joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e2a0
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 1
mov r8, rcx
cmp dword [rcx + 0x1c], r10d
jbe 0x18000e3b1
lea r9, [rcx + 0x32]
lea r11, [0x180000000]
nop
movzx edx, byte [r9 + 1]
movzx eax, byte [r9 - 1]
inc r10d
mov ecx, dword [r11 + rdx*4 + 0x23d600]
add r9, 0x10
xor ecx, dword [r11 + rax*4 + 0x23ce00]
movzx eax, byte [r9 - 0x10]
xor ecx, dword [r11 + rax*4 + 0x23d200]
movzx eax, byte [r9 - 0x12]
xor ecx, dword [r11 + rax*4 + 0x23ca00]
mov dword [r9 - 0x12], ecx
movzx ecx, byte [r9 - 0xb]
movzx eax, byte [r9 - 0xc]
mov edx, dword [r11 + rcx*4 + 0x23d600]
xor edx, dword [r11 + rax*4 + 0x23d200]
movzx eax, byte [r9 - 0xd]
xor edx, dword [r11 + rax*4 + 0x23ce00]
movzx eax, byte [r9 - 0xe]
xor edx, dword [r11 + rax*4 + 0x23ca00]
mov dword [r9 - 0xe], edx
movzx ecx, byte [r9 - 7]
movzx eax, byte [r9 - 8]
mov edx, dword [r11 + rcx*4 + 0x23d600]
xor edx, dword [r11 + rax*4 + 0x23d200]
movzx eax, byte [r9 - 9]
xor edx, dword [r11 + rax*4 + 0x23ce00]
movzx eax, byte [r9 - 0xa]
xor edx, dword [r11 + rax*4 + 0x23ca00]
mov dword [r9 - 0xa], edx
movzx eax, byte [r9 - 4]
movzx ecx, byte [r9 - 3]
mov edx, dword [r11 + rcx*4 + 0x23d600]
xor edx, dword [r11 + rax*4 + 0x23d200]
movzx eax, byte [r9 - 5]
xor edx, dword [r11 + rax*4 + 0x23ce00]
movzx eax, byte [r9 - 6]
xor edx, dword [r11 + rax*4 + 0x23ca00]
mov dword [r9 - 6], edx
cmp r10d, dword [r8 + 0x1c]
jb 0x18000e2c0
repz ret
Function at 0x180016890
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
movzx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x1800168c3
lea r10, [0x18020d070]
movzx edx, cl
lea ecx, [rax*8]
inc r9
movzx r8d, byte [rdx + r10]
xor r8d, ecx
movzx ecx, byte [r9]
xor eax, r8d
test cl, cl
jne 0x1800168a3
repz ret

Function at 0x180016940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, edx
mov edi, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova edi, ecx
cmp edi, dword [rbx]
jne 0x180016974
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180242810]
test rax, rax
je 0x180016982
call rax
mov ecx, edi
shl rcx, 4
call fcn.180011e00
mov rcx, qword [0x180242818]
mov rdi, rax
test rcx, rcx
je 0x18001699e
call rcx
test rdi, rdi
je 0x180016967
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.180012120
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x180238780]
xor edx, edx
mov rcx, rdi
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rbx], esi
shl r8, 4
call fcn.180189610
mov r8, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test r8, r8
je 0x180016ab2
mov qword [rsp + 0x30], rbp
lea rbp, [0x18020d070]
nop dword [rax + rax]
mov r9, qword [r8 + 0x18]
mov eax, r11d
movzx ecx, byte [r9]
test cl, cl
je 0x180016a2d
nop
movzx ecx, cl
inc r9
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [r9]
xor eax, edx
test cl, cl
jne 0x180016a10
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rdi
je 0x180016a85
mov eax, dword [r9]
test eax, eax
je 0x180016a4d
mov rcx, qword [r9 + 8]
jmp 0x180016a50
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x180016a85
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x180016a7b
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x180016aa1
mov qword [rbx + 8], r8
mov qword [rcx + 8], r8
jmp 0x180016aa1
mov rax, qword [rbx + 8]
mov qword [r8], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x180016a99
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rbx + 8], r8
mov r8, r10
test r10, r10
jne 0x180016a00
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180016ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, r8
mov r8, qword [rcx + 0x10]
xor r9d, r9d
mov rdi, rdx
mov r11, rcx
lea rsi, [0x18020d070]
test r8, r8
je 0x180016b3f
movzx eax, byte [rdx]
mov r10, rdx
test al, al
je 0x180016b24
movzx eax, al
inc r10
movzx ecx, byte [rax + rsi]
lea eax, [r9*8]
xor ecx, eax
movzx eax, byte [r10]
xor r9d, ecx
test al, al
jne 0x180016b05
mov eax, r9d
xor edx, edx
div dword [r11]
mov eax, edx
mov r9d, edx
add rax, rax
mov r10, qword [r8 + rax*8 + 8]
mov r11d, dword [r8 + rax*8]
jmp 0x180016b47
mov r10, qword [rcx + 8]
mov r11d, dword [rcx + 4]
mov dword [rbx], r9d
test r11d, r11d
je 0x180016bac
movzx eax, byte [rdi]
movzx ebx, byte [rax + rsi]
nop word [rax + rax]
mov r8, qword [r10 + 0x18]
dec r11d
movzx edx, byte [r8]
movzx eax, byte [rdx + rsi]
sub eax, ebx
jne 0x180016ba4
mov r9, rdi
sub r9, r8
nop dword [rax]
test dl, dl
je 0x180016ba0
movzx eax, byte [r9 + r8 + 1]
movzx edx, byte [r8 + 1]
inc r8
movzx ecx, byte [rax + rsi]
movzx eax, byte [rdx + rsi]
sub eax, ecx
je 0x180016b80
jmp 0x180016ba4
test eax, eax
je 0x180016bbe
mov r10, qword [r10]
test r11d, r11d
jne 0x180016b60
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rax, r10
ret
Function at 0x180047d70
Capabilities:
Create thread

Disassembly:
mov rax, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x180047d9c
cmp dword [rcx + 0x20], 0
je 0x180047d94
mov rcx, qword [rcx]
lea rdx, [0x180047d40]
mov r8, rax
jmp fcn.180014a40
mov rcx, rax
jmp fcn.180047c30
xor eax, eax
ret

Function at 0x1800489d0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, qword [rcx + 0x18]
mov r12, qword [rcx + 0x28]
xor ebx, ebx
mov rdi, qword [rsi + 0x30]
mov r13, r9
mov ebp, r8d
mov r14, rdx
test rdi, rdi
jne 0x180048a73
movzx eax, word [r12 + 6]
imul eax, eax, 0x38
add eax, 0x50
test eax, eax
jle 0x180048a43
mov rcx, qword [r12 + 0x10]
movsxd rdx, eax
test rcx, rcx
je 0x180048a2e
call fcn.180012520
jmp 0x180048a36
mov rcx, rdx
call fcn.180011e00
mov rdi, rax
test rax, rax
jne 0x180048a46
mov rdi, rbx
jmp 0x180048a5e
mov rdi, rbx
lea rax, [rdi + 0x18]
mov qword [rdi], r12
mov qword [rdi + 8], rax
movzx eax, word [r12 + 6]
inc ax
mov word [rdi + 0x10], ax
mov qword [rsi + 0x30], rdi
test rdi, rdi
jne 0x180048a6f
lea eax, [rdi + 7]
jmp 0x180048af8
mov word [rdi + 0x10], bp
cmp byte [rsi + 0x58], bl
je 0x180048aab
cmp byte [rsi + 0x59], bl
je 0x180048a8a
mov rax, qword [rsi + 0x10]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x180048ab5
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rcx + rcx*4]
shl rax, 4
add rax, qword [rdx + 0x18]
mov edx, dword [rax + 0x14]
mov r8, qword [rax + 0x28]
jmp 0x180048ab5
mov rax, qword [rsi + 0x38]
mov edx, dword [rax]
lea r8, [rax + 0x10]
mov r9, rdi
mov rcx, r12
call fcn.180039730
test ebp, ebp
jle 0x180048adf
mov rax, qword [rdi + 8]
add rax, 8
nop dword [rax]
test byte [rax], 1
jne 0x180048b17
inc ebx
add rax, 0x38
cmp ebx, ebp
jl 0x180048ad0
mov rdx, qword [r14 + 0x10]
mov ecx, dword [r14 + 0xc]
xor r9d, r9d
mov r8, rdi
call fcn.180039da0
mov dword [r13], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
mov dword [r13], 0xffffffff
jmp 0x180048af6
Function at 0x180052cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180052e8f
test rdx, rdx
je 0x180052e8f
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov esi, dword [rdx + 4]
mov ebp, esi
or ebp, eax
bt ebp, 0xa
jae 0x180052d45
and esi, eax
bt esi, 0xa
jae 0x180052db5
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x180052db5
xor eax, eax
jmp 0x180052d7e
movzx eax, byte [rcx]
cmp al, byte [rdx]
je 0x180052d93
cmp al, 0x5f
jne 0x180052d63
mov rcx, qword [rcx + 0x10]
call fcn.180052cf0
cmp eax, 2
jl 0x180052d79
mov r8d, dword [rsp + 0x40]
cmp byte [rbx], 0x5f
jne 0x180052db5
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call fcn.180052cf0
cmp eax, 2
jge 0x180052db5
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
cmp al, 0x98
je 0x180052dfb
cmp al, 0x9a
je 0x180052dfb
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x180052dfb
cmp al, 0x97
jne 0x180052dbc
mov rdx, qword [rdx + 8]
call fcn.1800156d0
test eax, eax
je 0x180052df6
mov eax, 2
jmp 0x180052d7e
mov r9, qword [rdx + 8]
sub r9, rcx
nop word [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x180052de5
inc rcx
test edx, edx
jne 0x180052dd0
test r8d, r8d
je 0x180052df6
xor ecx, ecx
cmp al, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x180052d7e
mov r8d, dword [rsp + 0x40]
xor esi, dword [rdi + 4]
test sil, 0x10
jne 0x180052db5
bt ebp, 0xe
jb 0x180052e88
bt ebp, 0xb
jb 0x180052db5
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.180052cf0
test eax, eax
jne 0x180052db5
mov esi, dword [rsp + 0x40]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, esi
call fcn.180052cf0
test eax, eax
jne 0x180052db5
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, esi
call fcn.180052eb0
test eax, eax
jne 0x180052db5
bt ebp, 0xd
jb 0x180052e88
cmp byte [rdi], 0x61
je 0x180052e88
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x180052db5
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x180052e88
cmp ecx, esi
jne 0x180052db5
test eax, eax
jns 0x180052db5
xor eax, eax
jmp 0x180052d7e
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1800587c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x28]
xor r11d, r11d
xor ebx, ebx
mov rsi, r8
mov r13, rdx
mov r12, rcx
test ebp, ebp
jle 0x1800588b2
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
lea r14, [0x18020d070]
mov r10d, ebx
cmp ebx, 2
jge 0x180058802
xor r10d, 1
test rsi, rsi
je 0x18005885a
mov rax, qword [r12 + 0x20]
movzx edx, byte [rsi]
movsxd rcx, r10d
movzx r9d, byte [rdx + r14]
shl rcx, 5
mov r8, rsi
mov rdi, qword [rcx + rax]
movzx eax, byte [rdi]
movzx eax, byte [rax + r14]
sub r9d, eax
jne 0x18005888f
sub rdi, rsi
test dl, dl
je 0x180058855
movzx edx, byte [r8 + 1]
movzx eax, byte [rdi + r8 + 1]
inc r8
movzx ecx, byte [rax + r14]
movzx r9d, byte [rdx + r14]
sub r9d, ecx
je 0x180058832
jmp 0x18005888f
test r9d, r9d
jne 0x18005888f
mov rax, qword [r12 + 0x20]
movsxd rcx, r10d
lea r8, [rsp + 0x50]
shl rcx, 5
mov rdx, r13
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.180016ad0
test rax, rax
je 0x18005888c
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x180058899
jmp 0x18005888f
xor r11d, r11d
inc ebx
cmp ebx, ebp
jl 0x1800587f6
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov rax, r11
add rsp, 0x20
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
mov rax, r11
add rsp, 0x20
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret

Function at 0x180058a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x20
mov esi, dword [rcx + 0x28]
xor r9d, r9d
xor ebx, ebx
mov rdi, r8
mov r12, rdx
test esi, esi
jle 0x180058b41
mov qword [rsp + 0x48], rbp
mov rbp, qword [rcx + 0x20]
mov qword [rsp + 0x50], r13
lea r13, [0x18020d070]
mov eax, ebx
cmp ebx, 2
jge 0x180058aa2
xor eax, 1
movsxd rcx, eax
shl rcx, 5
mov r11, qword [rcx + rbp + 0x18]
test rdi, rdi
je 0x180058af8
mov r10, qword [rcx + rbp]
movzx edx, byte [rdi]
mov r8, rdi
movzx eax, byte [r10]
movzx ecx, byte [rax + r13]
movzx eax, byte [rdx + r13]
sub eax, ecx
jne 0x180058b1c
sub r10, rdi
test dl, dl
je 0x180058af4
movzx eax, byte [r10 + r8 + 1]
movzx edx, byte [r8 + 1]
inc r8
movzx ecx, byte [rax + r13]
movzx eax, byte [rdx + r13]
sub eax, ecx
je 0x180058ad2
jmp 0x180058b1c
test eax, eax
jne 0x180058b1c
lea rcx, [r11 + 0x20]
lea r8, [rsp + 0x40]
mov rdx, r12
call fcn.180016ad0
test rax, rax
je 0x180058b19
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x180058b26
jmp 0x180058b1c
xor r9d, r9d
inc ebx
cmp ebx, esi
jl 0x180058a98
mov rbp, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rax, r9
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
mov rax, r9
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x18005c860
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rcx]
movsxd r10, edx
mov qword [rsp + 0x38], r9
mov rdx, qword [rax + 0x20]
shl r10, 5
mov qword [rsp + 0x30], r8
mov rbp, qword [r10 + rdx]
mov r15, rcx
mov r14d, 1
nop word [rax + rax]
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x40]
mov r9d, r14d
mov ecx, 0x18
call fcn.180014660
mov r12, qword [r15]
xor ebx, ebx
mov r13d, dword [r12 + 0x28]
xor edi, edi
test r13d, r13d
jle 0x18005ca9e
movzx esi, byte [rsp + 0x40]
mov r10d, edi
cmp edi, 2
jge 0x18005c8ef
xor r10d, 1
test rbp, rbp
je 0x18005c96c
mov rax, qword [r12 + 0x20]
movzx edx, byte [rbp]
movsxd rcx, r10d
shl rcx, 5
mov r8, rbp
mov r11, qword [rcx + rax]
lea rcx, [0x18020d070]
movzx eax, byte [r11]
movzx r9d, byte [rdx + rcx]
movzx eax, byte [rax + rcx]
sub r9d, eax
jne 0x18005ca63
sub r11, rbp
jmp 0x18005c937
lea rcx, [0x18020d070]
test dl, dl
je 0x18005c963
movzx eax, byte [r11 + r8 + 1]
movzx edx, byte [r8 + 1]
inc r8
movzx ecx, byte [rax + rcx]
lea rax, [0x18020d070]
movzx r9d, byte [rdx + rax]
sub r9d, ecx
je 0x18005c930
jmp 0x18005ca63
test r9d, r9d
jne 0x18005ca63
mov rax, qword [r12 + 0x20]
movsxd rcx, r10d
shl rcx, 5
mov r9, qword [rcx + rax + 0x18]
mov r10, qword [r9 + 0x18]
test r10, r10
je 0x18005c9db
xor eax, eax
lea r8, [rsp + 0x40]
movzx ecx, sil
test sil, sil
je 0x18005c9c3
lea r13, [0x18020d070]
nop dword [rax]
movzx ecx, cl
inc r8
movzx edx, byte [rcx + r13]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x18005c9a0
mov r13d, dword [r12 + 0x28]
xor edx, edx
div dword [r9 + 8]
mov ecx, edx
shl rcx, 4
add rcx, r10
mov r10, qword [rcx + 8]
mov r11d, dword [rcx]
jmp 0x18005c9e3
mov r10, qword [r9 + 0x10]
mov r11d, dword [r9 + 0xc]
test r11d, r11d
je 0x18005ca61
lea rcx, [0x18020d070]
movzx eax, sil
movzx ebx, byte [rax + rcx]
nop word [rax + rax]
mov r8, qword [r10 + 0x18]
dec r11d
movzx edx, byte [r8]
movzx eax, byte [rdx + rcx]
sub eax, ebx
jne 0x18005ca59
lea r9, [rsp + 0x40]
sub r9, r8
nop dword [rax + rax]
test dl, dl
je 0x18005ca55
movzx eax, byte [r9 + r8 + 1]
movzx edx, byte [r8 + 1]
inc r8
movzx ecx, byte [rax + rcx]
lea rax, [0x18020d070]
movzx eax, byte [rdx + rax]
sub eax, ecx
lea rcx, [0x18020d070]
je 0x18005ca20
lea rcx, [0x18020d070]
jmp 0x18005ca59
test eax, eax
je 0x18005cac9
mov r10, qword [r10]
test r11d, r11d
jne 0x18005ca00
xor ebx, ebx
inc edi
cmp edi, r13d
jl 0x18005c8e3
test rbx, rbx
je 0x18005ca9e
mov rax, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
mov r8, rbp
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.1800586e0
inc r14d
cmp r14d, 4
jle 0x18005c8b0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbx, qword [r10 + 0x10]
test rbx, rbx
jne 0x18005ca73
jmp 0x18005ca63
Function at 0x1800a4530
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x90], rax
inc ecx
xor r9d, r9d
mov rbx, rdx
mov r8d, r9d
nop word [rax + rax]
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x7fffff07
sub ecx, edx
jns 0x1800a4587
add ecx, 0x7fffff07
mov eax, ecx
mov byte [rsp + r8*4 + 0x80], cl
inc r8
sar eax, 8
mov byte [rsp + r8*4 + 0x7d], al
mov eax, ecx
sar eax, 0x10
mov byte [rsp + r8*4 + 0x7e], al
mov eax, ecx
sar eax, 0x18
mov byte [rsp + r8*4 + 0x7f], al
cmp r8, 4
jl 0x1800a4560
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov qword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x34], r9d
call fcn.1800a3bd0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800a39f0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180183a50
add rsp, 0xa0
pop rbx
ret

Function at 0x1800a4620
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x1f]
sub rsp, 0xc0
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rax, qword [r9]
mov r12, qword [rbp + 0x6f]
mov r13, qword [rbp + 0x7f]
mov qword [rbp - 0x21], rax
mov rax, qword [r9 + 8]
xor edi, edi
mov qword [rbp - 0x19], rax
test r8d, r8d
mov eax, edx
sete dil
sar eax, 8
mov ebx, edx
mov byte [rbp - 0x10], al
mov eax, edx
mov rsi, rcx
sar eax, 0x10
mov byte [rbp - 0x11], dl
mov r14d, r8d
mov byte [rbp - 0xf], al
mov eax, edx
lea rcx, [rsp + 0x20]
sar eax, 0x18
lea rdx, [rbp - 0x21]
mov r8d, 0x18
mov dword [rbp - 0xd], 0x546c4173
mov dword [rsp + 0x20], 0x67452301
mov dword [rbp - 0x7d], 0xefcdab89
mov byte [rbp - 0xe], al
mov dword [rbp - 0x79], 0x98badcfe
mov qword [rbp - 0x75], 0x10325476
mov dword [rbp - 0x6d], 0
call fcn.1800a3bd0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x21]
call fcn.1800a39f0
lea rdx, [rbp - 9]
mov ecx, ebx
call fcn.1800a4530
mov rbx, qword [rsi + 0x30]
mov dword [rbx], 1
mov dword [rbx + 4], 1
test edi, edi
je 0x1800a4702
cmp edi, 1
jne 0x1800a4775
lea rcx, [rbp - 9]
mov dword [rbx + 8], edi
xor r8d, r8d
mov rax, qword [rcx]
lea r9, [rbp - 0x21]
lea r10d, [r8 + 0x10]
mov qword [rbx + 0xc], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0x14], rax
mov dword [rbx + 0x1c], 0xa
nop word [rax + rax]
mov rax, r8
mov rdx, r8
inc r9
and eax, 3
shr rdx, 2
inc r8
dec r10
lea rcx, [rbp + rax - 9]
movzx eax, byte [r9 - 1]
mov byte [rcx + rdx*4], al
jne 0x1800a4730
lea rdx, [rbp - 9]
mov rcx, rbx
call fcn.18000e060
cmp dword [rbx + 8], 1
jne 0x1800a476f
mov rcx, rbx
call fcn.18000e2a0
mov dword [rbx], 0
mov r8d, dword [rbp + 0x77]
mov rcx, qword [rsi + 0x30]
mov r9, r13
shl r8d, 3
mov rdx, r12
test r14d, r14d
je 0x1800a4793
call fcn.18000d6d0
jmp 0x1800a4798
call fcn.18000db70
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180183a50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x1800a5570
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
call fcn.1800a5610
lea r11, vtable.CTcpSocket.0
lea rcx, [rbx + 0x130]
mov qword [rbx], r11
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x378], 0xffffffffffffffff
mov qword [rbx + 0x148], rax
xor eax, eax
mov dword [rbx + 0x150], eax
mov qword [rbx + 0x368], rax
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x1d0
pop rbx
ret

Function at 0x1800a57a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x378]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x80
xor ebx, ebx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x378]
call qword [sym.imp.KERNEL32.dll_CancelIo]
xchg dword [rdi + 0x150], ebx
mov rcx, qword [rdi + 0x378]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rdi + 0x148]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x48]
mov qword [rdi + 0x378], 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
Function at 0x1800a5e50
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
xor edi, edi
mov r14d, r8d
mov rsi, rdx
mov r13, rcx
mov ebp, r8d
mov r12d, edi
cmp r8d, 0x40000
jl 0x1800a5ee1
nop dword [rax + rax]
mov ebx, edi
nop word [rax + rax]
mov rcx, qword [r13 + 0x378]
xor r9d, r9d
mov r8d, 0x40000
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1800a5ec4
inc ebx
cmp ebx, 0xf
jl 0x1800a5ea0
cmp ebx, 0xf
je 0x1800a5f42
sub ebp, 0x40000
add r12d, eax
add rsi, 0x40000
cmp ebp, 0x40000
jge 0x1800a5e90
test ebp, ebp
jle 0x1800a5f19
nop word [rax + rax]
mov rcx, qword [r13 + 0x378]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1800a5f11
inc edi
cmp edi, 0xf
jl 0x1800a5ef0
cmp edi, 0xf
je 0x1800a5f42
add r12d, eax
or eax, 0xffffffff
cmp r12d, r14d
cmove eax, r12d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
or eax, 0xffffffff
jmp 0x1800a5f23
Function at 0x1800a63a0
Capabilities:
Check for time delay via queryperformancecounter
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx + 0x148]
mov rdi, r9
mov ebp, r8d
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsi + 0x388]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r14d, r14d
lea rcx, [rsi + 0x138]
mov eax, r14d
xchg dword [rsi + 0x150], eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsi + 0x160]
mov r8, rdi
mov edx, 0xff
call fcn.1801887c4
lea rcx, [rsi + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rsi + 0x160]
lea rcx, [rsi + 0x160]
lea eax, [rax + rax + 2]
movsxd r8, eax
mov dword [rsi + 0x360], eax
call fcn.180183a80
movsxd r11, dword [rsi + 0x360]
lea eax, [r11 + 4]
mov rcx, r11
mov dword [rsi + 0x364], eax
call fcn.180184398
mov qword [rsi + 0x380], rax
test rax, rax
je 0x1800a64b5
mov rcx, qword [rsi + 0x378]
mov edi, 1
movzx r8d, bp
mov rax, qword [rcx + 8]
add rcx, 8
mov rdx, r12
mov r9d, edi
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
call qword [rax]
mov rcx, qword [rsi + 0x388]
mov edx, 0x1770
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1800a64bc
cmp eax, 0x102
je 0x1800a64a8
cmp eax, 0xffffffff
jne 0x1800a64b5
mov rcx, qword [rsi + 0x388]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor al, al
jmp 0x1800a653f
lea rcx, [rsi + 0x140]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi + 0x140]
sub rax, qword [rsi + 0x138]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm0, qword [rsi + 0x130]
cvtsi2sd xmm1, rax
divsd xmm0, qword [0x1802172b0]
divsd xmm1, xmm0
movsd qword [rsi + 0x128], xmm1
xchg dword [rsi + 0x150], edi
mov rcx, qword [rsi + 0x388]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea r11, [rsp + 0x60]
lea r8, [0x1800a6560]
mov qword [rsp + 0x28], r11
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call fcn.18018858c
mov qword [rsi + 0x390], rax
mov al, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret