]
mov rsi, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x30], rax
je 0x18006cf22
mov edx, 0xfffffffe
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.18004c9f0
add qword [rdi + 0x10], 0xfffffffffffffff0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
add rcx, rsi
mov r9, r14
mov edx, 1
mov r8d, 0x2000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rcx, rax
mov rsi, qword [rsp + 0x30]
mov r9, rcx
mov qword [rsp + 0x40], rcx
mov rbx, rcx
cmp rax, 0x2000
jne 0x18006cf83
mov r8, qword [rsp + 0x38]
mov r10, rcx
mov r11, rcx
mov rbp, rcx
mov rdx, rcx
jmp 0x18006ce93
mov rax, qword [rdi + 0x18]
cmp qword [rax + 0x18], 0
jle 0x18006cf96
mov rcx, rdi
call fcn.180057140
cmp rbx, 0x28
ja 0x18006cfac
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.18005bef0
jmp 0x18006cfe6
lea rax, [rbx + 1]
movabs rcx, 0x7fffffffffffffe7
cmp rax, rcx
ja 0x18006d056
mov rax, qword [rdi + 0x18]
mov r9d, reloc.WS2_32.dll_sendto
mov r8, rbx
mov rdx, rsi
mov ecx, dword [rax + 0x50]
mov dword [rsp + 0x20], ecx
mov rcx, rdi
call fcn.18005be50
mov qword [rax + 0x10], rbx
mov rcx, qword [rdi + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
lea rax, [rsp + 0x50]
add qword [rdi + 0x10], 0x10
cmp qword [rsp + 0x30], rax
je 0x18006d01e
mov edx, 0xfffffffe
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.18004c9f0
add qword [rdi + 0x10], 0xfffffffffffffff0
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.1800d2160
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdx, str.buffer_too_large
mov rcx, rdi
call fcn.18004fa40
int3
mov rcx, rdi
call fcn.180071860
int3
Function at 0x18006d060
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2060
call fcn.1800d3020
sub rsp, rax
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0x2050], rax
xor ebp, ebp
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], 0x2000
mov eax, ebp
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x50]
mov qword [rsp + 0x30], r14
mov rsi, r8
mov r15, rdx
mov rbx, rcx
cmp r8, 0x2000
jbe 0x18006d122
mov eax, 0x4000
mov rdi, r8
cmp r8, rax
cmovbe rdi, rax
cmp rdi, r8
jb 0x18006d21b
mov rdx, rdi
call fcn.18004e880
mov r8, qword [rsp + 0x40]
mov rcx, rax
mov rdx, qword [rsp + 0x30]
mov r14, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x30], rax
je 0x18006d113
lea edx, [rbp - 2]
mov rcx, rbx
lea r8d, [rbp - 1]
call fcn.18004c9f0
add qword [rbx + 0x10], 0xfffffffffffffff0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rdi
lea rcx, [r14 + rax]
mov r9, r15
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, qword [rsp + 0x40]
mov r14, rax
mov rbx, qword [rsp + 0x48]
add rdi, rax
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
mov rcx, qword [rbx + 0x18]
cmp qword [rcx + 0x18], rbp
jle 0x18006d163
mov rcx, rbx
call fcn.180057140
cmp rdi, 0x28
ja 0x18006d179
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.18005bef0
jmp 0x18006d1b3
lea rax, [rdi + 1]
movabs rcx, 0x7fffffffffffffe7
cmp rax, rcx
ja 0x18006d228
mov rax, qword [rbx + 0x18]
mov r9d, reloc.WS2_32.dll_sendto
mov r8, rdi
mov rdx, rsi
mov ecx, dword [rax + 0x50]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.18005be50
mov qword [rax + 0x10], rdi
mov rcx, qword [rbx + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
lea rax, [rsp + 0x50]
add qword [rbx + 0x10], 0x10
cmp qword [rsp + 0x30], rax
je 0x18006d1eb
mov edx, 0xfffffffe
mov rcx, rbx
lea r8d, [rdx + 1]
call fcn.18004c9f0
add qword [rbx + 0x10], 0xfffffffffffffff0
test r14, r14
setne bpl
mov eax, ebp
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.1800d2160
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2060
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.buffer_too_large
call fcn.18004fa40
int3
mov rcx, rbx
call fcn.180071860
int3
Function at 0x18007b8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
lea rdi, [rdx + 8]
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
cmp eax, 0xc
jne 0x18007b932
mov rax, qword [rcx]
movsxd r10, dword [rdi]
mov r9, qword [rax + 0x38]
mov edx, dword [r9 + r10*4]
mov eax, edx
and eax, 0x3f
cmp al, 0x1b
jne 0x18007b937
dec dword [rcx + 0x20]
and edx, 0xffc5ffff
or edx, 0x440000
xor eax, eax
shr edx, 0x11
mov ecx, 0x4000
test r8d, r8d
cmove eax, ecx
or edx, eax
jmp 0x18007b991
cmp eax, 7
je 0x18007b96e
mov rdx, qword [rbx]
movzx ecx, byte [rcx + 0x3c]
inc ecx
movzx eax, byte [rdx + 0xc]
cmp ecx, eax
jbe 0x18007b953
cmp ecx, 0xff
jae 0x18007b9b5
mov byte [rdx + 0xc], cl
inc byte [rbx + 0x3c]
mov rdx, rsi
movzx r8d, byte [rbx + 0x3c]
mov rcx, rbx
dec r8d
call fcn.18007b1d0
cmp dword [rsi], 7
jne 0x18007b981
mov edx, dword [rdi]
bt edx, 8
jb 0x18007b981
movzx eax, byte [rbx + 0x3a]
cmp edx, eax
jl 0x18007b981
dec byte [rbx + 0x3c]
mov edx, dword [rdi]
shl edx, 9
or edx, ebp
shl edx, 0xe
or edx, 0x3fe3
mov rcx, rbx
call fcn.18007ad70
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18007a9f0
mov rcx, qword [rbx + 0x10]
lea rdx, str.function_or_expression_needs_too_many_registers
call fcn.180078df0
int3
Function at 0x1800989e0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180098a41
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x180098a3b
shr ax, 8
cmp al, 2
jne 0x180098a3b
call fcn.18009e8b0
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800d2160
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800d2160
add rsp, 0x1d8
ret
Function at 0x1800a7570
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x430], 0
mov r14, r9
mov rax, qword [rsp + 0x130]
mov rbp, r8
mov esi, edx
mov rdi, rcx
je 0x1800a76a1
test rax, rax
je 0x1800a76a1
mov rdx, qword [rax + 0xc0]
test rdx, rdx
je 0x1800a76a1
mov ecx, esi
lea r9, str.Data
sub ecx, 1
je 0x1800a75fb
sub ecx, 1
je 0x1800a75eb
sub ecx, 1
je 0x1800a7602
cmp ecx, 1
je 0x1800a75f2
jmp 0x1800a76a1
lea r9, str.Header
lea rax, [0x1800d9940]
jmp 0x1800a7609
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
mov edx, 0xa0
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
call fcn.1800a99c0
lea rax, [rsp + 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800a7632
mov r10, qword [rdi + 0x258]
test r10, r10
je 0x1800a7669
mov rax, qword [rdi + 0x1a8]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call r10
test eax, eax
je 0x1800a76a1
jmp 0x1800a76b1
mov r9, qword [rdi + 0x1a0]
lea rcx, [0x1800d9860]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x1a0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, r14
mov r8, rbp
mov edx, esi
mov rcx, rdi
call fcn.1800a7db0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800d2160
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800a7990
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800a79cb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800a7a90
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rax, edx
mov r10, r9
mov r11, r8
mov rdi, rcx
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
mov rcx, qword [rcx + rax*8 + 0x1a8]
call qword [sym.imp.WS2_32.dll_send]
mov r14, qword [rsp + 0x50]
movsxd rsi, eax
mov dword [r14], 0
cmp rsi, 0xffffffffffffffff
jne 0x1800a7b3c
mov qword [rsp + 0x30], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1800a7b0b
mov dword [r14], 0x51
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov edx, eax
mov rcx, rdi
call fcn.180099630
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1800a76d0
mov rcx, qword [rdi]
mov rax, rsi
mov dword [rcx + 0x882c], ebx
mov dword [r14], gethostname
jmp 0x1800a7af5
mov rdi, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1800a7db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rcx + 0x258]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test r10, r10
je 0x1800a7df3
mov rax, qword [rcx + 0x1a8]
mov qword [rsp + 0x20], rax
call r10
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
ja 0x1800a7e38
mov r9, qword [rbx + 0x1a0]
movsxd rax, edx
mov edx, 2
lea rcx, [rax + rax*2]
lea rax, [0x1800d9860]
add rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbx + 0x1a0]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800a8030
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x7c0]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x1800a80a0
mov rcx, qword [rcx + 0x80]
test rcx, rcx
jne 0x1800a8063
cmp qword [rdi + 0x78], rcx
je 0x1800a80a0
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 0
test rcx, rcx
jne 0x1800a8076
mov rcx, qword [rdi + 0x78]
add rcx, 0xc0
lea r8, [0x1800a90c0]
lea rdx, [rsp + 0x20]
call fcn.1800b1d80
cmp byte [rsp + 0x28], 0
jne 0x1800a80b4
mov qword [rdi + 0x7c0], 0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
test rsi, rsi
je 0x1800a80bc
mov qword [rsi], rbx
cmp byte [rbx + 0x1f0], 0
mov rdi, qword [rbx + 0x1a8]
je 0x1800a80da
mov rcx, rbx
call fcn.1800a0120
test eax, eax
jne 0x1800a80fc
jmp 0x1800a80a0
cmp rdi, 0xffffffffffffffff
je 0x1800a80fc
mov r9d, 2
lea rdx, [rsp + 0x40]
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1800a80a0
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800a8640
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov eax, dword [0x18012c940]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 4
test eax, eax
jne 0x1800a8718
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x9c
call sub.VCRUNTIME140.dll_memset
mov r8b, 3
mov dword [rsp + 0x40], 0x9c
mov edx, 2
mov dword [rsp + 0x44], 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 0x33
lea rcx, [rsp + 0x40]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x1800a870c
mov dword [0x18012c940], 2
jmp 0x1800a876f
mov dword [0x18012c940], 1
jmp 0x1800a871d
cmp eax, 2
je 0x1800a876f
lea rax, [rsp + 0x38]
mov edx, 0xffff
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1800a874e
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jg 0x1800a876f
lea r9, [rsp + 0x34]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1800d2160
add rsp, 0xf0
pop rbx
ret

Function at 0x1800a8870
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
lea r9, [rsp + 0x40]
mov rax, rdx
mov dword [rsp + 0x40], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rdi, rcx
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1800a88db
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
call fcn.180099630
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
call fcn.1800a7790
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.1800a7790
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800a89e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18012c070]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0xa4], 2
mov rbx, rdx
mov rsi, qword [rcx]
mov rdi, rcx
je 0x1800a8ba0
cmp byte [rcx + 0x339], 0
jne 0x1800a8b98
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1800a8a75
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180099630
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1800a76d0
jmp 0x1800a8ba0
xor edx, edx
mov dword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1800a8ad2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180099630
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1800a76d0
jmp 0x1800a8ba0
lea rbx, [rdi + 0xf0]
mov rdx, rbx
lea r8, [rdi + 0x120]
lea rcx, [rsp + 0xb0]
call fcn.1800a90e0
test al, al
jne 0x1800a8b20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180099630
mov r9, rax
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1800a76d0
jmp 0x1800a8ba0
movups xmm0, xmmword [rbx]
mov eax, dword [rbx + 0x28]
lea r8, [rdi + 0x154]
movups xmm1, xmmword [rbx + 0x10]
lea rdx, [rdi + 0x124]
movups xmmword [rdi + 0x70], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rbx + 0x20]
movups xmmword [rdi + 0x80], xmm1
movsd qword [rdi + 0x90], xmm0
mov dword [rdi + 0x98], eax
movzx eax, word [rbx + 0x2c]
mov word [rdi + 0x9c], ax
call fcn.1800a90e0
test al, al
jne 0x1800a8b98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180099630
mov r9, rax
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1800a76d0
jmp 0x1800a8ba0
mov rcx, rdi
call fcn.1800a8580
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800d2160
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret