joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180067b30
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x180067b82
lea rdx, str.Couldnt_set_desired_mode
call fcn.180053b90
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x180067b97
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.180053a90
cmp edi, 0x13
jne 0x180067ba6
mov rcx, rsi
call fcn.180067ab0
jmp 0x180067bd1
cmp edi, 0x14
jne 0x180067bb5
mov rcx, rsi
call fcn.180064cb0
jmp 0x180067bd1
cmp edi, 0x15
jne 0x180067bc4
mov rcx, rsi
call fcn.180067b10
jmp 0x180067bd1
cmp edi, 0x16
jne 0x180067bd3
mov rcx, rsi
call fcn.180067b20
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180068310
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
mov ebx, dword [rcx + 0x674]
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov rdi, rcx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x18006839c
test ebx, ebx
jne 0x18006835a
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.180053a90
mov dword [rdi + 0x41c], ebx
inc ebx
cmp ebx, 2
jne 0x180068383
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.180053b90
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1800643c0
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.180053a90
xor edx, edx
mov rcx, rdi
call fcn.180064280
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180068170
Function at 0x180070fb0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1038
call fcn.180039cb0
sub rsp, rax
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x1020], rax
call fcn.1800354e8
mov byte [rsp + 0x20], 0
test rax, rax
je 0x18007101c
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x18007101c
lea rcx, [rsp + 0x20]
call qword [fcn.180043464]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x1038
ret
xor eax, eax
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x1038
ret
jmp 0x180070fb0

Function at 0x180071040
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1038
call fcn.180039cb0
sub rsp, rax
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x1020], rax
call fcn.1800354e8
mov byte [rsp + 0x20], 0
test rax, rax
je 0x18007101c
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x18007101c
lea rcx, [rsp + 0x20]
call qword [fcn.180043464]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x1038
ret
xor eax, eax
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x1038
ret
jmp 0x180070fb0

Function at 0x1800748f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov edx, 0x4004747b
mov dword [rsp + 0x28], 4
mov rbx, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x180074957
lea r9, [rsp + 0x68]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x50
pop rbx
ret
Function at 0x180077210
Capabilities:
Resolve dns

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r14, r9
mov qword [r9], r15
lea r9, [rsp + 0x68]
mov esi, r15d
mov r13d, r15d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1800773ad
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x180077393
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov eax, dword [rbx + 4]
cmp eax, 2
jne 0x18007726d
lea ebp, [rax + 0xe]
jmp 0x180077279
cmp eax, 0x17
jne 0x180077321
lea ebp, [rax + 5]
cmp qword [rbx + 0x20], r15
je 0x180077321
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x180077321
cmp rax, rbp
jb 0x180077321
mov ecx, 0x30
call qword [fcn.1800339ec]
mov rdi, rax
test rax, rax
je 0x18007735c
mov ecx, dword [rbx]
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
mov dword [rax + 0x10], ebp
mov dword [rax + 0xc], ecx
mov rcx, rbp
mov qword [rax + 0x20], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x28], r15
call qword [fcn.1800339ec]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x18007734b
mov rdx, qword [rbx + 0x20]
mov r8, rbp
mov rcx, rax
call fcn.180033ff0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18007730e
call qword [fcn.180043464]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x180077330
test rsi, rsi
cmove rsi, rdi
test r13, r13
je 0x18007731e
mov qword [r13 + 0x28], rdi
mov r13, rdi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x180077260
jmp 0x180077362
mov rcx, qword [rdi + 0x20]
mov r12d, 8
call qword [fcn.1800337e4]
mov rcx, rdi
call qword [fcn.1800337e4]
jmp 0x180077362
mov rcx, rdi
mov r12d, 8
call qword [fcn.1800337e4]
jmp 0x180077362
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x18007737c
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x18007738e
mov rcx, rsi
call fcn.1800771c0
mov rsi, r15
jmp 0x1800773a2
test rsi, rsi
jne 0x1800773a2
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x50]
mov qword [r14], rsi
mov eax, r12d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1800776e0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edx, 1
mov edi, 2
mov rsi, r9
lea r8d, [rdx + 5]
mov ecx, edi
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov dword [rsp + 0x34], 1
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800778d5
xor eax, eax
mov ecx, 0x7f000001
mov qword [rsp + 0x38], rax
mov word [rsp + 0x38], di
mov qword [rsp + 0x40], rax
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rsp + 0x34]
lea r8d, [rdi + 2]
mov dword [rsp + 0x3c], eax
xor eax, eax
mov edx, 0xffff
mov rcx, rbx
mov qword [rsi + 8], 0xffffffffffffffff
mov qword [rsi], 0xffffffffffffffff
mov word [rsp + 0x3a], ax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800778b9
lea r8d, [rdi + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1800778b9
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1800778b9
lea edx, [rdi - 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1800778b9
lea edx, [rdi - 1]
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1800778b9
lea r8d, [rdi + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1800778b9
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1800778b9
lea r8, [0x1800966bc]
lea edx, [rdi + 0xa]
lea rcx, [rsp + 0x48]
mov r9, rsi
call fcn.1800703c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x48]
lea rdx, [rsp + 0x48]
xor r9d, r9d
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea r8d, [rcx - 1]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_send]
movsxd rdx, eax
cmp rdx, rdi
jne 0x1800778b9
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea rdx, [rsp + 0x54]
lea r8d, [r9 + 0xc]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, rdi
jne 0x1800778b9
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x48]
mov r8, rdi
call fcn.18003f130
test eax, eax
jne 0x1800778b9
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1800778d8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsi + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800334b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800779d0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.180084374
test rax, rax
je 0x1800779f9
cmp rax, 0xffffffffffffffff
jne 0x1800779fb
xor eax, eax
add rsp, 0x38
ret
Function at 0x180078860
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
xor eax, eax
test edx, edx
lea r8, [rsp + 0x38]
setne al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x18007d220
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov byte [rcx], 0
mov edx, ebx
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x18007d259
lea edx, [rax + 0x2e]
mov rcx, rdi
call fcn.1800435c8
test rax, rax
je 0x18007d257
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18007d390
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18007d461
xor eax, eax
lea rdx, [rsp + 0x64]
mov rcx, rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.18007d2f0
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.180082670
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea r8d, [r9 + 0x14]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x18007d465
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x18007d4b2
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800334b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18007d4e0
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.18007d390
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.18007d390
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18007d390
Function at 0x18007da60
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rbx, rcx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18007daa3
mov rcx, qword [rbx]
lea rax, [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
add rsp, 0x30
pop rbx
ret
Function at 0x180081cf0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x28], eax
mov qword [rcx], rax
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret

Function at 0x1800826d0
Capabilities:
Create new key via cryptacquirecontext
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
lea rdi, [rcx + 8]
xor r8d, r8d
lea r9d, [rax + 1]
xor edx, edx
mov rbx, rcx
mov qword [rcx], rax
mov qword [rdi], rax
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18008271d
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180082840
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.1800339ec]
mov rdi, rax
test rax, rax
jne 0x180082881
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x1800828c5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.WS2_32.dll_htonl]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.WS2_32.dll_recv]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x180082924
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
dec r12
jne 0x1800828e0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x180082963
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1800991f4]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1800991f5]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x180082930
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x1800894e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x18008950e
call fcn.180037028
and dword [rax], 0
call fcn.180037008
mov ebx, reloc.WS2_32.dll_shutdown
mov dword [rax], ebx
call fcn.180036fa0
mov eax, ebx
jmp 0x18008955e
test edx, 0xfffffff9
jne 0x1800894f1
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180089537
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180037048
call fcn.180037008
mov eax, dword [rax]
jmp 0x18008955e
test al, 0x10
jne 0x18008955c
test al, 1
je 0x18008955c
test bl, 2
je 0x18008955c
call fcn.180037028
mov dword [rax], 5
call fcn.180037008
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x18008952e
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14158e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14158e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14158e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14158e0c7
add dl, dl
jne 0x14158e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14158e14e
xor eax, eax
add dl, dl
jne 0x14158e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14158e205
add dl, dl
jne 0x14158e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14158e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14158e0d6
mov eax, 1
add dl, dl
jne 0x14158e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14158e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14158e153
sub eax, ebx
mov ebx, 1
jne 0x14158e1a4
mov ecx, 1
add dl, dl
jne 0x14158e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14158e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14158e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14158e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14158e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14158e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14158e1b5
cmp eax, 0x7d00
jae 0x14158e1f3
cmp eax, 0x500
jb 0x14158e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14158e0d6
cmp eax, 0x7f
ja 0x14158e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14158e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14158e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14158e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401550
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
lea r9, [rdx + 0x10]
mov rax, rcx
movzx r8d, byte [rdx]
add rdx, 4
add rax, 4
mov byte [rax - 4], r8b
movzx r8d, byte [rdx - 3]
mov byte [rax - 3], r8b
movzx r8d, byte [rdx - 2]
mov byte [rax - 2], r8b
movzx r8d, byte [rdx - 1]
mov byte [rax - 1], r8b
cmp r9, rdx
jne 0x401559
lea r11, [0x00406120]
mov r10d, 4
lea rbx, section..rdata
nop dword [rax]
test r10b, 3
movzx r9d, byte [rcx + 0xc]
movzx r8d, byte [rcx + 0xd]
movzx edx, byte [rcx + 0xe]
movzx eax, byte [rcx + 0xf]
jne 0x4015da
movzx esi, byte [r11 + r8]
movzx r8d, byte [r11 + rdx]
movzx edx, byte [r11 + rax]
movzx eax, byte [r11 + r9]
mov r9d, r10d
shr r9d, 2
xor sil, byte [rbx + r9]
mov r9d, esi
xor r9b, byte [rcx]
add r10d, 1
add rcx, 4
xor r8b, byte [rcx - 3]
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0xc], r9b
mov byte [rcx + 0xd], r8b
mov byte [rcx + 0xe], dl
mov byte [rcx + 0xf], al
cmp r10d, 0x2c
jne 0x4015a0
pop rbx
pop rsi
ret
Function at 0x401610
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
lea r11, [rcx + 4]
lea rsi, [rdx - 4]
mov r9, r11
lea r10, [rcx + 0x14]
sub rsi, rcx
lea rax, [r9 - 4]
lea r8, [rsi + r9]
movzx ebx, byte [r8]
add r8, 1
xor byte [rax], bl
add rax, 1
cmp rax, r9
jne 0x401634
lea r9, [rax + 4]
cmp r9, r10
jne 0x40162c
lea rsi, [rdx + 0x10]
lea rdi, [rdx + 0xa0]
sub rsi, rcx
lea rbx, [rcx + 0x10]
sub rdi, rcx
lea r9, [0x00406120]
nop dword [rax]
mov r8, rbx
lea rax, [r8 - 0x10]
movzx ebp, byte [rax]
add rax, 4
movzx ebp, byte [r9 + rbp]
mov byte [rax - 4], bpl
cmp r8, rax
jne 0x401677
add r8, 1
cmp r8, r10
jne 0x401673
movzx r8d, byte [rcx + 9]
cmp rdi, rsi
movzx eax, byte [rcx + 1]
movzx ebp, byte [rcx + 5]
movzx r12d, byte [rcx + 0xa]
mov byte [rcx + 5], r8b
movzx r8d, byte [rcx + 0xd]
mov byte [rcx + 0xd], al
movzx eax, byte [rcx + 2]
movzx r13d, byte [rcx + 0xf]
mov byte [rcx + 1], bpl
mov byte [rcx + 2], r12b
mov byte [rcx + 9], r8b
movzx r8d, byte [rcx + 0xe]
mov byte [rcx + 0xa], al
movzx eax, byte [rcx + 6]
mov byte [rcx + 6], r8b
movzx r8d, byte [rcx + 0xb]
mov byte [rcx + 0xe], al
movzx eax, byte [rcx + 3]
mov byte [rcx + 3], r13b
mov byte [rcx + 0xf], r8b
movzx r8d, byte [rcx + 7]
mov byte [rcx + 7], al
mov byte [rcx + 0xb], r8b
je 0x401816
mov rax, rcx
movzx r8d, byte [rax]
xor r12d, r13d
add rax, 4
xor ebp, r8d
mov r14d, ebp
xor r12d, ebp
add ebp, ebp
shr r14b, 7
lea r13d, [r14 + r14]
add r13d, r14d
lea r13d, [r13 + r13*8]
xor ebp, r13d
mov r13d, r8d
xor r8b, byte [rax - 1]
xor r13d, r12d
xor ebp, r13d
mov byte [rax - 4], bpl
movzx ebp, byte [rax - 3]
xor bpl, byte [rax - 2]
mov r14d, ebp
add ebp, ebp
shr r14b, 7
lea r13d, [r14 + r14]
add r13d, r14d
lea r13d, [r13 + r13*8]
xor ebp, r13d
movzx r13d, byte [rax - 3]
xor r13d, r12d
xor ebp, r13d
mov byte [rax - 3], bpl
movzx ebp, byte [rax - 2]
xor bpl, byte [rax - 1]
mov r14d, ebp
add ebp, ebp
shr r14b, 7
lea r13d, [r14 + r14]
add r13d, r14d
lea r13d, [r13 + r13*8]
xor ebp, r13d
movzx r13d, byte [rax - 2]
xor r13d, r12d
xor r12b, byte [rax - 1]
xor ebp, r13d
mov r13d, r8d
shr r13b, 7
mov byte [rax - 2], bpl
add r8d, r8d
lea ebp, [r13 + r13]
add ebp, r13d
lea ebp, [rbp + rbp*8]
xor r8d, ebp
xor r8d, r12d
mov byte [rax - 1], r8b
cmp rax, rbx
je 0x4017e0
movzx ebp, byte [rax + 1]
movzx r12d, byte [rax + 2]
movzx r13d, byte [rax + 3]
jmp 0x401704
lea r13, [rsi - 4]
mov rbp, r11
lea rax, [rbp - 4]
lea r8, [r13 + rbp]
movzx r12d, byte [r8]
add r8, 1
xor byte [rax], r12b
add rax, 1
cmp rbp, rax
jne 0x4017f0
add rbp, 4
cmp rbp, r10
jne 0x4017e7
add rsi, 0x10
jmp 0x401670
lea r8, [rdx + 0x9c]
sub r8, rcx
lea rax, [r11 - 4]
lea rdx, [r8 + r11]
movzx ecx, byte [rdx]
add rdx, 1
xor byte [rax], cl
add rax, 1
cmp r11, rax
jne 0x401828
add r11, 4
cmp r11, r10
jne 0x401820
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret