joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002c91c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov word [rsp + 0x20], r9w
push rdi
sub rsp, 0x30
xor edi, edi
cmp dword [rcx], 2
mov rbx, rcx
jne 0x18002c93c
movzx eax, word [rcx + 4]
jmp 0x18002c93e
mov eax, edi
cmp dword [rcx], 2
mov word [rcx + 0x10], ax
mov word [rcx + 4], r8w
jne 0x18002c952
movzx eax, word [rcx + 6]
jmp 0x18002c954
mov eax, edi
cmp dword [rcx], 2
mov word [rcx + 0x12], ax
mov word [rcx + 6], dx
jne 0x18002c967
movzx eax, word [rcx + 8]
jmp 0x18002c969
mov eax, edi
mov word [rcx + 0x14], ax
mov word [rcx + 8], di
mov dword [rcx], 1
mov dword [rcx + 0xc], edi
mov rcx, qword [rcx + 0x30]
cmp rcx, rdi
je 0x18002c99f
call fcn.180037230
mov r8, qword [rbx + 0x30]
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 0x30], rdi
mov r8, qword [rbx + 0x38]
cmp r8, rdi
je 0x18002c9bb
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 0x38], rdi
cmp dword [rbx + 0x50], edi
jne 0x18002c9e6
lea rax, [rsp + 0x58]
lea r8, [0x18002c6e8]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18002c9f4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x50], edi
jne 0x18002ca8f
cmp dword [rcx + 0x18], edi
je 0x18002ca8f
mov rcx, qword [rcx + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x18002ca28
cmp eax, 0x80
jne 0x18002ca8f
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r11, qword [rbx + 0x30]
cmp r11, rdi
je 0x18002ca8f
cmp qword [rbx + 0x38], rdi
je 0x18002ca8f
cmp qword [r11], rdi
je 0x18002ca8f
cmp word [rbx + 6], di
je 0x18002ca8f
mov rcx, qword [rbx + 0x48]
mov dword [rbx + 0xc], 1
cmp rcx, rdi
je 0x18002ca62
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
lea r8, [0x18002c6e8]
mov r9, rbx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
mov eax, 1
jmp 0x18002ca91
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18002ca9c
Capabilities:
Terminate thread

Disassembly:
test rcx, rcx
je 0x18002cb45
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x50], 1
mov rcx, qword [rcx + 0x40]
mov edx, 0x1b58
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18002cae5
cmp eax, 0x80
je 0x18002cae5
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18002caf8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x48]
jmp 0x18002caf2
mov rcx, qword [rbx + 0x48]
and dword [rbx + 0x50], 0
test rcx, rcx
je 0x18002caf8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x30]
and qword [rbx + 0x48], 0
test rcx, rcx
je 0x18002cb23
call fcn.180037230
mov r8, qword [rbx + 0x30]
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx + 0x30], 0
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x18002cb40
mov rcx, qword [0x180059270]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx + 0x38], 0
add rsp, 0x20
pop rbx
ret

Function at 0x18002e254
Capabilities:
Connect socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
lea rsi, [rdx + 0xa0]
mov rdi, rdx
lea r9, [rdx + 0xaa]
movsx edx, word [rdx + 0xb0]
mov qword [rax - 0x20], rsi
mov dword [rax - 0x28], 1
mov qword [rax - 0x30], rdi
lea rax, [0x18002904c]
mov r8d, 1
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
and dword [rsp + 0x20], 0
mov r13, rcx
call fcn.180033e44
mov ebx, eax
test eax, eax
jne 0x18002e370
lock add dword [rdi + 0x60], 1
cmp word [rdi + 0xb0], 2
jne 0x18002e2d8
lea ebx, [rax + 0x10]
jmp 0x18002e2e9
or ebx, 0xffffffff
cmp word [rdi + 0xb0], 0x17
lea eax, [rbx + 0x1d]
cmove ebx, eax
mov r12, qword [rsi]
xor eax, eax
cmp word [rdi + 0xb0], 2
sete al
lea rdx, [rdi + 0xb0]
lea rcx, [r12 + 0x10]
movsxd r8, ebx
mov dword [r12 + 0x94], eax
call sub.ntdll.dll_memcpy
mov rcx, qword [r12]
lea rdx, [rdi + 0xb0]
mov r8d, ebx
mov dword [r12 + 0x90], ebx
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x18002e33d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18002e348
mov rdx, r12
mov rcx, r13
call fcn.180033d5c
mov ebx, eax
test eax, eax
jne 0x18002e357
mov byte [rdi + 0x248], 1
jmp 0x18002e370
cmp ebx, 0x2733
je 0x18002e370
mov rcx, qword [rsi]
test rcx, rcx
je 0x18002e370
call fcn.180034124
and qword [rsi], 0
test ebx, ebx
jne 0x18002e384
and dword [rdi + 0x230], ebx
mov rcx, rdi
call fcn.180034474
mov ebx, eax
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18002f328
Capabilities:
Get socket status

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x468
lea r14, [rcx + 0x3b0]
xor eax, eax
mov r12, rcx
mov rsi, qword [r14]
mov dword [rsp + 0x4b0], eax
jmp 0x18002f52c
lea rbx, [rsi - 0x20]
mov rsi, qword [rsi]
cmp byte [rbx + 0x248], 2
jne 0x18002f52c
mov rbp, qword [rbx + 0xa0]
xor eax, eax
xor edi, edi
xor r13d, r13d
mov dword [rsp + 0x4c8], eax
test rbp, rbp
je 0x18002f4ad
lea rcx, [rsp + 0x258]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
mov r15, qword [rbp]
and dword [rsp + 0x30], edi
xor eax, eax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x250]
mov dword [rsp + 0x34], eax
lea eax, [rdi + 1]
lea ecx, [rdi + 2]
mov dword [rsp + 0x250], eax
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x258], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x18002f496
lea rdx, [rsp + 0x40]
mov rcx, r15
lea r13d, [rdi + 1]
call sub.WS2_32.dll___WSAFDIsSet
mov rcx, r15
test eax, eax
je 0x18002f464
and dword [rsp + 0x4b8], edi
lea rax, [rsp + 0x4c0]
lea r9, [rsp + 0x4b8]
mov edx, 0xffff
mov r8d, 0x1007
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c0], 4
call qword [sym.imp.WS2_32.dll_getsockopt]
mov edi, 0x274d
test eax, eax
cmove edi, dword [rsp + 0x4b8]
jmp 0x18002f4a6
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x18002f489
mov rdx, rbp
mov rcx, r12
mov dword [rbp + 0xac], r13d
call fcn.180033d5c
jmp 0x18002f4a6
and dword [rbp + 0xac], edi
mov edi, 0x2749
jmp 0x18002f4a6
jns 0x18002f4a6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, 1
mov edi, eax
mov eax, dword [rsp + 0x4c8]
cmp r13d, 1
jne 0x18002f4eb
test edi, edi
jne 0x18002f4d0
and dword [rbx + 0x230], edi
mov rcx, rbx
mov byte [rbx + 0x248], r13b
call fcn.180034474
mov edi, eax
jmp 0x18002f4e9
lock add dword [rbx + 0x60], 0xffffffff
jne 0x18002f4e9
mov rcx, qword [0x180059270]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
test edi, edi
je 0x18002f525
test eax, eax
je 0x18002f549
lea rcx, str.EDK_CheckAsyncConnections
mov r9, rbx
mov r8, r12
mov edx, 0x7c9
call fcn.18002e3a0
test eax, eax
je 0x18002f525
lea rcx, str.EDK_CheckAsyncConnections
mov r9, rbx
mov r8, r12
mov edx, 0x7ca
call fcn.18002d680
mov eax, dword [rsp + 0x4b0]
cmp rsi, r14
jne 0x18002f357
add rsp, 0x468
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
mov dword [rsp + 0x4b0], eax
jmp 0x18002f52c
Function at 0x18002fc38
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
xor ebx, ebx
mov r15d, r9d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, rbx
je 0x18002fc9f
mov rbx, qword [rdx + 0x4c0]
movzx r8d, word [rsp + 0x1e8]
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rbx + 4]
call sub.ntdll.dll_memcpy
movzx r8d, word [rsp + 0x1e8]
lea rdx, [rbx + 4]
mov rcx, rdi
call fcn.1800341ec
mov ebx, eax
jmp 0x18002fe95
cmp word [r8], 2
jne 0x18002fcaf
mov rax, qword [rcx + 0xc48]
jmp 0x18002fcc1
cmp word [r8], 0x17
jne 0x18002fe90
mov rax, qword [rcx + 0xc50]
cmp rax, rbx
je 0x18002fe90
mov r13, qword [rax]
mov eax, dword [rcx + 0xc0]
mov edi, ebx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x1b8], 0x395f2ec1
mov dword [rsp + 0x1b0], eax
mov rax, qword [rcx + 0xd38]
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x1e8]
add eax, 0xc
test al, 7
setne dil
shr eax, 3
add edi, eax
shl edi, 3
mov dword [rsp + 0x40], edi
call fcn.18001ab38
mov ecx, 0x593
sub cx, di
cdq
movzx r8d, cx
idiv r8d
mov eax, 1
mov dword [rsp + 0x30], edx
cmp dword [rsp + 0x1b0], ebx
je 0x18002fd48
mov edi, eax
mov ebp, ebx
jmp 0x18002fd7a
mov rcx, qword [rsp + 0x1d8]
cmp rcx, rbx
je 0x18002fd76
cmp qword [rcx], rbx
jne 0x18002fd60
cmp qword [rcx + 8], rbx
je 0x18002fd76
mov eax, dword [rcx + 0xc]
mov ebp, ebx
xor eax, dword [rcx + 8]
xor eax, dword [rcx + 4]
xor eax, dword [rcx]
mov dword [rsp + 0x1b0], eax
jmp 0x18002fd78
mov ebp, eax
mov edi, ebx
mov r12d, 4
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x38]
mov r8, r12
call sub.ntdll.dll_memcpy
lea rcx, [rsp + 0x3c]
mov edx, r12d
call fcn.1800448e4
lea r9d, [r12 - 3]
lea r8, [rsp + 0x38]
lea edx, [r12 + 4]
lea rcx, [rsp + 0x60]
call fcn.18002c364
call fcn.18001ab38
and al, 0xfc
cmp ebp, ebx
je 0x18002fdca
or al, 2
jmp 0x18002fdd6
and al, 0xfd
cmp edi, ebx
je 0x18002fdd4
or al, 1
jmp 0x18002fdd6
and al, 0xfe
mov rdi, qword [rsp + 0x50]
lea rdx, [rsp + 0x3c]
mov r8, r12
lea rcx, [rdi + 1]
mov byte [rdi], al
call sub.ntdll.dll_memcpy
lea r9, [rdi + 5]
lea r8, [rsp + 0x1b8]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.18002c2c0
lea r9, [rdi + 9]
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.18002c2c0
lea r9, [rdi + 0xd]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.18002c2c0
mov r8, qword [rsp + 0x1e0]
lea r9, [rdi + 0x11]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.18002c2c0
mov eax, dword [rsp + 0x30]
add ax, di
add ax, 5
je 0x18002fe95
mov rdx, qword [rsi + 0xd38]
movzx r8d, ax
xor r9d, r9d
mov rcx, r13
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, ebx
jg 0x18002fe95
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18002fc98
mov ebx, 0x57
mov eax, ebx
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800309c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rdi, qword [rcx + 0x2a0]
mov rbx, qword [rcx + 0xd30]
mov rdx, qword [rsp + 0x90]
mov byte [rbx], 0xc5
mov byte [rbx + 1], 0x94
mov rsi, rcx
mov rcx, qword [rsp + 0xa0]
mov r14d, 0x70
xor r13d, r13d
mov word [rbx + 2], r14w
mov rax, qword [rdx]
mov ebp, r9d
mov qword [rbx + 4], rax
mov rax, qword [rdx + 8]
mov rdx, qword [rsp + 0x98]
mov qword [rbx + 0xc], rax
mov rax, qword [rdx]
mov r12, r8
mov qword [rbx + 0x14], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 0x1c], rax
mov rax, qword [rcx]
mov qword [rbx + 0x24], rax
mov rax, qword [rcx + 8]
lea rcx, [rbx + 0x5d]
mov qword [rbx + 0x2c], rax
mov rax, qword [rsp + 0xa8]
mov qword [rbx + 0x34], rax
mov al, byte [rsp + 0xb0]
mov byte [rbx + 0x3c], al
mov rax, qword [rsi + 8]
mov qword [rbx + 0x3d], rax
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x45], rax
cmp rdi, r13
je 0x180030aaf
mov rax, qword [rdi + 0x78]
lea rdx, [rdi + 0x130]
mov qword [rbx + 0x4d], rax
mov rax, qword [rdi + 0x80]
mov qword [rbx + 0x55], rax
call fcn.18002a704
movzx r11d, word [rdi + 0xa8]
mov word [rbx + 0x6e], r11w
jmp 0x180030ac7
xor edx, edx
mov qword [rbx + 0x55], r13
mov qword [rbx + 0x4d], r13
lea r8d, [rdx + 0x11]
call sub.ntdll.dll_memset
mov word [rbx + 0x6e], r13w
mov rax, qword [rsp + 0x88]
mov word [rsp + 0x38], r14w
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov r9d, ebp
mov r8, r12
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], r13d
call fcn.18002fc38
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret

Function at 0x180033ce0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor eax, eax
xor esi, esi
mov ebx, r8d
mov rdi, rcx
lea rcx, [rsp + 0x58]
lea r8d, [rsi + 4]
mov byte [rsp + 0x58], sil
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call sub.ntdll.dll_memcpy
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rsp + 0x58]
lea r8d, [rsi + 0xc]
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x5c], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
cmp eax, esi
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180033d5c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rdx + 0xb0]
xor ebx, ebx
mov rdi, rdx
test rbp, rbp
je 0x180033e2b
cmp dword [rdx + 0xa8], ebx
je 0x180033df7
lea rsi, [rcx + 0xc8]
mov rcx, qword [0x180059270]
lea r8d, [rbx + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x180033db1
lea ebx, [rax + 8]
jmp 0x180033ded
lea rcx, [rsi + 0x54]
mov rdx, rax
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rdi
call fcn.1800432d0
lea rcx, [rsi + 0x2c]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rsi], rsi
jne 0x180033de3
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.180042ff0
lea rcx, [rsi + 0x2c]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and qword [rdi + 0x98], 0
jmp 0x180033e2b
lea rax, [rdx + 0xa0]
mov r9, rdx
mov r8, rbp
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x98], rax
test rax, rax
jne 0x180033e2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180039400
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x8c0
mov r13, r8
mov r8d, dword [rsp + 0x928]
xor ebx, ebx
mov r14, r9
movzx esi, dx
mov r12, rcx
mov dword [r9], ebx
call fcn.180039b60
movsxd rbp, eax
test eax, eax
jns 0x180039440
xor eax, eax
jmp 0x180039529
mov qword [rsp + 0x8f0], rdi
mov rdi, qword [rsp + 0x910]
test rdi, rdi
je 0x1800394a6
lea r8, [rsp + 0x908]
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov dword [rsp + 0x908], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x1800394a6
mov edx, dword [rsp + 0x908]
mov dword [rsp + 0x30], 0xa
lea rcx, [rsp + 0x40]
mov r9d, 0x10
mov r8, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_getnameinfo]
movzx eax, si
lea r8, str.GET__s_HTTP__s_r_nHost:__s:_d_r_nConnection:_Close_r_nUser_Agent:_Microsoft_Windows_NT_5.1__UPnP_1.1__MiniUPnPc_2.0_r_n_r_n
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x30], eax
lea rax, [0x18005125c]
mov r9, r13
mov edx, 0x800
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll__snprintf]
mov edi, eax
test eax, eax
jle 0x180039508
movsxd rcx, ebx
mov r8d, edi
xor r9d, r9d
lea rdx, [rsp + rcx + 0xc0]
sub r8d, ebx
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x180039541
add ebx, eax
cmp ebx, edi
jl 0x1800394e1
mov rdx, r14
mov ecx, ebp
call fcn.180038bc0
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, rbx
mov rdi, qword [rsp + 0x8f0]
mov rbx, qword [rsp + 0x8f8]
add rsp, 0x8c0
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x180039521
Function at 0x180039b60
Capabilities:
Connect socket
Resolve dns

Disassembly:
push rbx
push rbp
push rdi
push r13
sub rsp, 0xa8
xor eax, eax
mov r13d, r8d
mov rdi, rcx
mov qword [rsp + 0x20], rax
movzx r9d, dx
mov qword [rsp + 0x28], rax
lea edx, [rax + 8]
lea r8, [0x180051658]
lea rcx, [rsp + 0xe8]
mov ebx, 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x24], eax
call qword [sym.imp.ntdll.dll__snprintf]
cmp byte [rdi], 0x5b
jne 0x180039c36
lea rax, [rdi + 1]
xor edx, edx
xor r10d, r10d
cmp byte [rax], dl
je 0x180039c2c
movzx ecx, byte [rax]
cmp cl, 0x5d
je 0x180039c2c
cmp rdx, 0x40
jge 0x180039c2c
mov byte [rsp + rdx + 0x50], cl
movsxd rcx, ebx
lea r8, [0x1800512b0]
mov r9w, word [rcx + rdi]
cmp r9w, word [r8]
jne 0x180039c0c
mov r9b, byte [rcx + rdi + 2]
cmp r9b, byte [r8 + 2]
jne 0x180039c0c
xor ecx, ecx
jmp 0x180039c11
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x180039c1c
add ebx, 2
add rax, 2
inc rax
inc r10d
inc rdx
inc ebx
cmp byte [rax], 0
jne 0x180039bd6
movsxd rax, r10d
mov byte [rsp + rax + 0x50], 0
jmp 0x180039c4a
lea rcx, [rsp + 0x50]
mov r8d, 0x40
mov rdx, rdi
call qword [sym.imp.ntdll.dll_strncpy]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0xa0], r12
mov byte [rsp + 0x90], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
je 0x180039c88
or eax, 0xffffffff
jmp 0x180039d30
mov rbx, qword [rsp + 0xd0]
or r12d, 0xffffffff
mov edi, r12d
test rbx, rbx
je 0x180039d16
mov qword [rsp + 0xd8], rsi
nop word [rax + rax]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
test eax, eax
js 0x180039cfd
mov rcx, qword [rbx + 0x20]
cmp word [rcx], 0x17
jne 0x180039cda
test r13d, r13d
je 0x180039cda
mov dword [rcx + 0x18], r13d
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
mov ebp, eax
test eax, eax
jns 0x180039d06
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x180039cb0
mov rbx, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
jns 0x180039d28
mov eax, r12d
jmp 0x180039d30
test ebp, ebp
cmovs edi, r12d
mov eax, edi
mov r12, qword [rsp + 0xa0]
add rsp, 0xa8
pop r13
pop rdi
pop rbp
pop rbx
ret

Function at 0x18003a224
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x18003a26a
test rdx, rdx
je 0x18003a26a
test ebx, ebx
je 0x18003a26a
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18003a25b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18003a26f
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1d
jmp 0x18003a26f
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x18003a278
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, r8d
test rcx, rcx
je 0x18003a2be
test rdx, rdx
je 0x18003a2be
test ebx, ebx
je 0x18003a2be
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18003a2af
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18003a2c3
mov eax, dword [rsp + 0x40]
sub eax, ebx
neg eax
sbb eax, eax
and eax, 0x1e
jmp 0x18003a2c3
mov eax, 0x57
add rsp, 0x30
pop rbx
ret
Function at 0x18003e654
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x90
xor r12d, r12d
mov rdi, r8
mov rsi, rcx
mov rbx, rdx
lea rcx, [rax - 0x68]
lea r8d, [r12 + 0x60]
xor edx, edx
mov ebp, r12d
call sub.ntdll.dll_memset
cmp rsi, r12
je 0x18003e6a7
cmp rbx, r12
je 0x18003e6a7
cmp rdi, r12
je 0x18003e6a7
mov al, byte [rbx]
mov rcx, rbx
cmp al, 0x2f
jne 0x18003e6d4
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
cmp al, 0x5c
je 0x18003e6a7
cmp al, 0x3a
je 0x18003e6a7
inc rcx
mov al, byte [rcx]
cmp al, r12b
jne 0x18003e6c7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, rsi
lea rcx, [rsp + 0x30]
cmp eax, 0xffffffff
je 0x18003e71d
mov r8d, 0x809
call fcn.18003d3a8
mov rdx, rsi
lea rcx, [rsp + 0x30]
cmp eax, r12d
je 0x18003e71d
call fcn.18003d808
cmp eax, r12d
jne 0x18003e733
lea rcx, [rsp + 0x30]
call fcn.18003d474
jmp 0x18003e6a7
xor r8d, r8d
call fcn.18003d794
cmp eax, r12d
je 0x18003e6a7
mov ebp, 1
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x28], 9
mov word [rsp + 0x20], r12w
call fcn.18003de6c
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.18003e3d4
lea rcx, [rsp + 0x30]
neg eax
sbb edi, edi
and edi, ebx
call fcn.18003e540
neg eax
sbb ebx, ebx
and ebx, edi
cmp ebx, r12d
jne 0x18003e794
cmp ebp, r12d
je 0x18003e794
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r12d
jne 0x18003e794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
jmp 0x18003e6a9
Function at 0x180040b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x39]
mov rdi, rcx
mov edx, dword [rdi + 0x85]
mov ebx, dword [rdi + 0x4d]
mov eax, dword [rdi + 0x39]
sub ebx, dword [rdi + 0x8d]
lea ecx, [rbp + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x180040be5
mov rcx, qword [rdi + 0x45]
mov r8, rbp
lea rdx, [rcx + rbp]
call sub.ntdll.dll_memcpy
mov r9d, dword [rdi + 0x65]
mov rax, qword [rdi + 0x59]
sub dword [rdi + 0x89], ebp
sub dword [rdi + 0x85], ebp
sub dword [rdi + 0x75], ebp
lea r8, [rax + r9*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x180040b98
mov rax, qword [rdi + 0x51]
mov r9d, ebp
lea r8, [rax + rbp*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
add r9d, 0xffffffff
mov word [r8], ax
jne 0x180040bc3
add ebx, ebp
mov rsi, qword [rdi]
cmp dword [rsi + 8], 0
je 0x180040cbb
mov eax, dword [rdi + 0x85]
mov r13d, dword [rdi + 0x8d]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rdi + 0x45]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x180040c67
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x24]
cmp ecx, 1
jne 0x180040c39
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x3c]
mov r8d, r12d
call fcn.18004b738
jmp 0x180040c4c
cmp ecx, 2
jne 0x180040c4f
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x3c]
mov r8d, r12d
call fcn.180044bb4
mov dword [rsi + 0x3c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.ntdll.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rdi + 0x8d], r12d
mov r9d, dword [rdi + 0x8d]
cmp r9d, 3
jb 0x180040ca5
mov eax, dword [rdi + 0x85]
mov rdx, qword [rdi + 0x45]
mov ecx, dword [rdi + 0x71]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x61], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x6d]
mov dword [rdi + 0x61], r8d
cmp r9d, 0x106
jae 0x180040cbb
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x180040b4e
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret