joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a330
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.180019bf0
test al, al
je 0x18001a5ab
lea rcx, [0x1801494a0]
call fcn.180049120
test al, al
jne 0x18001a3ee
lea rcx, [0x180149440]
call fcn.180049120
test al, al
je 0x18001a395
call fcn.180048d90
test al, al
sete al
jmp 0x18001a3e2
lea rcx, [0x180149560]
call fcn.180049120
test al, al
je 0x18001a3b1
call fcn.180048de0
test al, al
sete al
jmp 0x18001a3e2
lea rcx, [0x180149500]
call fcn.180049120
test al, al
je 0x18001a5ab
lea rcx, [rsp + 0x90]
call fcn.180002db0
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x18001a3ee
call fcn.180048d90
mov byte [rsp + 0x20], al
test al, al
je 0x18001a5ab
lea rcx, [0x180149440]
call fcn.180049120
test al, al
je 0x18001a409
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.18001a5f0
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x18001a455
mov r8d, ebx
jmp 0x18001a46a
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x18001a460
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180003b30
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180063c50
nop
cmp qword [rsp + 0x48], 8
jb 0x18001a49d
mov rcx, qword [rsp + 0x30]
call fcn.18007d480
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180002fb0
nop
call fcn.180038450
mov dl, 1
mov ecx, 0x2718
call fcn.18001bb30
lea rcx, [0x180149440]
call fcn.180049120
test al, al
je 0x18001a4fd
xor edx, edx
lea rcx, [0x18004a8d0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x18004a8d0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18001a514
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x18001a51c
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180039530
nop
cmp qword [rsp + 0xc8], 8
jb 0x18001a543
mov rcx, qword [rsp + 0xb0]
call fcn.18007d480
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18001a5ab
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x18001a5ab
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001a5ab
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.180053b80
mov rcx, qword [0x180149398]
test rcx, rcx
je 0x18001a5c5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18009b480
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x18001af50
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, rcx
cmp edx, 1
jne 0x18001b13b
xor esi, esi
mov ebx, esi
lea rdi, [0x180149440]
mov dword [rsp + 0x30], ebx
cmp ebx, 4
jge 0x18001afb7
movsxd rax, ebx
lea rcx, [rax + rax*2]
shl rcx, 5
add rcx, rdi
call fcn.180049120
test al, al
jne 0x18001afc7
inc ebx
jmp 0x18001af93
call fcn.1800494e0
test al, al
jne 0x18001afc7
xor eax, eax
jmp 0x18001b140
call fcn.1800494e0
test al, al
je 0x18001afda
mov eax, 1
jmp 0x18001b140
mov qword [0x180149398], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x180149390], eax
mov rcx, r14
call fcn.18001ad70
call fcn.18001b170
or rdi, 0xffffffffffffffff
cmp word [rax], 0
jne 0x18001b009
mov r8, rsi
jmp 0x18001b01b
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18001b010
mov rdx, rax
lea rcx, [0x18013c318]
call fcn.180003b30
mov rcx, r14
call fcn.18004aa80
nop
lea rcx, [0x1801494a0]
call fcn.180049120
test al, al
je 0x18001b048
call fcn.180038450
lea rcx, [0x180149560]
call fcn.180049120
test al, al
je 0x18001b0a5
call fcn.180048de0
test al, al
je 0x18001b068
xor eax, eax
jmp 0x18001b140
call fcn.180038450
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18001a7a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call fcn.18004ae60
mov eax, 1
jmp 0x18001b140
mov dword [rsp + 0x40], esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x18001a7a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180065920
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18001b0f2
mov rsi, qword [rax]
mov rcx, rsi
call fcn.18004ae60
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x18001b13b
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x18001b13b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x18001b13b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x18001b13b
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009b480
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180038b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x5f47
lea r8, [0x18014b258]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x5f345f10
mov dword [rsp + 0x24], 0x5f185f75
mov dword [rsp + 0x28], 0x5f755f74
mov dword [rsp + 0x2c], 0x5f235f69
mov dword [rsp + 0x30], 0x5f2b5f2b
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048340
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x130
pop rbp
ret

Function at 0x180038d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x2f41
lea r8, [0x18014b280]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x2f322f16
mov dword [rsp + 0x24], 0x2f1e2f73
mov dword [rsp + 0x28], 0x2f732f72
mov dword [rsp + 0x2c], 0x2f252f6f
mov dword [rsp + 0x30], 0x2f2d2f2d
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.180048340
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x130
pop rbp
ret
Function at 0x180048aa0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edi, ecx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [rsp + 0x6c], eax
lea rcx, [r11 - 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x40], bx
jne 0x180048b01
xor al, al
jmp 0x180048b7c
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, edi
call fcn.1800483b0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180065920
nop
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180048b34
mov rbx, qword [rax]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x28], 0
sete sil
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x180048b78
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x180048b78
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x180048b78
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18009b480
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18004be40
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
call fcn.1800a4560
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jne 0x18004bea6
cmp dword [rsp + 0x28], 2
jb 0x18004bea6
mov al, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x158
ret
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x158
ret
Function at 0x18004cb70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004cbb3
xor eax, eax
jmp 0x18004cdb6
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18004cbed
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18004cbed
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
mov eax, esi
jmp 0x18004cdb6
cmp qword [rbx + 0x90], 0
jne 0x18004cbff
or eax, 0xffffffff
jmp 0x18004cdb6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x80]
cmp qword [r8], rax
jne 0x18004cc29
mov rdx, qword [rbx + 0x70]
mov rcx, qword [rbx + 0x68]
mov qword [r8], rcx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp qword [rbx + 0x78], 0
jne 0x18004cc4d
movsx ecx, sil
mov rdx, qword [rbx + 0x90]
call fcn.18009cffc
or ebx, 0xffffffff
cmp eax, ebx
cmovne ebx, esi
jmp 0x18004cdb4
mov byte [rbp - 1], sil
xor r15d, r15d
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], r15b
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp + 7]
call fcn.180018630
nop
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
nop word [rax + rax]
lea rdx, [rbp + 7]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp + 7]
cmovae r8, r10
mov rcx, qword [rbx + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 1]
lea rdx, [rbx + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x18004cd91
cmp eax, 1
jg 0x18004cd72
lea rax, [rbp + 7]
mov r10, qword [rbp + 7]
mov r9, qword [rbp + 0x1f]
cmp r9, 0x10
cmovae rax, r10
mov rdi, qword [rbp - 9]
sub rdi, rax
je 0x18004cd39
lea rcx, [rbp + 7]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rbx + 0x90]
mov r8, rdi
mov edx, 1
call fcn.18009d914
cmp rdi, rax
jne 0x18004cd91
mov r9, qword [rbp + 0x1f]
mov r10, qword [rbp + 7]
mov byte [rbx + 0x81], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x18004cd6e
test rdi, rdi
jne 0x18004cc90
cmp qword [rbp + 0x17], 0x20
jae 0x18004cd91
xor r8d, r8d
lea edx, [rdi + 8]
lea rcx, [rbp + 7]
call fcn.18000a000
jmp 0x18004cc7d
mov ebx, esi
jmp 0x18004cd94
cmp eax, 3
jne 0x18004cd91
movsx ecx, byte [rbp - 1]
mov rdx, qword [rbx + 0x90]
call fcn.18009cffc
or ebx, 0xffffffff
cmp eax, ebx
cmovne ebx, esi
jmp 0x18004cd94
or ebx, 0xffffffff
cmp qword [rbp + 0x1f], 0x10
jb 0x18004cda4
mov rcx, qword [rbp + 7]
call fcn.18007d480
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r15
mov byte [rbp + 7], 0
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18009b480
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004daa0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x18004dc17
cmp byte [rcx + 0x81], 0
je 0x18004dc17
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x18004dafc
xor al, al
jmp 0x18004dc19
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.180018630
nop
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
lea rdx, [rbp - 0x30]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x30]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x18004db70
dec eax
jne 0x18004dbe7
jmp 0x18004db77
mov byte [rdi + 0x81], 0
lea rax, [rbp - 0x30]
mov r10, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x18004dbc1
lea rcx, [rbp - 0x30]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rbx
mov edx, 1
call fcn.18009d914
cmp rbx, rax
jne 0x18004dbec
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x30]
cmp byte [rdi + 0x81], 0
je 0x18004dbf0
test rbx, rbx
jne 0x18004db30
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.18000a000
jmp 0x18004db28
sub eax, 2
je 0x18004dbf0
xor bl, bl
jmp 0x18004dbf2
mov bl, 1
cmp qword [rbp - 0x18], 0x10
jb 0x18004dc02
mov rcx, qword [rbp - 0x30]
call fcn.18007d480
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
movzx eax, bl
jmp 0x18004dc19
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18009b480
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180053a60
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], 0
call fcn.180053970
mov dword [rsp + 0x68], 0
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1800538d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
mov rcx, rdi
call fcn.180065920
mov dword [rsp + 0x30], 1
mov rax, qword [rdi]
test rax, rax
je 0x180053b26
cmp qword [rax], 0
je 0x180053b26
lea rbx, [0x180149778]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, rdi
call fcn.180053d90
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rdi
jmp 0x180053b53
lea rax, str.wtf__cannot_create_the_thread
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.18009bd78
lea rdx, [0x180137390]
lea rcx, [rsp + 0x50]
call fcn.1800a1948
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18009b480
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x180053b80
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.180053970
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.1800539f0
nop
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x50], rdi
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rbx
cmp rbx, rdi
je 0x180053c06
mov rcx, qword [rbx]
test rcx, rcx
je 0x180053bed
mov rcx, qword [rcx]
mov edx, 0x29a
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rbx, 0x10
cmp rbx, rdi
jne 0x180053be2
mov qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x180053c73
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
je 0x180053c59
nop
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x180053c46
lock dec dword [rbx + 8]
jne 0x180053c46
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock dec dword [rbx + 0xc]
jne 0x180053c46
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
add rdi, 0x10
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jne 0x180053c20
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.18007d480
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009b480
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180066c00
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rbp], rax
mov rdi, r8
mov rbx, rdx
xor esi, esi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x40], 0x6a09e667
mov dword [rbp - 0x3c], 0xbb67ae85
mov dword [rbp - 0x38], 0x3c6ef372
mov dword [rbp - 0x34], 0xa54ff53a
mov dword [rbp - 0x30], 0x510e527f
mov dword [rbp - 0x2c], 0x9b05688c
mov dword [rbp - 0x28], 0x1f83d9ab
mov dword [rbp - 0x24], 0x5be0cd19
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x180066c82
mov rcx, qword [rcx]
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.180088e70
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.180088f50
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], sil
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x28], eax
movzx eax, word [rbp - 0x1c]
mov word [rsp + 0x2c], ax
mov qword [rsp + 0x38], 6
lea rax, [rsp + 0x28]
cmp r14, 0x10
cmovae rax, qword [rsp + 0x28]
mov byte [rax + 6], sil
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
mov eax, dword [rbp - 0x1a]
mov dword [rsp + 0x48], eax
movzx eax, word [rbp - 0x16]
mov word [rsp + 0x4c], ax
mov qword [rsp + 0x58], 6
lea rax, [rsp + 0x48]
cmovae rax, qword [rsp + 0x48]
mov byte [rax + 6], 0
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180066b40
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180066b40
nop
cmp qword [rsp + 0x60], 0x10
jb 0x180066d56
mov rcx, qword [rsp + 0x48]
call fcn.18007d480
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
cmp qword [rsp + 0x40], 0x10
jb 0x180066d77
mov rcx, qword [rsp + 0x28]
call fcn.18007d480
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], 0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180072ad0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180072b22
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.1800bee30
test ebx, ebx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
jne 0x180072b37
mov eax, edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x40
pop rdi
ret
lea rdx, [0x1800ef7b0]
lea rcx, [rsp + 0x20]
call fcn.1800728e0
int3

Function at 0x180072e00
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
xor r8d, r8d
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x18014a6cc], eax
test eax, eax
je 0x180072e77
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rbx + 8]
lea rcx, [fcn.180003d30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009b480
add rsp, 0x40
pop rbx
ret