joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18018bbd0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd4]
je 0x18016a39a
mov dword [rcx + 0xd4], edx
test edx, edx
je 0x18016a39a
mov rdx, r8
jmp fcn.180167110
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
mov esi, edx
mov rbx, rcx
jne 0x18018bc08
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x18018bc38
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x18018bc52
xor ecx, ecx
call fcn.18000d700
cmp dword [rbx + 0xee8], 2
jne 0x18018bc5f
lea rcx, [rbx + 0x220]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801cbd90
cmp dword [rcx + 0xee8], 2
jne 0x18018bc0f
add rcx, 0x220
call fcn.1801cbca0
test rax, rax
je 0x18018bc0f
mov rcx, rax
call fcn.1801cde90
mov rcx, rax
jmp 0x18018bc66
lea rcx, [rbx + 0xb50]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x18016a380
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x18]
mov rbx, r8
mov rcx, rdi
mov esi, edx
call fcn.1801c9d60
test rax, rax
jne 0x1801cbdd5
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.No_socket_connection.]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x28]
mov r8, rbx
mov edx, esi
mov rcx, rax
call 0x18016a380
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1801ca0c0

Function at 0x18018bc80
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd0]
je 0x18016a3ba
mov dword [rcx + 0xd0], edx
test edx, edx
je 0x18016a3ba
mov rdx, r8
jmp fcn.1801671c0
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
mov esi, edx
mov rbx, rcx
jne 0x18018bcb8
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x18018bce8
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x18018bd02
xor ecx, ecx
call fcn.18000d700
cmp dword [rbx + 0xee8], 2
jne 0x18018bd0f
lea rcx, [rbx + 0x220]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801cbe00
cmp dword [rcx + 0xee8], 2
jne 0x18018bcbf
add rcx, 0x220
call fcn.1801cbca0
test rax, rax
je 0x18018bcbf
mov rcx, rax
call fcn.1801cde90
mov rcx, rax
jmp 0x18018bd16
lea rcx, [rbx + 0xb50]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x18016a3a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x18]
mov rbx, r8
mov rcx, rdi
mov esi, edx
call fcn.1801c9d60
test rax, rax
jne 0x1801cbe45
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.No_socket_connection.]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x28]
mov r8, rbx
mov edx, esi
mov rcx, rax
call 0x18016a3a0
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1801ca0c0
Function at 0x18018c610
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r8, rdx
add rcx, 0xffffffffffffff78
mov dl, 1
jmp fcn.18018b7f0

Function at 0x18018c630
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov esi, r9d
mov rdi, qword [rsp + 0x88]
mov r15d, r8d
mov r12, rdx
mov byte [rbx], 0
cmp byte [rdi + 0x10], 0
jne 0x18018c685
mov rcx, qword [rsp + 0x90]
mov rdx, qword [str.Internal_error:_Socket_IO_params_not_valid.__Contact_support_chilkatsoft.com]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor al, al
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
lea rbp, [rcx - 0x88]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r14
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x88], rbp
test r9d, r9d
jne 0x18018c6fc
mov rax, qword [rcx + 0xe50]
mov r8, r14
mov rdx, rdi
test rax, rax
je 0x18018c6cc
mov rcx, rax
call fcn.1801cf940
jmp 0x18018c6ef
cmp dword [rcx + 0xe60], 2
jne 0x18018c6e3
add rcx, 0x198
call fcn.1801cbd70
jmp 0x18018c6ef
add rcx, 0xac8
call fcn.18016a1f0
test al, al
je 0x18018c7dc
mov esi, 0x7530
mov rcx, r12
call fcn.18001fd80
mov r9d, esi
mov qword [rsp + 0x28], r14
mov r8d, r15d
mov qword [rsp + 0x20], rdi
mov rdx, r12
mov rcx, rbp
mov r13d, eax
call fcn.18018c110
movzx r15d, al
test al, al
je 0x18018c7dc
mov rcx, r12
call fcn.18001fd80
cmp eax, r13d
jbe 0x18018c74d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov byte [rbx], al
mov al, 1
jmp 0x18018c7de
call sub.KERNEL32.dll_GetTickCount
mov ebp, eax
xor ebx, ebx
mov rcx, r12
call fcn.18001fd80
cmp eax, r13d
jne 0x18018c7af
cmp ebx, esi
jae 0x18018c7af
mov r8d, dword [rsp + 0x70]
mov r9d, esi
mov rcx, qword [rsp + 0x88]
mov rdx, r12
movzx ebx, byte [rdi + 0x34]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
call fcn.18018c110
movzx r15d, al
test bl, bl
je 0x18018c799
mov byte [rdi + 0x34], 1
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
cmp eax, ebp
jb 0x18018c7dc
sub ebx, ebp
cmp ebx, esi
jae 0x18018c7c8
test r15b, r15b
jne 0x18018c756
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x80]
mov byte [rcx], al
movzx eax, r15b
jmp 0x18018c7de
mov rax, qword [r14]
lea rdx, str.Timed_out......
mov rcx, r14
call qword [rax + 0x28]
mov byte [rdi + 0x28], 1
xor al, al
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18018e320
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x18018e334
mov rcx, rax
jmp 0x1801dcfb0
cmp dword [rcx + 0xee8], 2
jne 0x18018e349
add rcx, 0x220
jmp 0x1801cc5a0
add rcx, 0xb50
jmp fcn.18016c660
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
add rcx, 0x40
mov rbp, r8
mov r14d, edx
call fcn.18001fd80
test eax, eax
je 0x1801ca852
mov al, 1
jmp 0x1801ca8a6
mov qword [rsp + 0x30], rdi
mov rcx, rbx
xor dil, dil
call fcn.180041720
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1801ca87b
mov r9, rsi
mov r8, rbp
mov edx, r14d
call fcn.18016c660
jmp 0x1801ca892
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1801ca895
mov r9, rsi
mov r8, rbp
mov edx, r14d
call fcn.18018e320
movzx edi, al
mov rcx, rbx
call fcn.1800416a0
movzx eax, dil
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
add rcx, 0x18
jmp 0x1801ca820
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, r9
mov rsi, r8
mov edi, edx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.18004bc90
nop
lea rcx, [rbx + 0xbe0]
call fcn.1801c9e50
mov rcx, rax
mov r9, rbp
mov r8, rsi
mov edx, edi
call fcn.18016c660
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.18004bd60
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180009610
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801bedf0
Capabilities:
Get socket status

Disassembly:
mov byte [rsp + 0x20], r9b
push rbp
push rsi
push r14
sub rsp, 0x40
movzx r10d, r9b
mov esi, r8d
mov r14d, edx
mov rbp, rcx
cmp r8d, 0x32
jbe 0x1801bef5b
test edx, edx
je 0x1801bef5b
mov qword [rsp + 0x30], r15
mov r15, qword [rsp + 0x90]
mov dword [r15], 0xffffffff
cmp dword [rcx + 0x10], 0
jne 0x1801bee5b
mov rcx, qword [rsp + 0x88]
lea rdx, str.No_sockets_exists_for_fdSetSelect.
mov rax, qword [rcx]
call qword [rax + 0x28]
mov r15, qword [rsp + 0x30]
xor al, al
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x60], rbx
mov al, 1
mov qword [rsp + 0x68], rdi
xor edi, edi
mov qword [rsp + 0x70], r12
mov r12, qword [rsp + 0x98]
mov qword [rsp + 0x38], r13
mov r13, qword [rsp + 0x88]
mov ecx, 1
mov ebx, r14d
cmp esi, edi
jbe 0x1801bee9a
mov ebx, esi
sub ebx, edi
cmp ebx, r14d
cmova ebx, r14d
test al, al
je 0x1801beea6
shr ebx, 1
cmp ebx, 1
cmovb ebx, ecx
mov r9, r13
mov qword [rsp + 0x20], r15
movzx r8d, r10b
mov edx, ebx
mov rcx, rbp
call fcn.1801bef90
mov ecx, dword [r15]
cmp ecx, 0xffffffff
je 0x1801bef1b
test ecx, ecx
jg 0x1801bef1b
add edi, ebx
cmp edi, esi
jae 0x1801bef3d
test r12, r12
je 0x1801beee2
mov rdx, r13
mov rcx, r12
call fcn.180079000
test al, al
jne 0x1801beeec
movzx r10d, byte [rsp + 0x78]
xor al, al
jmp 0x1801bee83
mov rax, qword [r13]
lea rdx, str.socket_set_select_aborted_by_application_callback
mov rcx, r13
call qword [rax + 0x28]
xor eax, eax
mov dword [r15], eax
mov rcx, qword [rbp + 8]
mov dword [rbp + 0x10], eax
mov dword [rbp + 0x1018], eax
test rcx, rcx
je 0x1801bef19
call fcn.1800f0540
mov al, 1
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 8]
xor ebx, ebx
mov dword [rbp + 0x10], ebx
mov dword [rbp + 0x1018], ebx
test rcx, rcx
je 0x1801bef56
call fcn.1800f0540
mov dword [r15], ebx
jmp 0x1801bef19
mov rax, qword [rsp + 0x90]
movzx r8d, r10b
mov r9, qword [rsp + 0x88]
mov edx, esi
mov qword [rsp + 0x80], rax
add rsp, 0x40
pop r14
pop rsi
pop rbp
jmp fcn.1801bef90
Function at 0x1801bef90
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0x90]
xor r15d, r15d
mov rdi, r9
movzx r10d, r8b
mov r9d, edx
mov rbx, rcx
mov r8d, r15d
mov dword [r14], 0xffffffff
mov eax, dword [rcx + 0x1018]
mov dword [rcx + 0x10], eax
test eax, eax
je 0x1801bf003
nop word [rax + rax]
mov edx, r8d
inc r8d
mov rax, qword [rcx + rdx*8 + 0x1020]
mov qword [rcx + rdx*8 + 0x18], rax
cmp r8d, dword [rcx + 0x1018]
jb 0x1801befe0
mov eax, dword [rcx + 0x10]
test eax, eax
jne 0x1801bf01a
mov rax, qword [rdi]
lea rdx, str.No_sockets_exists_for_fdSetSelect.
mov rcx, rdi
call qword [rax + 0x28]
xor al, al
jmp 0x1801bf161
mov eax, 0x10624dd3
mul r9d
shr edx, 6
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub r9d, eax
imul eax, r9d, 0x3e8
xor r9d, r9d
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
test r10b, r10b
je 0x1801bf058
xor r8d, r8d
lea rdx, [rcx + 0x10]
jmp 0x1801bf05e
lea r8, [rcx + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov qword [rsp + 0x80], rbp
mov dword [r14], eax
cmp eax, 0xffffffff
jne 0x1801bf0a6
mov rax, qword [rdi]
lea rdx, str.select_system_call_failed.
mov rcx, rdi
call qword [rax + 0x28]
mov rcx, qword [rbx + 8]
mov dword [rbx + 0x10], r15d
mov dword [rbx + 0x1018], r15d
test rcx, rcx
je 0x1801bf0db
call fcn.1800f0540
xor al, al
jmp 0x1801bf159
cmp dword [rbx + 0x10], r15d
jne 0x1801bf0ce
mov rcx, qword [rbx + 8]
mov dword [rbx + 0x10], r15d
mov dword [rbx + 0x1018], r15d
test rcx, rcx
je 0x1801bf157
call fcn.1800f0540
jmp 0x1801bf157
call fcn.1800f0550
mov rbp, rax
test rax, rax
jne 0x1801bf0df
xor al, al
jmp 0x1801bf159
movsxd rsi, dword [rbx + 0x10]
test rsi, rsi
jle 0x1801bf140
mov rdi, r15
nop dword [rax + rax]
movsxd rax, dword [rbx + 0x1018]
mov edx, r15d
mov rcx, r15
test eax, eax
jle 0x1801bf138
mov r8, qword [rbx + rdi*8 + 0x18]
mov r9, rax
lea rax, [rbx + 0x1020]
cmp r8, qword [rax]
je 0x1801bf125
inc edx
inc rcx
add rax, 8
cmp rcx, r9
jl 0x1801bf110
jmp 0x1801bf138
mov rcx, qword [rbx + 8]
call fcn.1800f0600
mov edx, eax
mov rcx, rbp
call fcn.1800f04e0
inc rdi
cmp rdi, rsi
jl 0x1801bf0f0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1801bf153
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 8], rbp
mov al, 1
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180009610
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801c1390
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x1801c139c
mov al, 1
ret
jmp fcn.18018a380

Function at 0x1801cd120
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r10, rcx
mov r9, qword [str.expand_32_byte_k]
movzx eax, byte [r9 + 2]
movzx r8d, byte [r9 + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [r9 + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [r9]
shl r8d, 8
or r8d, eax
mov dword [rcx], r8d
movzx eax, byte [r9 + 6]
movzx ecx, byte [r9 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movzx eax, byte [r9 + 0xa]
movzx ecx, byte [r9 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movzx eax, byte [r9 + 0xe]
movzx ecx, byte [r9 + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x10], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
movzx eax, byte [rdx + 0xe]
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x40], 0x40
mov dword [r10 + 0x2c], ecx
ret
Function at 0x1801d13b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r9
movzx ebp, r8b
mov rbx, rdx
mov r14, rcx
mov rdi, qword [rsp + 0x90]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
movzx r9d, byte [rdx + 0x38]
lea r8, str.readExpectedMessage
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180029f80
nop
cmp byte [rbx + 0x38], 0
je 0x1801d1425
cmp qword [rbx + 0x40], 0
jne 0x1801d1425
mov rax, qword [rdi]
lea rdx, str.No_m_pHandler.
mov rcx, rdi
call qword [rax + 0x28]
mov dword [rbx + 0x58], 0
cmp dword [rbx + 8], 0
jne 0x1801d1440
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
nop word [rax + rax]
mov eax, dword [rbx + 0x14]
cmp eax, 5
jne 0x1801d1475
cmp dword [0x1802e42f8], 0xa
jge 0x1801d1467
mov rax, qword [rdi]
lea rdx, str.sshRp.m_totalTimeoutMs_wf_is_too_small__2_
mov rcx, rdi
call qword [rax + 0x28]
inc dword [0x1802e42f8]
mov dword [rbx + 0x14], 0x7530
mov eax, 0x7530
jmp 0x1801d1479
test eax, eax
je 0x1801d14ab
cmp dword [rbx + 8], 0
jne 0x1801d148a
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
mov eax, dword [rbx + 0x14]
cmp eax, 0x3e8
jae 0x1801d1498
mov dword [rbx + 0x14], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 8]
cmp eax, ecx
jbe 0x1801d14ab
sub eax, ecx
cmp eax, dword [rbx + 0x14]
ja 0x1801d14df
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.1801d3100
test al, al
je 0x1801d1517
mov rcx, rsi
call fcn.18017a630
test al, al
jne 0x1801d1517
test bpl, bpl
je 0x1801d14db
cmp dword [rbx + 0x58], 0x5d
je 0x1801d1440
mov bl, 1
jmp 0x1801d1519
mov rcx, rsi
call fcn.18017a6b0
mov byte [rsi + 0x28], 1
cmp byte [rdi + 0x169], 0
je 0x1801d1517
mov rax, qword [rdi]
lea rdx, str.Too_much_time_elapsed_waiting_for_response.
mov rcx, rdi
call qword [rax + 0x28]
mov r8d, dword [rbx + 0x14]
lea rdx, str.totalTimeoutMs
mov rcx, rdi
call fcn.18002a810
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.18002a0e0
movzx eax, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180009610
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801d3060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov r11, rdx
mov edi, r9d
mov r9d, dword [rsp + 0x30]
xor edx, edx
mov eax, r9d
mov rbx, r8
shr eax, 8
mov r8d, edi
movzx r10d, al
movzx eax, r9b
shl eax, 8
or r10d, eax
mov qword [r11 + 0x30], rdx
shl r10d, 8
mov eax, r9d
shr eax, 0x10
movzx ecx, al
or r10d, ecx
shr r9d, 0x18
shl r10d, 8
mov rcx, r11
or r10d, r9d
mov dword [r11 + 0x38], edx
mov qword [r11 + 0xb8], rdx
mov rdx, rbx
mov dword [r11 + 0x3c], r10d
mov dword [r11 + 0xc0], r10d
mov dword [r11 + 0x40], 0x40
mov dword [r11 + 0xc4], 0x40
mov dword [r11 + 0xb4], 1
mov rbx, qword [rsp + 0x10]
pop rdi
jmp fcn.1801ccd30
Function at 0x1801db8e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 0x14]
mov rdi, r8
mov rbx, rdx
test eax, eax
je 0x1801db942
cmp dword [rdx + 8], 0
jne 0x1801db908
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
mov eax, dword [rbx + 0x14]
cmp eax, 0x3e8
jae 0x1801db916
mov dword [rbx + 0x14], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 8]
cmp eax, ecx
jbe 0x1801db942
sub eax, ecx
cmp eax, dword [rbx + 0x14]
jbe 0x1801db942
mov rcx, rdi
call fcn.18017a6b0
mov al, 1
mov byte [rdi + 0x28], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1801e1fa0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x28]
mov rbp, rdx
cmp eax, r8d
mov esi, eax
mov rdi, rcx
cmova esi, r8d
test esi, esi
jne 0x1801e1fd7
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
sub eax, esi
mov qword [rsp + 0x30], rbx
cmp byte [rcx + 0x18], 0
mov dword [rcx + 0x28], eax
je 0x1801e213b
mov r9, qword [rcx + 0x20]
mov r11d, esi
mov r8d, dword [rcx + 0x1c]
movzx ecx, r8w
shr r8d, 0x10
test r9, r9
jne 0x1801e2010
lea r8d, [r9 + 1]
jmp 0x1801e2137
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jb 0x1801e20e0
mov r10d, edx
shr r10, 4
nop
movzx eax, byte [r9]
add edx, 0xfffffff0
add ecx, eax
movzx eax, byte [r9 + 1]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 2]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 3]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 4]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 5]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 6]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 7]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 8]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 9]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xa]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xb]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xc]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xd]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xe]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xf]
add r8d, ecx
add r9, 0x10
add ecx, eax
add r8d, ecx
sub r10, 1
jne 0x1801e2030
test edx, edx
je 0x1801e2101
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9]
inc r9
add ecx, eax
add r8d, ecx
add edx, 0xffffffff
jne 0x1801e20f0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r8d, eax
test r11d, r11d
jne 0x1801e2010
shl r8d, 0x10
or r8d, ecx
mov dword [rdi + 0x1c], r8d
mov rdx, qword [rdi + 0x20]
mov rcx, rbp
mov r8d, esi
mov ebx, esi
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x20], rbx
mov eax, esi
add dword [rdi + 0x2c], esi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1801e4be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x2c]
mov rbx, rcx
mov qword [rsp + 0x30], r14
nop word [rax + rax]
mov esi, dword [rbx + 0x40]
mov edx, dword [rbx + 0x88]
sub esi, edx
mov eax, dword [rbx + 0x90]
sub esi, eax
jne 0x1801e4c24
test edx, edx
jne 0x1801e4c33
test eax, eax
jne 0x1801e4c33
mov esi, edi
jmp 0x1801e4cc3
cmp esi, 0xffffffff
jne 0x1801e4c33
mov esi, 0xfffffffe
jmp 0x1801e4cc3
mov ecx, dword [rbx + 0x2c]
add ecx, 0xfffffefa
add ecx, edi
cmp edx, ecx
jb 0x1801e4cc3
mov rcx, qword [rbx + 0x38]
mov r8, rdi
lea rdx, [rdi + rcx]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbx + 0x68]
mov rax, qword [rbx + 0x58]
sub dword [rbx + 0x8c], edi
sub dword [rbx + 0x88], edi
sub dword [rbx + 0x78], edi
lea rdx, [rax + r8*2]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
sub cx, di
movzx eax, cx
not ax
sar ax, 0xf
and ax, cx
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1801e4c71
mov rax, qword [rbx + 0x48]
mov r8d, edi
lea rdx, [rax + rdi*2]
nop dword [rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
sub cx, di
movzx eax, cx
not ax
sar ax, 0xf
and ax, cx
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x1801e4ca0
add esi, edi
mov rcx, qword [rbx + 8]
call fcn.18004cde0
test eax, eax
je 0x1801e4d46
mov edx, dword [rbx + 0x90]
mov r8d, esi
mov eax, dword [rbx + 0x88]
mov rcx, qword [rbx + 8]
add rdx, rax
add rdx, qword [rbx + 0x38]
call fcn.1801e1fa0
add dword [rbx + 0x90], eax
mov r9d, dword [rbx + 0x90]
cmp r9d, 3
jb 0x1801e4d2c
mov eax, dword [rbx + 0x88]
mov rdx, qword [rbx + 0x38]
mov ecx, dword [rbx + 0x74]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x64], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x70]
mov dword [rbx + 0x64], r8d
cmp r9d, 0x106
jae 0x1801e4d46
mov rcx, qword [rbx + 8]
call fcn.18004cde0
test eax, eax
jne 0x1801e4c00
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret