joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180073990
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180184690]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x1800739f1
cmp byte [rbx + 0x4a76], 0
jne 0x1800739f1
movsx r9d, word [rbx + 0x5b82]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.180062b20
test dil, 1
je 0x180073b1f
jmp 0x180073a7a
movss xmm1, dword [rbx + 0x38bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b82]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x180137c10]
mulss xmm1, dword [0x180137bf4]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47e0], rax
mov dword [rbx + 0x47cc], 1
movss dword [rbx + 0x47d8], xmm0
movss dword [rbx + 0x47dc], xmm1
movss xmm0, dword [rbx + 0x3924]
mulss xmm0, dword [0x180137ae0]
or dword [rbx + 0x47c8], 0x41
movss dword [rbx + 0x4828], xmm0
call fcn.180062b20
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180073ad0
lea r11, [0x180130cc0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180073ab3
cmp byte [r8], r9b
jne 0x180073ab3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180073aa0
not ecx
call fcn.18006a330
test rax, rax
je 0x180073b1f
cmp byte [rax + 0xb6], 0
je 0x180073b1f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5b82]
movsx r9d, word [rbx + 0x5b82]
call fcn.180062b20
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18006cc30
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180112970
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180078f20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c68], 0
lea rbx, [rcx + 0x5c70]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180078fc7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180078f7a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18007b0d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180063c20
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c68]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c78]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180184688]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180078fcf
mov rcx, rbx
call fcn.180063c20
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180079370
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180184690]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800793d3
mov qword [rsp], rbx
lea rbx, [0x180130cc0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800793b3
cmp byte [r8], r9b
jne 0x1800793b3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800793a0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5be0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x180079407
mov r10, qword [r10 + 0x5be8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18007940e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1800793f4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x18008e980
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.1800700c0
cmp byte [rax], 0
je 0x18008e9ef
xor edx, edx
mov ecx, 0x210
call fcn.180072530
test al, al
je 0x18008e9ef
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18008e9ef
mov rbx, qword [0x180184690]
cmp byte [rbx + 0x37b9], 0
je 0x18008e9db
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.180062570
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.1800700c0
cmp byte [rax], 0
je 0x18008ea58
xor edx, edx
mov ecx, 0x214
call fcn.180072530
test al, al
je 0x18008ea58
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18008ea58
mov rbx, qword [0x180184690]
cmp byte [rbx + 0x37b9], 0
je 0x18008ea44
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.180062570
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.1800700c0
cmp byte [rax], 0
je 0x18008eac1
xor edx, edx
mov ecx, 0x212
call fcn.180072530
test al, al
je 0x18008eac1
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18008eac1
mov rbx, qword [0x180184690]
cmp byte [rbx + 0x37b9], 0
je 0x18008eaad
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.180062570
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.1800700c0
cmp byte [rax], 0
je 0x18008eb2a
xor edx, edx
mov ecx, 0x216
call fcn.180072530
test al, al
je 0x18008eb2a
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18008eb2a
mov rbx, qword [0x180184690]
cmp byte [rbx + 0x37b9], 0
je 0x18008eb16
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.180062570
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x1800a5d70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
cmp rdi, 0x40000000
jbe 0x1800a5dbd
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1801865c0]
lea r15, [rdi + 0x40000000]
cmp qword [rsp + 0x60], r15
cmovbe r15, qword [rsp + 0x60]
sub r15, 0xfff
test rsi, rsi
je 0x1800a5dff
cmp rsi, r14
jb 0x1800a5df7
cmp rsi, r15
jae 0x1800a5df7
cmp qword [rsi + 8], 0
jne 0x1800a5fbd
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800a5de2
mov qword [rsp + 0xb8], rbx
mov rbx, rdi
mov qword [rsp + 0xc0], rbp
cmp rdi, r14
jb 0x1800a5e82
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800a5e79
nop word [rax + rax]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800a5e79
cmp dword [rsp + 0x40], 0x10000
je 0x1800a5efb
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x1800a5e79
sub rbx, rbp
cmp rbx, r14
jae 0x1800a5e40
test rsi, rsi
jne 0x1800a5f66
cmp rdi, r15
ja 0x1800a5fad
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800a5fad
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800a5fad
cmp dword [rsp + 0x40], 0x10000
je 0x1800a5f34
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800a5eb2
jmp 0x1800a5fad
test rbx, rbx
je 0x1800a5e79
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800a5f66
cmp rbx, r14
jae 0x1800a5e20
jmp 0x1800a5e82
test rdi, rdi
je 0x1800a5fad
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800a5f66
cmp rdi, r15
jbe 0x1800a5e90
jmp 0x1800a5fad
xor eax, eax
lea rcx, [rsi + 0x40]
mov rdx, rcx
mov qword [rsi + 8], rax
sub rdx, rsi
mov dword [rsi + 0x10], eax
nop dword [rax]
mov rax, qword [rsi + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rsi + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800a5f80
mov rax, qword [0x1801865c0]
mov qword [rsi], rax
mov qword [0x1801865c0], rsi
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180112970
mov rsi, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
ret
Function at 0x1800a6960
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
xor edx, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
mov ebp, r8d
mov esi, r15d
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800a6aaf
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1800a6ad5
lea esi, [r15 + 1]
nop
cmp dword [rsp + 0x20], 0x10
jb 0x1800a6a60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x1800a6a60
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x1800a6a60
mov rdx, qword [rbx]
test rdx, rdx
jne 0x1800a6a22
mov rcx, qword [0x1801846a0]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x1800a6a89
jmp 0x1800a6a53
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x1800a6a53
mov rcx, qword [0x1801846a0]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rbx + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x1800a6a89
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_33
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800a69d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800a6ad5
mov r8, qword [rbx]
mov esi, r15d
test r8, r8
je 0x1800a6ad5
mov rcx, qword [0x1801846a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
mov qword [rbx], r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180112970
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1800a6aaf
cmp qword [rbx], r15
je 0x1800a6b33
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x1800a6b33
mov rax, qword [rbx]
xor edx, edx
mov ecx, edi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800a6b2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800a67b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800a6af0
mov eax, r15d
jmp 0x1800a6ab4
Function at 0x1800a6b40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1801865b0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a6bb3
mov eax, 0xa
jmp 0x1800a6c42
test esi, esi
je 0x1800a6bd5
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800a6bf8
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800a6bf8
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800a6bf1
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800a6bf8
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180112970
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800a6c70
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x1801865bc]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x1800a6cb7
mov rax, qword [0x1801865b0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x1800a6cc4
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x1800a6ca0
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x1800a6cb7
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.1800a6960
mov edi, eax
test eax, eax
jne 0x1800a6dad
mov r9d, dword [0x1801865bc]
cmp ebx, r9d
jae 0x1800a6d3c
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1801865b0]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x1800a6d35
mov edx, esi
mov ecx, ebx
call fcn.1800a6b40
mov edi, eax
test eax, eax
jne 0x1800a6d3c
mov r9d, dword [0x1801865bc]
inc ebx
cmp ebx, r9d
jb 0x1800a6d00
cmp qword [rsp + 0x20], 0
je 0x1800a6dab
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800a6d97
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800a6d88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800a6d60
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801846a0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x1800b8540
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1800b8694
cmp r9, 4
jb 0x1800b858a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1800b8570
xor r11d, r11d
test r9, r9
je 0x1800b8694
cmp r9, 0x40
jb 0x1800b8673
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1800b85bc
cmp rdx, r8
jae 0x1800b8673
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1800b85d1
cmp rdx, r10
jae 0x1800b8673
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rdi
jb 0x1800b8600
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp r11, r9
jae 0x1800b8694
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800b8680
add rsp, 8
ret
Function at 0x1800d1290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0xae5], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1800d1346
cmp qword [rcx + 0x270], 0
je 0x1800d12fb
mov dl, 1
call fcn.1800c0b40
mov rax, qword [rdi + 0x1d8]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x270]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1800c0b40
mov eax, ebx
jmp 0x1800d1348
mov edx, ebx
test ebx, ebx
je 0x1800d130b
sub edx, 1
je 0x1800d130b
cmp edx, 1
jne 0x1800d1346
mov r9, qword [rdi + 0x1d0]
lea rax, [0x180122c00]
mov edx, 2
lea rcx, [rbx + rbx*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800d1360
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
sub rsp, 0x158
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xae5], 0
mov rbx, rcx
jne 0x1800d13a4
cmp qword [rcx + 0x1e0], 0
je 0x1800d1470
mov r8, rdx
mov qword [rsp + 0x150], rdi
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1800e3fa0
mov rdx, qword [rbx + 0x1e0]
movsxd rdi, eax
test rdx, rdx
je 0x1800d1408
cmp byte [rbx + 0x12e3], 0
jne 0x1800d1408
lea rcx, [rsp + 0x30]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1800d13f0
mov byte [rbx + 0x12e3], 1
mov byte [rsp + rdi + 0x30], 0xa
inc rdi
cmp rdi, 0x102
jae 0x1800d14c2
cmp byte [rbx + 0xae5], 0
mov byte [rsp + rdi + 0x30], 0
je 0x1800d1468
cmp qword [rbx + 0x270], 0
je 0x1800d148a
mov dl, 1
mov rcx, rbx
call fcn.1800c0b40
mov rax, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [rbx + 0x270]
xor edx, edx
mov rcx, rbx
call fcn.1800c0b40
mov rdi, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180112970
add rsp, 0x158
pop rsi
pop rbx
ret
mov r9, qword [rbx + 0x1d0]
lea rcx, [0x180122c00]
mov edx, 2
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rbx + 0x1d0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1800d1468
call fcn.18011320c
int3

Function at 0x1800d15f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800d1632
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800d17d0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x238]
mov r14, qword [rcx + r8*8 + 0x1f0]
add rbx, rax
mov rax, qword [rcx + 0x410]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1800d18dc
lea rax, [0x1800d1680]
cmp qword [rcx + r8*8 + 0x218], rax
jne 0x1800d18dc
cmp qword [rbx], 0
je 0x1800d1861
test rdi, rdi
je 0x1800d18dc
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1800e26a0
cmp eax, 0xffffffff
je 0x1800d18dc
test al, 1
je 0x1800d18dc
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800d18bb
mov eax, dword [rbp + 0x6f4]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [0x180156170]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x1800d1916
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1800d18dc
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x1800d1955
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x1800d1925
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x1800d1955
mov dword [rsi], reloc.WLDAP32.dll_Ordinal_27
mov rax, 0xffffffffffffffff
jmp 0x1800d1958
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800e5b00
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.1800d1360
mov dword [rbp + 0xda4], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180112970
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800d1e50
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x288], 0
je 0x1800d1e6d
call fcn.1800cb020
test eax, eax
je 0x1800d1e99
mov al, 1
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1f0]
cmp rcx, 0xffffffffffffffff
je 0x1800d1e99
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret