joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001ed0
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x4f0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [r11 - 0x228]
call fcn.18006cf60
mov r8d, 0x104
lea rdx, [rsp + 0x2d0]
mov rcx, qword [0x18010bdb8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebp, ebp
test eax, eax
je 0x180001f54
cmp eax, 0x104
ja 0x180001f54
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov word [rax], bp
jmp 0x180001f6a
call fcn.180003180
test eax, eax
js 0x180002101
cmp eax, 1
je 0x180002101
lea rdx, str.PlugFormat_
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x80]
call fcn.18006cf60
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2d0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x28]
call fcn.1800027f0
nop
mov r8d, 5
lea rdx, str..dll
lea rcx, [rsp + 0x28]
call fcn.1800026b0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180002030
cmp qword [rsp + 0x48], 8
jb 0x180002023
mov rcx, qword [rsp + 0x30]
call fcn.18006a4d4
xor eax, eax
jmp 0x180002101
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbp
mov word [rsp + 0x58], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2d0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x50]
call fcn.1800027f0
nop
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xac]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0xac]
lea rcx, [rsp + 0x50]
call fcn.1800026b0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov r8d, 1
mov rcx, rsi
call fcn.180001d90
nop
cmp qword [rsp + 0x70], 8
jb 0x1800020ca
mov rcx, qword [rsp + 0x58]
call fcn.18006a4d4
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180002030
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp qword [rsp + 0x48], 8
jb 0x1800020ff
mov rcx, qword [rsp + 0x30]
call fcn.18006a4d4
xor eax, eax
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.18006a4f0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180003ac0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
xor r13d, r13d
mov r10, r9
mov rbp, rdx
mov r12, rcx
test rbx, rbx
je 0x180003aef
mov dword [rbx], r13d
mov edi, dword [rsp + 0x70]
test edi, edi
jne 0x180003afe
xor eax, eax
jmp 0x180003c16
mov qword [rsp + 0x50], rsi
cmp rdx, 0xffffffffffffffff
je 0x180003c0c
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x180003c0c
test r8d, r8d
je 0x180003b5c
mov rax, qword [r9]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x180003b40
test edi, 0x1ff
je 0x180003b5c
mov r9, rsi
mov r8, r10
mov rdx, rbp
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call fcn.180003e10
jmp 0x180003c11
mov rdx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180003be7
lea r9, [rsp + 0x70]
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180003bfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180003bb6
cmp eax, 0x3e6
je 0x180003bb6
test eax, eax
jle 0x180003c11
movzx eax, ax
or eax, 0x80070000
jmp 0x180003c11
mov edx, edi
mov rcx, r12
call fcn.180003da0
test eax, eax
js 0x180003c11
cmp eax, 1
je 0x180003c11
mov rdx, qword [r12]
lea r9, [rsp + 0x70]
mov r8d, edi
mov rcx, rbp
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180003bee
call fcn.180003180
jmp 0x180003c11
mov rdx, qword [r12]
mov r8, rdi
mov rcx, rsi
call fcn.18006c2d0
test rbx, rbx
je 0x180003c08
mov eax, dword [rsp + 0x70]
mov dword [rbx], eax
xor eax, eax
jmp 0x180003c11
mov eax, 0x80070057
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x180003c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
xor r13d, r13d
mov r10, r9
mov rsi, rdx
mov r12, rcx
test rbx, rbx
je 0x180003c5f
mov dword [rbx], r13d
mov edi, dword [rsp + 0x70]
test edi, edi
jne 0x180003c6e
xor eax, eax
jmp 0x180003d8a
mov qword [rsp + 0x50], rbp
mov rbp, qword [rsp + 0x78]
test rbp, rbp
je 0x180003d80
cmp rdx, 0xffffffffffffffff
je 0x180003d80
test r8d, r8d
je 0x180003ccc
mov rax, qword [r9]
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0x1ff
cmp rax, rdx
jne 0x180003cb0
test edi, 0x1ff
je 0x180003ccc
mov r9, rbp
mov r8, r10
mov rdx, rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call fcn.180003f70
jmp 0x180003d85
mov rdx, qword [r10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180003d6a
lea r9, [rsp + 0x70]
mov r8d, edi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180003d71
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x180003d2a
cmp eax, 0x3e6
je 0x180003d2a
test eax, eax
jle 0x180003d85
movzx eax, ax
or eax, 0x80070000
jmp 0x180003d85
mov edx, edi
mov rcx, r12
call fcn.180003da0
test eax, eax
js 0x180003d85
cmp eax, 1
je 0x180003d85
mov rcx, qword [r12]
mov r8, rdi
mov rdx, rbp
call fcn.18006c2d0
mov rdx, qword [r12]
lea r9, [rsp + 0x70]
mov r8d, edi
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180003d71
call fcn.180003180
jmp 0x180003d85
test rbx, rbx
je 0x180003d7c
mov eax, dword [rsp + 0x70]
mov dword [rbx], eax
xor eax, eax
jmp 0x180003d85
mov eax, 0x80070057
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x180003e10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rsp + 0x88]
xor edi, edi
mov r14, r9
mov r13, r8
mov r12, rdx
mov r15, rcx
test rbp, rbp
je 0x180003e45
mov dword [rbp], edi
mov esi, dword [rsp + 0x80]
test esi, esi
jne 0x180003e57
xor eax, eax
jmp 0x180003f17
test r9, r9
je 0x180003f69
cmp rdx, 0xffffffffffffffff
je 0x180003f69
test r8, r8
je 0x180003f69
mov rcx, qword [r8]
mov qword [rsp + 0x60], rbx
mov rax, rcx
cqo
and edx, 0x1ff
lea rbx, [rdx + rax]
mov rax, rsi
sar rbx, 9
shl rbx, 9
sub rax, rbx
lea rax, [rax + rcx + 0x1ff]
mov rcx, r15
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0xfffffe00
mov edx, eax
mov qword [rsp + 0x88], rax
call fcn.180003da0
test eax, eax
js 0x180003f12
cmp eax, 1
je 0x180003f12
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180003f0d
mov r8d, dword [rsp + 0x88]
mov rdx, qword [r15]
lea r9, [rsp + 0x80]
mov rcx, r12
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180003f2f
call fcn.180003180
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, dword [r13]
mov ecx, dword [rsp + 0x80]
sub eax, ebx
cmp ecx, eax
jbe 0x180003f5d
sub ecx, eax
cmp ecx, esi
cmovb esi, ecx
mov edi, esi
test esi, esi
je 0x180003f5d
mov edx, eax
mov r8, rdi
mov rcx, r14
add rdx, qword [r15]
call fcn.18006c2d0
test rbp, rbp
je 0x180003f65
mov dword [rbp], edi
xor eax, eax
jmp 0x180003f12
mov eax, 0x80070057
jmp 0x180003f17
Function at 0x180003f70
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, qword [rsp + 0x98]
xor edi, edi
mov r15, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
test rbp, rbp
je 0x180003fa5
mov dword [rbp], edi
mov esi, dword [rsp + 0x90]
test esi, esi
jne 0x180003fb7
xor eax, eax
jmp 0x1800040d4
test r9, r9
je 0x180004111
cmp rdx, 0xffffffffffffffff
je 0x180004111
test r8, r8
je 0x180004111
mov rcx, qword [r8]
mov qword [rsp + 0x70], rbx
mov rax, rcx
cqo
and edx, 0x1ff
lea rbx, [rdx + rax]
mov rax, rsi
sar rbx, 9
shl rbx, 9
sub rax, rbx
lea rax, [rax + rcx + 0x1ff]
mov rcx, r14
cqo
and edx, 0x1ff
add rax, rdx
and eax, 0xfffffe00
mov edx, eax
mov qword [rsp + 0x30], rax
call fcn.180003da0
test eax, eax
js 0x1800040cf
cmp eax, 1
je 0x1800040cf
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800040ca
mov r8d, dword [rsp + 0x30]
mov rdx, qword [r14]
lea r9, [rsp + 0x98]
mov rcx, r12
mov dword [rsp + 0x98], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800040ca
mov r13d, dword [r13]
mov r8, rsi
mov rdx, r15
sub r13d, ebx
mov ecx, r13d
add rcx, qword [r14]
call fcn.18006c2d0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800040ca
mov r8d, dword [rsp + 0x30]
mov rdx, qword [r14]
lea r9, [rsp + 0x90]
mov rcx, r12
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800040ef
call fcn.180003180
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test rbp, rbp
je 0x18000410d
mov eax, dword [rsp + 0x90]
cmp eax, r13d
jbe 0x18000410a
sub eax, r13d
cmp eax, esi
cmovb esi, eax
mov edi, esi
mov dword [rbp], edi
xor eax, eax
jmp 0x1800040cf
mov eax, 0x80070057
jmp 0x1800040d4
Function at 0x180009d30
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov qword [rcx + 0x30], send
xor edi, edi
mov rbx, rcx
mov qword [rcx + 0x28], rdi
mov byte [rcx + 0x18], dil
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rdx, [0x180106f48]
mov ecx, 0x1f4
call fcn.18006aaa4
xor edx, edx
mov r8d, 0x1f4
mov rcx, rax
mov qword [rbx + 0x38], rax
call fcn.18006cf60
mov qword [rbx], 0xffffffffffffffff
mov qword [rbx + 8], 0xffffffffffffffff
mov dword [rbx + 0x50], edi
mov qword [rbx + 0x48], 0xffffffffffffffff
mov dword [rbx + 0x60], edi
mov dword [rbx + 0x64], edi
mov qword [rbx + 0x58], rdi
mov dword [rbx + 0x40], edi
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18006a4f0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rdi
ret

Function at 0x18000a560
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x58]
mov r12, r9
mov esi, r8d
mov rdi, rdx
test rcx, rcx
jne 0x18000a595
mov eax, 0x80004005
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
test r8d, r8d
je 0x18000a6a5
cmp rdx, rcx
jae 0x18000a6a5
lea rax, [rdx + rsi]
cmp rax, rcx
jbe 0x18000a5b4
mov esi, ecx
sub esi, edx
cmp qword [rbx + 0x48], rdx
je 0x18000a615
mov rcx, rbx
call fcn.18000afa0
test eax, eax
js 0x18000a678
cmp eax, 1
je 0x18000a678
mov rdx, rdi
mov rcx, rbx
call fcn.18000b300
test eax, eax
js 0x18000a678
cmp eax, 1
je 0x18000a678
mov rcx, rbx
mov qword [rbx + 0x48], rdi
call fcn.18000b400
test eax, eax
js 0x18000a678
cmp eax, 1
je 0x18000a678
mov rcx, rbx
call fcn.18000b0e0
test eax, eax
js 0x18000a678
cmp eax, 1
je 0x18000a678
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r13
mov ebp, esi
test esi, esi
je 0x18000a68e
mov r13d, 0x1000
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18000a69e
mov r8d, ebp
mov eax, ebp
cmp ebp, r13d
cmova r8d, r13d
mov edx, esi
xor r9d, r9d
sub rdx, rax
add rdx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18000a686
xor edi, edi
call fcn.180003180
test eax, eax
js 0x18000a66e
cmp eax, 1
jne 0x18000a68a
mov rbp, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
add qword [rbx + 0x48], rdi
sub ebp, edi
jne 0x18000a630
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x18000a69a
mov dword [rax], esi
xor eax, eax
jmp 0x18000a66e
mov eax, 0x80004005
jmp 0x18000a66e
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x18000a6b5
mov dword [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x18000a6d0
Capabilities:
Connect to http server
Create http request

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x2a8
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, qword [rsp + 0x308]
mov r13, rcx
mov r12, r9
mov rdi, r8
mov rbp, rdx
lea rcx, [0x1800e15f0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenW]
cmp qword [r12 + 0x20], 8
mov rbx, rax
jb 0x18000a735
mov rax, qword [r12 + 8]
jmp 0x18000a73a
lea rax, [r12 + 8]
cmp qword [rdi + 0x20], 8
jb 0x18000a747
mov r9, qword [rdi + 8]
jmp 0x18000a74b
lea r9, [rdi + 8]
cmp qword [rbp + 0x20], 8
jb 0x18000a758
mov rdx, qword [rbp + 8]
jmp 0x18000a75c
lea rdx, [rbp + 8]
movzx r8d, word [rsp + 0x300]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x8000000
mov rcx, rbx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rdi, rax
test rax, rax
jne 0x18000a7dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x2eee
jne 0x18000a7bb
test rbx, rbx
je 0x18000a7b1
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0xe0036003
jmp 0x18000a89d
test eax, eax
jle 0x18000a7c8
movzx edi, ax
or edi, 0x80070000
test rbx, rbx
je 0x18000a7d6
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, edi
jmp 0x18000a89d
cmp qword [rsi + 0x20], 8
jb 0x18000a7ea
mov rdx, qword [rsi + 8]
jmp 0x18000a7ee
lea rdx, [rsi + 8]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_FtpFindFirstFileW]
test rax, rax
jne 0x18000a82f
call fcn.180003180
mov rcx, rdi
mov esi, eax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rbx, rbx
je 0x18000a82b
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, esi
jmp 0x18000a89d
mov edx, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x60]
shl rdx, 0x20
or rdx, rcx
mov qword [r13 + 0x58], rdx
jne 0x18000a86b
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rbx, rbx
je 0x18000a864
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 0xe0036006
jmp 0x18000a89d
mov ecx, dword [rsp + 0x58]
mov dword [r13 + 0x64], ecx
mov ecx, dword [rsp + 0x54]
mov dword [r13 + 0x60], ecx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rbx, rbx
je 0x18000a89b
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x2a8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000a8c0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
mov rcx, qword [rcx]
mov r12, r9
mov rbp, r8
mov rdi, rdx
cmp rcx, 0xffffffffffffffff
je 0x18000a8fd
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rsi], 0xffffffffffffffff
xor r8d, r8d
mov r13d, 2
lea edx, [r8 + 1]
mov ecx, r13d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x18000a926
call fcn.180003180
jmp 0x18000aa1c
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rax
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x30], 0x7530
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
xor r11d, r11d
cmp qword [rdi + 0x20], 0x10
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x3c], r11d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x44], r11d
jb 0x18000a97c
mov rcx, qword [rdi + 8]
lea rbx, [rdi + 8]
jmp 0x18000a983
lea rbx, [rdi + 8]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x18000a9cc
cmp qword [rdi + 0x20], 0x10
jb 0x18000a998
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
je 0x18000aa02
mov rdx, qword [rax + 0x18]
movsx r8, word [rax + 0x12]
lea rcx, [rsp + 0x3c]
mov rdx, qword [rdx]
call fcn.18006c2d0
movzx r11d, word [rbx + 0x10]
mov word [rsp + 0x38], r11w
jmp 0x18000a9d6
mov word [rsp + 0x38], r13w
mov dword [rsp + 0x3c], eax
movzx ecx, word [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rsi]
lea rdx, [rsp + 0x38]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18000aa09
call fcn.180003180
jmp 0x18000aa17
mov r8, r12
mov rdx, rbp
mov rcx, rsi
call fcn.18000aa40
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000afa0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
lea rdx, str.TYPE_I__r_n
lea rcx, [rsp + 0x20]
mov r8d, 9
mov qword [rsp + 0x40], send
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
call fcn.1800024b0
cmp qword [rsp + 0x40], 0x10
mov r8d, dword [rsp + 0x38]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x18000b03b
call fcn.180003180
cmp qword [rsp + 0x40], 0x10
mov ebx, eax
jb 0x18000b026
mov rcx, qword [rsp + 0x28]
call fcn.18006a4d4
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x50
pop rbx
ret
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx]
xor r9d, r9d
mov r8d, 0x1f4
mov qword [rsp + 0x68], rdi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x18000b081
call fcn.180003180
mov edi, eax
test eax, eax
js 0x18000b06b
cmp eax, 1
jne 0x18000b08c
cmp qword [rsp + 0x40], 0x10
jb 0x18000b07d
mov rcx, qword [rsp + 0x28]
call fcn.18006a4d4
mov eax, edi
jmp 0x18000b0c6
movsxd rcx, eax
mov rax, qword [rbx + 0x38]
mov byte [rcx + rax], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x18000b0b2
cmp byte [rcx], 0
je 0x18000b0b2
lea rdx, str._n226
call fcn.18006af5c
test rax, rax
je 0x18000b0b2
mov dword [rbx + 0x40], 1
cmp qword [rsp + 0x40], 0x10
jb 0x18000b0c4
mov rcx, qword [rsp + 0x28]
call fcn.18006a4d4
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x50
pop rbx
ret
Function at 0x18000b0e0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
lea r8, [rcx + 0x10]
lea rdx, str.RETR
lea rcx, [rsp + 0x20]
call fcn.18000bee0
nop
lea r8, [0x1800e1600]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.18000bfa0
nop
cmp qword [rsp + 0x40], 0x10
jb 0x18000b14e
mov rcx, qword [rsp + 0x28]
call fcn.18006a4d4
mov qword [rsp + 0x40], send
xor esi, esi
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x28], sil
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rdx, qword [rsp + 0x80]
xor r9d, r9d
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x18000b1bc
call fcn.180003180
mov ebx, eax
cmp qword [rsp + 0x98], 0x10
jb 0x18000b1b5
mov rcx, qword [rsp + 0x80]
call fcn.18006a4d4
mov eax, ebx
jmp 0x18000b2ce
xor r9d, r9d
mov r8d, 0x1f4
mov rdx, qword [rdi + 0x38]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x18000b206
call fcn.180003180
mov ebx, eax
test eax, eax
js 0x18000b1e7
cmp eax, 1
jne 0x18000b211
cmp qword [rsp + 0x98], 0x10
jb 0x18000b1ff
mov rcx, qword [rsp + 0x80]
call fcn.18006a4d4
mov eax, ebx
jmp 0x18000b2ce
movsxd rcx, eax
mov rax, qword [rdi + 0x38]
mov byte [rcx + rax], sil
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.18000bc10
nop
mov rbx, qword [rax + 0x18]
cmp rbx, rbx
cmovb rbx, rbx
cmp qword [rax + 0x20], 0x10
jb 0x18000b237
mov rcx, qword [rax + 8]
jmp 0x18000b23b
lea rcx, [rax + 8]
mov r8d, 3
cmp rbx, r8
cmovb r8, rbx
lea rdx, [0x1800e1634]
call fcn.180079150
movsxd rcx, eax
test eax, eax
jne 0x18000b270
cmp rbx, 3
jae 0x18000b266
or ecx, 0xffffffff
jmp 0x18000b270
cmp rbx, 3
setne sil
mov ecx, esi
test ecx, ecx
sete bl
cmp qword [rsp + 0x70], 0x10
jb 0x18000b287
mov rcx, qword [rsp + 0x58]
call fcn.18006a4d4
test bl, bl
je 0x18000b2aa
cmp qword [rsp + 0x98], 0x10
jb 0x18000b2a3
mov rcx, qword [rsp + 0x80]
call fcn.18006a4d4
mov eax, 1
jmp 0x18000b2ce
mov rcx, rdi
call fcn.18000bb80
mov ebx, eax
cmp qword [rsp + 0x98], 0x10
jb 0x18000b2cc
mov rcx, qword [rsp + 0x80]
call fcn.18006a4d4
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18006a4f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000b300
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor eax, eax
mov byte [rsp + 0x20], 0
mov rbx, rcx
mov r8, rdx
mov qword [r11 - 0x47], rax
mov qword [r11 - 0x3f], rax
mov qword [r11 - 0x37], rax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
lea rdx, str.REST__I64d__r_n
lea rcx, [r11 - 0x48]
mov byte [rsp + 0x51], al
call fcn.18000c060
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x20]
repne scasb al, byte [rdi]
xor r9d, r9d
not rcx
mov r8d, ecx
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x18000b384
call fcn.180003180
jmp 0x18000b3e2
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx]
xor r9d, r9d
mov r8d, 0x1f4
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x18000b3af
call fcn.180003180
test eax, eax
js 0x18000b3e2
cmp eax, 1
jne 0x18000b3ba
jmp 0x18000b3e2
movsxd rcx, eax
mov rax, qword [rbx + 0x38]
mov byte [rcx + rax], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x18000b3e0
cmp byte [rcx], 0
je 0x18000b3e0
lea rdx, str._n226
call fcn.18006af5c
test rax, rax
je 0x18000b3e0
mov dword [rbx + 0x40], 1
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18006a4f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret