joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bf680
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, qword [rcx + 0x18]
lea r8, [rsp + 0x20]
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov rbp, qword [rsi + 0x1f0]
mov rcx, rbp
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1800bf6fb
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.18009c180
mov rcx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x1800bf723
lea rdx, str.Error_accept__ing_server_connect
call fcn.18009b810
lea eax, [rbx + 0x1f]
jmp 0x1800bf79f
lea rdx, str.Connection_accepted_from_server
call fcn.18009b980
mov edx, 1
mov byte [rsi + 0x3da], 0
mov rcx, rbx
mov qword [rsi + 0x1f0], rbx
call fcn.1800ca7a0
mov byte [rsi + 0x3ed], 1
cmp qword [rdi + 0x288], 0
je 0x1800bf79d
mov dl, 1
mov rcx, rdi
call fcn.18008a640
mov rcx, qword [rdi + 0x290]
mov r8d, 1
mov rdx, rbx
call qword [rdi + 0x288]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.18008a640
test ebx, ebx
je 0x1800bf79d
mov rdx, rsi
mov rcx, rdi
call fcn.1800bfca0
mov eax, Ordinal_46
jmp 0x1800bf79f
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180133630
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800c1230
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b0]
mov rbx, rcx
mov rdx, qword [rcx + 0x18]
cmp dword [rax + 0x10], 0
je 0x1800c1266
mov dword [rdx + 0x7d0], 0xd
mov r8d, reloc.WS2_32.dll_listen
mov dl, 1
add rsp, 0x20
pop rbx
jmp fcn.1800c1350
cmp byte [rcx + 0xb0e], 0
je 0x1800c127b
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1800c1df0
cmp byte [rcx + 0xb11], 0
je 0x1800c12fc
mov r9, qword [rdx + 0x790]
test r9, r9
jne 0x1800c12be
mov r9, qword [rcx + 0x7b8]
test r9, r9
jne 0x1800c12b5
cmp byte [rbx + 0x12e1], 0
lea rcx, str.NLST
lea r9, str.LIST
cmovne r9, rcx
lea r8, str.PRET__s
jmp 0x1800c12d5
cmp byte [rcx + 0xb1d], 0
lea r8, str.PRET_STOR__s
jne 0x1800c12d5
lea r8, str.PRET_RETR__s
add rdx, 0x700
mov rcx, rbx
call fcn.1800d4d10
test eax, eax
jne 0x1800c1306
mov rcx, qword [rbx + 0x18]
mov dword [rcx + 0x7d0], 0x1d
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.1800c1d40
add rsp, 0x20
pop rbx
ret

Function at 0x1800c1640
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b0]
add rdx, 0x700
mov rbx, rcx
cmp dword [rax + 0x10], 0
je 0x1800c168e
cmp qword [rdx + 0x90], 0
je 0x1800c168e
xor r9d, r9d
lea r8, str.REST__d
call fcn.1800d4d10
test eax, eax
jne 0x1800c1698
mov rcx, qword [rbx + 0x18]
mov dword [rcx + 0x7d0], 0x1a
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.1800c1230
add rsp, 0x20
pop rbx
ret
Function at 0x1800c1960
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x18]
lea eax, [rdx - 0xc8]
xor edi, edi
mov esi, r8d
mov rbx, rcx
cmp eax, 0x64
jb 0x1800c199f
lea rdx, str.Couldnt_set_desired_mode
call fcn.18009b810
lea eax, [rdi + 0x11]
jmp 0x1800c1b0b
cmp edx, 0xc8
je 0x1800c19b6
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.18009b980
cmp esi, 0x13
jne 0x1800c19cb
mov rdx, rbp
mov rcx, rbx
call fcn.1800c1860
jmp 0x1800c1b07
cmp esi, 0x14
jne 0x1800c1ae9
cmp dword [rbx + 0x750], 2
mov rbp, qword [rbx + 0x18]
jne 0x1800c1a4e
mov rax, qword [rbx + 0x1b0]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800c1a4e
mov dword [rsp + 0x28], 3
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.1800c9c90
test eax, eax
jne 0x1800c1b07
mov rcx, qword [rsp + 0x40]
lea edx, [rsi + 0x1b]
call fcn.180136688
test rax, rax
je 0x1800c1a43
mov rdi, qword [rsp + 0x40]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], 0
jmp 0x1800c1a4e
mov rcx, qword [rsp + 0x40]
call qword [fcn.18013a4c0]
mov rdx, qword [rbx + 0x7b8]
test rdx, rdx
jne 0x1800c1a73
cmp byte [rbx + 0x12e1], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x1801df18f]
test rdi, rdi
mov r9, r8
lea rax, reloc.WLDAP32.dll_Ordinal_32
cmovne r9, rdi
lea rcx, [0x180176114]
cmovne r8, rax
call fcn.1800a05b0
mov rcx, rdi
mov rsi, rax
call qword [fcn.18013a4c0]
test rsi, rsi
jne 0x1800c1ab1
lea edi, [rsi + 0x1b]
jmp 0x1800c1b09
lea rdx, [rbp + 0x700]
mov r9, rsi
lea r8, [0x180170520]
mov rcx, rbx
call fcn.1800d4d10
mov rcx, rsi
mov edi, eax
call qword [fcn.18013a4c0]
test edi, edi
jne 0x1800c1b09
mov rcx, qword [rbx + 0x18]
mov dword [rcx + 0x7d0], 0x1f
jmp 0x1800c1b09
cmp esi, 0x15
jne 0x1800c1af4
lea r8d, [rsi - 8]
jmp 0x1800c1afd
cmp esi, 0x16
jne 0x1800c1b09
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rbx
call fcn.1800c1350
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800c8640
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rdi
push r13
sub rsp, 0x58
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov r13, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1800c8666
mov qword [rsp + 0x90], rsi
xor ebp, ebp
cmp byte [rdx], 0x5b
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x50], r15
jne 0x1800c87ca
cmp rbx, 4
jb 0x1800c87de
inc rdi
sub rbx, 2
cmp byte [rdi + rbx], 0x5d
lea r14, [rdi + rbx]
jne 0x1800c87de
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rdi
call fcn.18014ecb0
cmp rbx, rax
je 0x1800c8772
cmp byte [rdi + rax], 0x25
lea r14, [rdi + rax]
jne 0x1800c87de
lea r8d, [rbp + 2]
mov esi, ebp
lea rdx, [0x18017e034]
lea rcx, [r14 + 1]
lea rbx, [r14 + 1]
call fcn.18014d700
test eax, eax
jne 0x1800c8705
movzx eax, byte [r14 + 3]
lea rcx, [r14 + 3]
test al, al
je 0x1800c8705
cmp al, 0x5d
cmovne rbx, rcx
movzx eax, byte [rbx]
test al, al
je 0x1800c87de
mov rcx, rbp
cmp al, 0x5d
je 0x1800c8730
cmp rcx, 0xf
jge 0x1800c8730
inc rbx
mov byte [rsp + rcx + 0x20], al
inc esi
inc rcx
movzx eax, byte [rbx]
test al, al
jne 0x1800c8713
test esi, esi
je 0x1800c87de
cmp byte [rbx], 0x5d
jne 0x1800c87de
movsxd rax, esi
cmp rax, 0x10
jae 0x1800c87e5
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], bpl
call qword [case.0x18008fb59.0]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x1800c876e
mov eax, 7
jmp 0x1800c879e
mov byte [r14 + 1], bpl
lea r8, [rsp + 0x30]
mov byte [r14], bpl
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800c87de
mov byte [r14], 0x5d
cmp byte [rdi], bpl
mov eax, reloc.WS2_32.dll_ntohl
cmove ebp, eax
mov eax, ebp
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180133630
add rsp, 0x58
pop r13
pop rdi
pop rbp
pop rbx
ret
lea rdx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rdi
call fcn.18013de00
cmp rbx, rax
je 0x1800c8791
mov eax, 3
jmp 0x1800c879e
call fcn.180133de8
int3
Function at 0x1800d0aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call case.0x18008fb59.0
mov r13, rax
test rax, rax
jne 0x1800d0b1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.180086a60
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.18009b810
xor ecx, ecx
lea ebx, [rbp + 0x4d]
call qword [fcn.18013a4c0]
jmp 0x1800d0cd8
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r13
mov qword [rsp + 0x170], r14
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1800d0b91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.180086a60
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.18009b810
xor ecx, ecx
lea ebx, [r14 + 0x4e]
jmp 0x1800d0cc2
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1800d0bda
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.180086a60
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.18009b810
mov ebx, Ordinal_79
jmp 0x1800d0cb6
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x1800d0c0f
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.18009b810
mov ebx, Ordinal_79
jmp 0x1800d0cae
lea rcx, [rdi + 1]
call qword [fcn.18013e628]
mov rbp, rax
test rax, rax
jne 0x1800d0c29
lea ebx, [rax + 0x1b]
jmp 0x1800d0cae
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x1800d0c88
nop word [rax + rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800d0cfa
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x1800d0c7f
mov edi, esi
jmp 0x1800d0c81
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x1800d0c40
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.1800d0800
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.18013a4c0]
mov rcx, r13
call fcn.18013a4c0
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180133630
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.180086a60
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.18009b810
mov ebx, Ordinal_79
jmp 0x1800d0ca6
Function at 0x1800d7d60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.18013e628]
mov rdi, rax
test rax, rax
jne 0x1800d7da2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1800d7de9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1800d7e42
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1800d7e00
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1800d7e83
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1801805ec]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1801805ed]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800d7e50
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1800d9cb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800d9f00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800d9dca
mov rax, qword [0x1802017f8]
cmp qword [rsp + 0x20], rax
jb 0x1800d9d14
mov rax, qword [0x180201800]
cmp qword [rsp + 0x20], rax
ja 0x1800d9d14
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800d9cd6
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180136140
mov r8d, gethostbyname
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800d9d45
jmp 0x1800d9dca
cmp dword [rsp + 0x50], 0x10000
jne 0x1800d9dad
cmp qword [rsp + 0x48], 0x10000
jb 0x1800d9dad
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800d9d8b
mov rax, qword [rsp + 0x28]
jmp 0x1800d9dcc
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800d9d9b
xor eax, eax
jmp 0x1800d9dcc
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800d9dc5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800d9f00
mov qword [rsp + 0x20], rax
jmp 0x1800d9cd6
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800d9de0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800d9f40
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800d9ef6
mov rax, qword [0x1802017f8]
cmp qword [rsp + 0x20], rax
jb 0x1800d9e3b
mov rax, qword [0x180201800]
cmp qword [rsp + 0x20], rax
ja 0x1800d9e3b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800d9dfd
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180136140
mov r8d, gethostbyname
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1800d9e6c
jmp 0x1800d9ef6
cmp dword [rsp + 0x50], 0x10000
jne 0x1800d9ed4
cmp qword [rsp + 0x48], 0x10000
jb 0x1800d9ed4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800d9eb2
mov rax, qword [rsp + 0x28]
jmp 0x1800d9ef8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800d9ec2
xor eax, eax
jmp 0x1800d9ef8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800d9ef1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800d9f40
mov qword [rsp + 0x20], rax
jmp 0x1800d9dfd
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800d9f90
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800da520
mov qword [rsp + 0x28], 0
cmp qword [0x1804a0ea0], 0
jne 0x1800d9fd8
cmp qword [0x1804a0e98], 0
je 0x1800d9fd8
mov rax, qword [0x1804a0e98]
mov qword [0x1804a0ea0], rax
cmp qword [0x1804a0ea0], 0
je 0x1800da07e
mov rax, qword [0x1804a0ea0]
cmp qword [rax + 0x10], 0
je 0x1800da07e
mov rax, qword [0x1804a0ea0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800da07e
mov rax, qword [0x1804a0ea0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800da07e
mov rax, qword [0x1804a0ea0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800da044
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800da04b
xor eax, eax
jmp 0x1800da1f9
mov rax, qword [0x1804a0ea0]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180136140
mov rax, qword [rsp + 0x28]
jmp 0x1800da1f9
mov rax, qword [0x1804a0e98]
mov qword [0x1804a0ea0], rax
jmp 0x1800da0a0
mov rax, qword [0x1804a0ea0]
mov rax, qword [rax + 8]
mov qword [0x1804a0ea0], rax
cmp qword [0x1804a0ea0], 0
je 0x1800da0ed
cmp qword [0x1804a0ea0], 0
je 0x1800da0eb
mov rax, qword [0x1804a0ea0]
cmp qword [rax + 0x10], 0
je 0x1800da0eb
mov rax, qword [0x1804a0ea0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800da0eb
mov rax, qword [0x1804a0ea0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800da0eb
jmp 0x1800da01c
jmp 0x1800da08e
mov rcx, qword [rsp + 0x60]
call fcn.1800dc430
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800da200
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800da1f7
mov rax, qword [rsp + 0x48]
mov qword [0x1804a0ea0], rax
mov rax, qword [0x1804a0ea0]
mov dword [rax], 0x52727464
mov rax, qword [0x1804a0ea0]
mov qword [rax + 0x10], 0
mov rax, qword [0x1804a0ea0]
mov rcx, qword [0x1804a0e98]
mov qword [rax + 8], rcx
mov rax, qword [0x1804a0ea0]
mov qword [0x1804a0e98], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1804a0ea0]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800da1a8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800da1e2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800da19e
mov rax, qword [0x1804a0ea0]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800da01c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800daf10
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, gethostbyname
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800daf57
xor al, al
jmp 0x1800daff9
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800daf81
xor al, al
jmp 0x1800daff9
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800daff1
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800daff1
mov al, 1
jmp 0x1800daff9
jmp 0x1800daff7
xor al, al
add rsp, 0x78
ret

Function at 0x1800db300
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1804a0e98]
mov qword [rsp + 0x28], rax
jmp 0x1800db320
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800db34f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1800db34d
call sub.KERNEL32.dll_GetLastError
jmp 0x1800db351
jmp 0x1800db312
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800dbbf0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1804a0eb0], eax
je 0x1800dbc0b
mov eax, 0x10dd
jmp 0x1800dbd30
mov rax, qword [0x1804a0ec8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800dbcb5
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x1800dbc80
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x1800dbc80
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800da660
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, gethostbyname
mov rcx, qword [rsp + 0x38]
call fcn.180133ca4
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800dbc17
mov qword [0x1804a0ec8], 0
call fcn.1800db0c0
mov rax, qword [0x1804a0ec0]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800dbd19
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x48]
call fcn.180133ca4
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1800dbcd1
mov qword [0x1804a0ec0], 0
mov dword [0x1804a0eb0], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800dc260
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1804a0eb4], 0
je 0x1800dc27d
mov eax, dword [0x1804a0eb4]
jmp 0x1800dc343
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x1800dc290
xor eax, eax
jmp 0x1800dc343
mov ecx, reloc.WS2_32.dll_recv
call fcn.1801338e8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1800dc2fe
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x1800dc2e3
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x38]
call fcn.180133ca4
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1804a0eb4], eax
mov qword [0x1804a0eb8], 0
mov eax, dword [rsp + 0x20]
jmp 0x1800dc343
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1800dc318
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x1800dc2b9
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1804a0ec0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1804a0ec0], rax
xor eax, eax
add rsp, 0x48
ret