joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c42d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r9d, dword [0x1802e1470]
mov rdi, rcx
mov rax, qword gs:[0x58]
xor ebx, ebx
mov ecx, Ordinal_41
mov rbp, r8
mov rsi, rdx
mov rax, qword [rax + r9*8]
mov eax, dword [rcx + rax]
cmp dword [0x1802e0f08], eax
jg 0x1800c4390
mov rdx, rsi
mov rcx, rdi
call qword [0x1802e0f00]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x35
xor byte [r8 - 1], al
cmp ebx, 0xd
jl 0x1800c4340
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add rax, rbp
lea rcx, [0x1802e0f08]
mov qword [0x1802e0f00], rax
call fcn.180157c24
jmp 0x1800c4313
lea rcx, [0x1802e0f08]
call fcn.180157c90
cmp dword [0x1802e0f08], 0xffffffff
jne 0x1800c4313
cmp dword [reloc.WS2_32.dll_accept], 2
movsd xmm0, qword [0x1801ab658]
movzx eax, byte [0x1801ab664]
mov ecx, dword [0x1801ab660]
movsd qword [rsp + 0x28], xmm0
mov byte [rsp + 0x34], al
mov dword [rsp + 0x30], ecx
jl 0x1800c4523
movdqa xmm5, xmmword [0x1801aecf0]
mov ebx, listen
movdqa xmm2, xmmword [0x180168c90]
movdqa xmm3, xmmword [0x18016fdb0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x18016fe50]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
movd xmm0, dword [0x1801ab658]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
xorps xmm2, xmm0
movd dword [rsp + 0x28], xmm2
movdqa xmm2, xmmword [0x18016fd90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
xorps xmm2, xmm0
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
movd dword [rsp + 0x2c], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
movd xmm0, ecx
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [str.5555555555555555]
xorps xmm3, xmm0
movd dword [rsp + 0x30], xmm3
mov eax, ebx
lea r8, [rsp + 0x28]
add r8, rax
jmp 0x1800c4340
Function at 0x1800c8110
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800c82bd
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180069240
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800c8286
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800c8200
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800c8275
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800c823d
mov r10, qword [rdx]
cmp r10, rax
je 0x1800c8237
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800c8275
cmp r9, rdx
je 0x1800c8251
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800c8297
cmp r9, rdx
jne 0x1800c8242
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800c81b0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800c8275
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1800dff50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.180157e80
sub rsp, rax
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x24], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov r8d, 0x3e
lea rdx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea rcx, [rsp + 0x30]
call fcn.18004a030
nop
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, 1
nop dword [rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x1800dffe0
mov dword [rsp + 0x50], 0x270
mov r15d, dword [rsp + 0x40]
dec r15d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x24], 1
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
test r14, r14
je 0x1800e0110
mov eax, 0x80000000
xor r15d, eax
movzx ebx, byte [rsp + 0x20]
nop dword [rax]
lea rcx, [rsp + 0x50]
cmp r15d, 0x7fffffff
jne 0x1800e0067
call fcn.1800b8ca0
mov ecx, eax
jmp 0x1800e00a8
lea esi, [r15 - 0x7fffffff]
call fcn.1800b8ca0
mov ebp, esi
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jae 0x1800e00a4
mov eax, esi
neg eax
xor edx, edx
div esi
mov esi, edx
cmp ecx, edx
jae 0x1800e00a4
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.1800b8ca0
mov ecx, eax
imul rcx, rbp
cmp ecx, esi
jb 0x1800e0090
shr rcx, 0x20
mov r8d, 0x80000000
lea eax, [rcx + r8]
xor eax, r8d
lea rcx, [rsp + 0x30]
cmp r13, 0xf
cmova rcx, r12
cdqe
movzx r9d, byte [rax + rcx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800e00f5
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1800e00ea
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800e0106
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.18005a390
sub r14, 1
jne 0x1800e0050
cmp r13, 0xf
jbe 0x1800e014b
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1800e0143
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800e0143
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.180157870
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.180157e20
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800f6200
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
mov qword [r11 - 0x38], rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r15d, r15d
cmp rax, 3
jb 0x1800f62cf
lea rax, [r8 + 3]
mov qword [rdi + 0x10], rax
mov rbx, rdi
cmp rcx, 0xf
jbe 0x1800f6263
mov rbx, qword [rdi]
lea rax, [0x18016d65b]
mov r14d, 3
lea rsi, [0x18016d658]
cmp rax, rbx
jbe 0x1800f6297
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x1800f6297
cmp rbx, rsi
ja 0x1800f628f
mov rbp, r15
jmp 0x1800f629a
mov rbp, rbx
sub rbp, rsi
jmp 0x1800f629a
mov rbp, r14
inc r8
lea rcx, [rbx + 3]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r14, rbp
lea rdx, [rsi + 3]
add rdx, rbp
lea rcx, [rbx + rbp]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800f62fa
mov r14d, 3
mov qword [rsp + 0x28], r14
lea rsi, [0x18016d658]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
movzx r8d, byte [rsp + 0x30]
mov edx, r14d
mov rcx, rdi
call fcn.18004a6d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x40], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
lea rax, str.cmd.exe
mov qword [rsp + 0x58], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800f635c
mov rax, qword [rdi]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x78], r15
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1800f638e
mov rcx, rdi
call fcn.18004ac00
mov eax, 0xffffffff
jmp 0x1800f63d6
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0xb8]
mov rcx, rdi
call fcn.18004ac00
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180157e20
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800fed90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x1800fedb8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x1800feda0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x1800fedc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x1800fee4b
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [r9 + rax]
lea ecx, [rdx - 0x2a]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 0x29]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x28]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x27]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x26]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x25]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x24]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x23]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x22]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x21]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x20]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x1f]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x1e]
xor byte [rax - 4], cl
sub dl, 0x1d
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x46
jb 0x1800fede0
mov byte [r8 + 0x47], 0
mov rax, r8
ret
Function at 0x18011df30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x18011df8e
mov dl, 1
call fcn.18010e980
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.18010e980
mov eax, ebx
jmp 0x18011dfd2
cmp ebx, 2
ja 0x18011dfd0
mov r9, qword [rdi + 0x668]
lea rdx, [0x1801b23d8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18011dff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x18011e033
cmp qword [rcx + 0x678], 0
je 0x18011e110
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.18010ca80
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x18011e061
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x18011e0a8
cmp byte [rdi + 0x1597], 0
jne 0x18011e0a8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x18011e090
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x18011e108
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x18011e163
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x18011e129
mov dl, 1
mov rcx, rdi
call fcn.18010e980
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.18010e980
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180157e20
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1801b23d8]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18011e108
call fcn.1801582a4
int3
Function at 0x18011e170
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x18011e2d6
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x18011e2be
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.18010ca80
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x18011e231
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x18011e1f0
cmp byte [rax + rcx - 1], 0xa
jne 0x18011e218
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x18011e22c
lea r8, [0x180164058]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.18010c980
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18011e236
cmp qword [rdi + 0x718], 0
je 0x18011e27e
mov dl, 1
mov rcx, rdi
call fcn.18010e980
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.18010e980
jmp 0x18011e2b6
mov r9, qword [rdi + 0x668]
lea rcx, [0x1801b23d8]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.180157e20
add rsp, 0x860
pop rdi
ret

Function at 0x18011e370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x18011e3b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, Ordinal_60
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18011e550
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rsp + 0x1a0]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov rax, rcx
mov r12, r9
shl rax, 5
mov r15, r8
lea rbx, [rsi + 0x508]
mov rbp, qword [rsi + rcx*8 + 0x4c0]
add rbx, rax
mov rax, qword [rsi + 0x698]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x18011e657
lea rax, [0x18011e400]
cmp qword [rsi + rcx*8 + 0x4e8], rax
jne 0x18011e657
cmp qword [rbx], r13
je 0x18011e5de
test rdi, rdi
je 0x18011e657
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.18012dbd0
cmp eax, 0xffffffff
je 0x18011e657
test al, 1
je 0x18011e657
mov rax, qword [rbx]
test rax, rax
jne 0x18011e630
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb70]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x18011e653
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x18011e657
add qword [rbx + 0x10], rcx
jmp 0x18011e657
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x18011e6c4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x18011e690
mov dword [r14], 0x51
mov rax, r13
jmp 0x18011e6c7
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.1801083f0
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.18011dff0
mov rcx, qword [rsi]
mov dword [rcx + 0x11b0], ebx
mov dword [r14], Ordinal_60
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180157e20
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18011ed60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x558], 0
je 0x18011ed7d
call fcn.180117f00
test eax, eax
jne 0x18011eda3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x18011ed76
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x18011ed76
mov al, 1
add rsp, 0x28
ret
Function at 0x1801209d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret

Function at 0x180120ce0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x180120d0a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801b2888]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x180120d6e
mov rcx, rbx
test r14, r14
je 0x180120d58
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x180120da6
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180120da6
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x180120e68
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x180120dd0
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x180120e5a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x180120e5a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x180120e00
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x180120e14
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x180120e30
mov rcx, rdi
test r14, r14
je 0x180120e51
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x180120e57
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.180158c7c]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret