joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180014124
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x530
cmp edx, 1
jne 0x180014211
lea rcx, [0x1800f50f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1800f5110]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlNewSecurityObjectWithMultipleInheritance
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and qword [rsp + 0x50], 0
lea rcx, [0x180149890]
and qword [rsp + 0x48], 0
mov r9, rax
and qword [rsp + 0x40], 0
xor r8d, r8d
and qword [rsp + 0x38], 0
mov edx, 0x1fffff
mov dword [rsp + 0x30], 5
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
call rdi
mov rcx, qword [0x180149890]
test rcx, rcx
je 0x180014211
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x90], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1800141df
xor eax, eax
jmp 0x180014216
mov rcx, qword [0x180149890]
lea rax, [0x180013044]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0xe0], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1800141db
mov rcx, qword [0x180149890]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov rbx, qword [rsp + 0x540]
add rsp, 0x530
pop rdi
ret

Function at 0x18001756c
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x180149a34], eax
test eax, eax
je 0x1800175c3
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1800175e4
mov rdx, qword [rbx + 8]
lea rcx, [fcn.180007114]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1800175ec
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x50
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea r12d, [r9 + 1]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 8], rax
mov rdi, rax
test rax, rax
jne 0x180017667
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, r12d
mov rcx, rsi
mov ebx, eax
call qword [r8]
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.180016218
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.180016efc
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x1800176c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, r12d
mov rcx, rsi
mov ebx, eax
call qword [r8]
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.180016218
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.180016efc
and dword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r8, [0x18001777c]
and dword [rsp + 0x20], 0
mov r9, rsi
mov edx, r14d
xor ecx, ecx
call fcn.1800abc70
mov qword [rbp + 8], rax
test rax, rax
jne 0x180017747
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, r12d
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x180017713
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x180017722
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.180016218
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.180016efc
test rdi, rdi
je 0x180017761
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x180017828
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov rdi, r9
mov r15, rdx
mov r14, rcx
mov esi, r12d
cmp rcx, 0xffffffffffffffff
je 0x1800179e1
test r8b, r8b
je 0x1800178cb
mov al, byte [rdx]
test al, 8
je 0x1800178cb
xor ecx, ecx
mov dword [rbp + 0x30], r12d
or al, 8
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rcx
lea r9, [rbp + 0x30]
mov byte [rdx], al
mov rcx, r14
mov edx, 0xffff
mov qword [rbp - 0x20], r12
mov r8d, 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1800178af
lea rcx, [rbp - 0x30]
call fcn.180016284
mov r8, rax
xor edx, edx
jmp 0x1800178c2
call fcn.180015750
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov r8, rbx
lea rcx, [rbp - 0x18]
call fcn.180016218
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test eax, eax
jne 0x1800178ec
mov rcx, rdi
call fcn.180016284
mov r8, rax
xor edx, edx
jmp 0x1800179c8
call fcn.180015750
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rbx
lea rcx, [rbp - 0x18]
mov edx, eax
call fcn.180016218
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rdi + 0x10], xmm1
call fcn.180015750
mov r8, rax
lea rcx, [rbp - 0x30]
mov edx, 0x2733
call fcn.180016218
movups xmm0, xmmword [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, rdi
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbp - 0x18], xmm0
movsd qword [rbp - 8], xmm1
call fcn.180016478
test al, al
jne 0x180017988
call fcn.180015750
mov r8, rax
lea rcx, [rbp - 0x18]
mov edx, 0x4d5
call fcn.180016218
movups xmm0, xmmword [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov rcx, rdi
movsd xmm1, qword [rbp - 8]
movups xmmword [rbp - 0x30], xmm0
movsd qword [rbp - 0x20], xmm1
call fcn.180016478
test al, al
je 0x1800179e1
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, r14
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r15], 0xfc
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test eax, eax
je 0x1800178da
call fcn.180015750
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov r8, rbx
lea rcx, [rbp - 0x18]
call fcn.180016218
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rdi + 0x10], xmm1
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x18001809c
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov dword [rax + 0x20], r9d
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rax - 0x38], 0
lea r9, [rbp + 0x28]
and qword [rax - 0x40], 0
and dword [rax - 0x48], 0
and dword [rbp + 0x28], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
call fcn.180015750
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rbx
lea rcx, [rbp - 0x20]
mov edx, eax
call fcn.180016218
mov rbx, qword [rbp + 0x30]
movabs r8, 0x4800144005b3
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbx + 0x10], xmm1
cmp qword [rbx + 0x10], 1
je 0x180018116
mov eax, dword [rbx]
jmp 0x180018140
mov rcx, qword [rbx + 8]
mov rax, r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, dword [rbx]
cmp eax, 0x40
jne 0x180018151
call fcn.180015750
mov edx, 0x2746
jmp 0x180018197
cmp qword [rbx + 0x10], 1
je 0x18001815c
mov eax, dword [rbx]
jmp 0x180018186
mov rcx, qword [rbx + 8]
mov rax, r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul eax, eax, 0x1ffff7
sub ecx, eax
imul eax, ecx, 0x3e8
add eax, dword [rbx]
cmp eax, 0x4d2
jne 0x1800181b4
call fcn.180015750
mov edx, 0x274d
mov r8, rax
lea rcx, [rbp - 0x20]
call fcn.180016218
movups xmm0, xmmword [rbp - 0x20]
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test edi, edi
je 0x1800181bd
or eax, 0xffffffff
jmp 0x1800181e6
mov rcx, rbx
call fcn.180016284
mov r8, rax
lea rcx, [rbp - 0x20]
xor edx, edx
call fcn.180016218
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rax + 0x10]
mov eax, dword [rbp + 0x28]
movsd qword [rbx + 0x10], xmm1
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1800181f8
Capabilities:
Get socket status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov r12, r9
mov r13, r8
mov sil, dl
mov r14, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180018268
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, 0x2719
call fcn.180016218
mov rax, qword [rbp + 0x200]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
xor eax, eax
jmp 0x1800183e1
cmp byte [rbp + 0x1f8], 0
je 0x1800182a7
test sil, 0x10
je 0x1800182a7
mov rbx, qword [rbp + 0x200]
mov rcx, rbx
call fcn.180016284
mov r8, rax
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.180016218
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rbx + 0x10], xmm1
jmp 0x180018261
mov rdi, qword [rbp + 0x200]
mov r8, r12
mov rdx, r13
mov qword [rsp + 0x20], rdi
call fcn.18001809c
test eax, eax
jns 0x1800183df
and sil, 1
test sil, sil
jne 0x180018261
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, 0x2733
call fcn.180016218
movups xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
call fcn.180016478
test al, al
jne 0x18001834f
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x30]
mov edx, 0x4d5
call fcn.180016218
movups xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsp + 0x48], xmm0
movsd qword [rsp + 0x58], xmm1
call fcn.180016478
test al, al
je 0x180018261
and qword [rsp + 0x20], 0
lea ecx, [r14 + 1]
xor r9d, r9d
mov qword [rbp - 0x68], r14
lea r8, [rbp - 0x70]
mov dword [rbp - 0x70], 1
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
mov r15d, eax
test eax, eax
js 0x18001838e
mov rcx, rdi
call fcn.180016284
mov r8, rax
lea rcx, [rsp + 0x78]
xor edx, edx
jmp 0x1800183a6
call fcn.180015750
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, eax
call fcn.180016218
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rax + 0x10]
movsd qword [rdi + 0x10], xmm1
test r15d, r15d
js 0x180018261
mov r8, r12
mov qword [rsp + 0x20], rdi
mov rdx, r13
mov rcx, r14
call fcn.18001809c
test eax, eax
js 0x1800182ca
cdqe
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180018d3c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r14, rdx
mov rbx, rcx
xor eax, eax
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x180018dee
lea edi, [rax + 1]
mov eax, edi
xchg dword [rcx + 0x34], eax
test eax, eax
jne 0x180018dc8
xchg dword [rcx + 0x38], edi
test edi, edi
jne 0x180018dc8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x180018dc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.180015750
mov r8, rax
mov edx, ebx
lea rcx, [rbp - 0x31]
call fcn.180016218
lea rdx, str.pqcs
lea rcx, [rbp - 0x31]
call fcn.180016efc
xor eax, eax
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
and qword [rbp - 0x59], rax
movups xmm0, xmmword [rbp - 0x69]
movups xmmword [r14], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [r14 + 0x10], xmm1
jmp 0x180018eb0
and dword [rbp + 0x37], 0
lea rcx, [rbp + 0x3f]
call fcn.1800634fc
nop
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rbp - 0x19]
call fcn.1800a8ae0
nop
mov rax, rbx
lea rdx, [rbx + 0x28]
neg rax
sbb rcx, rcx
and rcx, rdx
mov qword [rbp - 0x51], rcx
lea rax, [rbp - 0x19]
mov qword [rbp - 0x49], rax
mov ecx, dword [0x180149b34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x51]
mov ecx, dword [0x180149b34]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
xor esi, esi
jmp 0x180018e5c
lea rax, [rsi + 1]
cmp rsi, 0xffffffffffffffff
cmove rax, rsi
mov rsi, rax
mov r9, r14
lea r8, [rbp - 0x19]
mov rcx, rbx
call fcn.180019140
test rax, rax
jne 0x180018e4d
mov rdx, qword [rbp - 0x41]
mov ecx, dword [0x180149b34]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rbp - 0x19]
mov edi, 1
lea r14d, [rdi + 9]
mov rcx, qword [rbx]
test rcx, rcx
je 0x180018e9b
call fcn.180059b58
add rbx, 8
sub r14, rdi
jne 0x180018e8e
lea rcx, [rbp + 0x3f]
call fcn.180063590
mov rax, rsi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180018f2c
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
lea rax, [rcx + 0x28]
neg rcx
sbb rbx, rbx
and rbx, rax
mov ecx, dword [0x180149b34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x180018f67
cmp qword [rax], rbx
je 0x180018f6e
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180018f5e
jmp 0x180018f74
mov rbx, qword [rax + 8]
jmp 0x180018f76
xor ebx, ebx
test rbx, rbx
je 0x180019033
mov ecx, dword [rbx + 0x50]
test ecx, ecx
je 0x18001900c
cmp ecx, 1
jne 0x180019033
mov dword [rbx + 0x50], 2
lea rax, [rbp - 0x28]
mov qword [rbp + 0x10], rax
lea rdx, [rbx + 0x58]
lea rcx, [rbp - 0x48]
call fcn.180063450
lea rax, [rbp - 0x48]
mov qword [rbp + 0x18], rax
lea rax, [0x1800ddac0]
mov qword [rbp - 0x28], rax
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rax, [0x1800f7c98]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x10]
call fcn.180063450
nop
lea rcx, [rbp - 0x48]
call fcn.180063590
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x38]
call fcn.18002a6ec
nop
mov rdx, rax
lea rcx, [rbx + 0x58]
call fcn.180063448
nop
jmp 0x18001902a
mov dword [rbx + 0x50], 1
lea rcx, [rbp - 0x38]
call fcn.180015378
nop
lea rcx, [rbx + 0x58]
mov rdx, rax
call fcn.180063448
nop
lea rcx, [rbp - 0x38]
call fcn.180063590
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
ret
Function at 0x18001e274
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov r10, rdx
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movabs rax, 0xaaaaaaaaaaaaaaab
mov r11, rcx
mul r8
mov r9, rcx
shr rdx, 1
mov rbx, rdx
je 0x18001e303
movzx eax, byte [r10]
shr rax, 2
mov al, byte [rax + rsi]
mov byte [r9], al
movzx eax, byte [r10 + 1]
movsx ecx, byte [r10]
shr eax, 4
and ecx, 3
shl ecx, 4
add ecx, eax
mov al, byte [rcx + rsi]
mov byte [r9 + 1], al
movzx eax, byte [r10 + 2]
movsx ecx, byte [r10 + 1]
shr eax, 6
and ecx, 0xf
lea eax, [rax + rcx*4]
mov al, byte [rax + rsi]
mov byte [r9 + 2], al
movsx rax, byte [r10 + 2]
add r10, 3
and eax, 0x3f
mov al, byte [rax + rsi]
mov byte [r9 + 3], al
add r9, 4
sub rbx, 1
jne 0x18001e2a3
lea rax, [rdx + rdx*2]
sub r8, rax
sub r8, 1
je 0x18001e355
cmp r8, 1
jne 0x18001e37f
movzx eax, byte [r10]
shr rax, 2
mov al, byte [rax + rsi]
mov byte [r9], al
movsx ecx, byte [r10]
movzx eax, byte [r10 + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, eax
mov al, byte [rcx + rsi]
mov byte [r9 + 1], al
movsx rax, byte [r10 + 1]
and eax, 0xf
mov al, byte [rsi + rax*4]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
jmp 0x18001e37b
movzx eax, byte [r10]
shr rax, 2
mov al, byte [rax + rsi]
mov byte [r9], al
movsx rcx, byte [r10]
and ecx, 3
add rcx, rcx
mov cl, byte [rsi + rcx*8]
mov byte [r9 + 1], cl
mov word [r9 + 2], 0x3d3d
add r9, 4
mov rbx, qword [rsp + 8]
sub r9, r11
mov rsi, qword [rsp + 0x10]
mov rax, r9
ret
Function at 0x18001fc24
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov r8, qword [rdx + 8]
mov rsi, rcx
mov rdx, qword [rdx]
lea rcx, [rbp - 0x79]
xor ebx, ebx
mov dword [rbp - 0x69], 0x67452301
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x71], rbx
mov dword [rbp - 0x65], 0xefcdab89
mov dword [rbp - 0x61], 0x98badcfe
mov dword [rbp - 0x5d], 0x10325476
mov dword [rbp - 0x59], 0xc3d2e1f0
call fcn.18001f67c
lea r8d, [rbx + 0x24]
lea rdx, str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11
lea rcx, [rbp - 0x79]
call fcn.18001f67c
mov rax, qword [rbp - 0x79]
mov rdi, qword [rbp - 0x71]
shl rdi, 6
add rdi, rax
mov byte [rbp + rax - 0x55], 0x80
mov rax, qword [rbp - 0x79]
shl rdi, 3
inc rax
mov r9, rax
jmp 0x18001fcc2
mov byte [rbp + rax - 0x55], bl
mov rax, qword [rbp - 0x79]
inc rax
mov qword [rbp - 0x79], rax
cmp rax, 0x40
jb 0x18001fcb7
mov rdx, rbx
movzx eax, byte [rbp + rdx - 0x54]
movzx ecx, byte [rbp + rdx - 0x55]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + rdx - 0x53]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + rdx - 0x52]
shl ecx, 8
or ecx, eax
mov dword [rbp + rdx + 0x17], ecx
add rdx, 4
cmp rdx, 0x40
jb 0x18001fccf
cmp r9, 0x38
jbe 0x18001fd22
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x69]
call fcn.18001e390
xor edx, edx
lea rcx, [rbp + 0x17]
lea r8d, [rdx + 0x38]
call fcn.1800a8ae0
mov dword [rbp + 0x53], edi
lea rdx, [rbp + 0x17]
shr rdi, 0x20
lea rcx, [rbp - 0x69]
mov dword [rbp + 0x4f], edi
call fcn.18001e390
mov al, byte [rbp + rbx - 0x69]
mov byte [rbp + rbx - 6], al
mov al, byte [rbp + rbx - 0x68]
mov byte [rbp + rbx - 7], al
mov al, byte [rbp + rbx - 0x67]
mov byte [rbp + rbx - 8], al
mov al, byte [rbp + rbx - 0x66]
mov byte [rbp + rbx - 9], al
add rbx, 4
cmp rbx, 0x14
jb 0x18001fd39
mov edx, 0x1c
mov rcx, rsi
call fcn.18002b12c
lea rcx, [rsi + 8]
mov r8d, 0x14
lea rdx, [rbp - 9]
call fcn.18001e274
mov rdx, rax
mov rcx, rsi
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
jmp fcn.18002b12c

Function at 0x1800258ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov r9, qword [rcx + 8]
mov r10d, 4
mov eax, dword [rdx]
mov r8, qword [rcx]
mov dword [rsp + 8], eax
cmp r9, r10
jb 0x1800258fb
mov r11, r9
lea rcx, [rsp + 8]
shr r11, 2
sub rcx, r8
imul rax, r11, 0xfffffffffffffffc
add r9, rax
mov rbx, r10
mov al, byte [rcx + r8]
xor byte [r8], al
inc r8
sub rbx, 1
jne 0x1800258e2
sub rcx, r10
sub r11, 1
jne 0x1800258df
test r9, r9
je 0x18002593a
lea rcx, [rsp + 8]
mov r11, r9
sub rcx, r8
mov al, byte [r8 + rcx]
xor byte [r8], al
inc r8
sub r11, 1
jne 0x18002590b
mov eax, dword [rdx]
sub r9, rdx
mov dword [rsp + 8], eax
lea rax, [r9 + rdx]
and eax, 3
mov al, byte [rsp + rax + 8]
mov byte [rdx], al
inc rdx
sub r10, 1
jne 0x180025924
mov rbx, qword [rsp + 0x10]
ret
Function at 0x1800284d0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov bl, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x180149a38], eax
inc eax
cmp eax, 1
jne 0x18002850a
lea ecx, [rax + 1]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x180149a3c], eax
test bl, bl
je 0x180028541
xor ebx, ebx
lock xadd dword [0x180149a3c], ebx
test ebx, ebx
je 0x180028541
call fcn.180015750
mov r8, rax
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180016218
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
call fcn.180016efc
mov rax, rdi
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
Function at 0x18003e110
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
cmp qword [rcx + 0x10], 0
je 0x18003e133
and qword [rcx + 0x10], 0
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x18003e18f
mov ecx, dword [0x180149b34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
test rax, rax
je 0x18003e154
mov rcx, qword [rax + 8]
jmp 0x18003e156
xor ecx, ecx
test rcx, rcx
je 0x18003e181
xor edx, edx
xor eax, eax
cmp qword [rcx + rax*8], 0
je 0x18003e173
inc edx
inc rax
cmp rax, 2
jl 0x18003e15f
jmp 0x18003e181
mov al, byte [rdi + 0x50]
mov byte [rdi], al
movsxd rax, edx
mov qword [rcx + rax*8], rdi
jmp 0x18003e18a
mov rcx, rdi
call fcn.180059b58
nop
and qword [rbx + 8], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18003e28c
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x18003e2c7
mov qword [rsp + 0x40], rax
mov r8, qword [rax + 0x38]
test r8, r8
je 0x18003e2c2
xor edx, edx
mov rcx, r8
call qword [r8]
and qword [rbx + 0x10], 0
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x18003e321
mov ecx, dword [0x180149b34]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18003e2e7
mov rcx, qword [rax + 8]
jmp 0x18003e2e9
xor ecx, ecx
test rcx, rcx
je 0x18003e314
xor edx, edx
xor eax, eax
cmp qword [rcx + rax*8], 0
je 0x18003e306
inc edx
inc rax
cmp rax, 2
jl 0x18003e2f2
jmp 0x18003e314
mov al, byte [rdi + 0x48]
mov byte [rdi], al
movsxd rax, edx
mov qword [rcx + rax*8], rdi
jmp 0x18003e31c
mov rcx, rdi
call fcn.180059b58
and qword [rbx + 8], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret