joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180216210
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r13
sub rsp, 0x960
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x950], rax
mov rbp, qword [rcx]
mov r13, rcx
mov edx, 0x3c
mov rdi, qword [rbp + 0x8820]
mov rcx, rbp
mov r9, qword [rdi + 0x1ab8]
lea r8, [rdi + 0x18b0]
sub r9, qword [rdi + 0x1ab0]
add r9, 2
call fcn.180215ce0
mov rax, qword [rdi + 0x1ab0]
movzx ecx, byte [rax]
inc rax
mov qword [rdi + 0x1ab0], rax
cmp ecx, 0x18
je 0x180216433
cmp ecx, 0x23
je 0x180216406
cmp ecx, 0x27
jne 0x1802164e6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov r12d, 0x800
lea rcx, [rsp + 0x150]
lea r8, str._c_c_c_c
mov r9d, 0xff
mov edx, r12d
mov qword [rsp + 0x988], rbx
mov dword [rsp + 0x20], 0xfa
mov qword [rsp + 0x990], rsi
call fcn.180212380
mov rbx, qword [rdi + 0x18a8]
mov esi, 4
test rbx, rbx
je 0x180216379
mov r10, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r10
repne scasb al, byte [rdi]
not rcx
lea rdi, [rsi + rcx]
cmp rdi, 0x7fa
jae 0x18021636c
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x50]
lea rdx, str._127_____127s
mov rcx, r10
call qword [sym.imp.MSVCR100.dll_sscanf]
lea rax, [rsp + 0xd0]
mov rdx, r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea rcx, [rsp + rsi + 0x150]
lea r8, str._c_s_c_s
sub rdx, rsi
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.180212380
mov rsi, rdi
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1802162f2
sub r12, rsi
lea rcx, [rsp + rsi + 0x150]
lea r8, [0x18034f7f0]
mov r9d, 0xff
mov rdx, r12
mov dword [rsp + 0x20], 0xf0
call fcn.180212380
mov rcx, qword [r13 + 0x120]
lea r8d, [rsi + 2]
lea rdx, [rsp + 0x150]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rbx, qword [rsp + 0x988]
test eax, eax
jns 0x1802163e1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180203720
lea r8, [rsp + 0x152]
mov r9, rsi
mov edx, 0x3e
mov rcx, rbp
call fcn.180215ce0
mov rsi, qword [rsp + 0x990]
jmp 0x1802164e6
mov dword [rsp + 0x48], 0xf0
mov dword [rsp + 0x40], 0xff
lea rdx, [rdi + 0x1828]
mov qword [rsp + 0x38], rdx
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x23
jmp 0x18021645e
mov dword [rsp + 0x48], 0xf0
mov dword [rsp + 0x40], 0xff
lea rdx, [rdi + 0x1808]
mov qword [rsp + 0x38], rdx
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
or rcx, 0xffffffffffffffff
mov rdi, rdx
lea r8, str._c_c_c_c_s_c_c
repne scasb al, byte [rdi]
mov r9d, 0xff
mov edx, 0x800
not rcx
mov dword [rsp + 0x20], 0xfa
lea rdi, [rcx - 1]
lea rcx, [rsp + 0x150]
call fcn.180212380
mov rcx, qword [r13 + 0x120]
lea r8d, [rdi + 6]
lea rdx, [rsp + 0x150]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1802164cd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180203720
lea r9, [rdi + 4]
lea r8, [rsp + 0x152]
mov edx, 0x3e
mov rcx, rbp
call fcn.180215ce0
mov rcx, qword [rsp + 0x950]
xor rcx, rsp
call fcn.180227610
mov rbp, qword [rsp + 0x998]
add rsp, 0x960
pop r13
pop r12
pop rdi
ret
Function at 0x180216c10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r11d, eax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
mov r8, rcx
lea ecx, [r11 + 1]
mov edx, ecx
add rcx, r8
cmp rcx, 0x104
ja 0x180216c86
lea rcx, [rsp + rdx + 0x20]
mov rdx, rbx
mov byte [rsp + r11 + 0x20], 0x5c
call sub.MSVCR100.dll_memcpy
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227610
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret

Function at 0x180217390
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x40
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x128]
mov r8b, 1
xor edx, edx
mov rbp, rcx
call fcn.18020e260
test eax, eax
jns 0x1802173e2
lea rdx, str.Timed_out_before_server_could_connect_to_us
mov rcx, rbx
call fcn.180203720
mov eax, 0x1c
jmp 0x1802174a3
mov qword [rsp + 0x58], rdi
or rdi, 0xffffffffffffffff
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
call fcn.18021f6a0
cmp eax, edi
je 0x18021748a
test eax, eax
je 0x180217481
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x180217442
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rsi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rbx
cmp rdi, 0xffffffffffffffff
jne 0x18021745d
lea rdx, str.Error_accept__ing_server_connect
jmp 0x180217494
lea rdx, str.Connection_accepted_from_server_n
call fcn.180203670
mov edx, 1
mov rcx, rdi
mov qword [rbp + 0x128], rdi
call fcn.18020e310
xor eax, eax
jmp 0x18021749e
lea rdx, str.Timeout_while_waiting_for_server_connect
jmp 0x180217491
lea rdx, str.Error_while_waiting_for_server_connect
mov rcx, rbx
call fcn.180203720
mov eax, 0x1e
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180227610
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x180218e50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x8820]
mov edx, dword [rax + 0x18]
test edx, edx
je 0x180218ebd
cmp qword [rbx + 0x3e0], 0
je 0x180218e9a
lea rdx, str.REST__d
xor r8d, r8d
mov rcx, rbx
call fcn.1802180c0
test eax, eax
jne 0x180218ed8
mov dword [rbx + 0x458], 0x18
add rsp, 0x20
pop rbx
ret
test edx, edx
je 0x180218ebd
mov r8d, ntohl
mov dl, 1
mov rcx, rbx
mov dword [rbx + 0x458], 0xb
add rsp, 0x20
pop rbx
jmp fcn.18021aaf0
cmp byte [rcx + 0x3c6], 0
mov rcx, rbx
je 0x180218ed3
add rsp, 0x20
pop rbx
jmp fcn.180218990
call fcn.180218d80
add rsp, 0x20
pop rbx
ret

Function at 0x180219830
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov esi, dword [rcx + 0x42c]
mov rbx, rcx
cmp edx, 0xc8
je 0x1802198b0
test esi, esi
jne 0x18021986d
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rdi
call fcn.180203670
mov byte [rbx + 0x1b9], sil
lea eax, [rsi + 1]
cmp eax, 2
jne 0x180219899
lea rdx, str.Failed_to_do_PORT
mov rcx, rdi
call fcn.180203720
mov eax, 0x1e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180218990
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rdi
call fcn.180203670
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x458], 0
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1802198e0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0x51eb851f
mov edi, r8d
mov r8d, edx
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rcx]
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 2
je 0x180219932
lea rdx, str.Couldnt_set_desired_mode
call fcn.180203720
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r8d, 0xc8
je 0x180219947
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.180203670
cmp edi, 0x11
jne 0x180219956
mov rcx, rsi
call fcn.180218ee0
jmp 0x180219983
cmp edi, 0x12
jne 0x180219965
mov rcx, rsi
call fcn.180218f30
jmp 0x180219983
cmp edi, 0x13
jne 0x180219970
lea r8d, [rdi - 8]
jmp 0x180219979
cmp edi, 0x14
jne 0x180219985
lea r8d, [rdi - 8]
mov dl, 1
mov rcx, rsi
call fcn.18021aaf0
mov ebx, eax
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18021a220
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
test dl, dl
mov esi, 0x49
mov eax, 0x41
cmovne esi, eax
mov edi, r8d
mov rbx, rcx
cmp byte [rcx + 0x410], sil
jne 0x18021a26d
mov edx, 0xc8
mov dword [rcx + 0x458], r8d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1802198e0
lea rdx, str.TYPE__c
movsx r8d, sil
call fcn.1802180c0
test eax, eax
jne 0x18021a28e
mov dword [rbx + 0x458], edi
mov byte [rbx + 0x410], sil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18021a2a0
Capabilities:
Check http status code

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x3ce], 0
je 0x18021a306
cmp qword [rbx + 0x3e0], 0
je 0x18021a306
cmp byte [rcx + 0x3c3], 0
mov eax, 0x41
mov edx, 0x49
cmovne edx, eax
movsx eax, byte [rbx + 0x410]
cmp eax, edx
je 0x18021a306
mov rax, qword [rcx + 0x8820]
mov r8d, reloc.WS2_32.dll_recvfrom
mov dword [rax + 0x18], 1
movzx edx, byte [rcx + 0x3c3]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18021a220
mov rax, qword [rcx + 0x8820]
cmp dword [rax + 0x18], 1
jne 0x18021a342
mov r8, qword [rbx + 0x3e0]
test r8, r8
je 0x18021a342
lea rdx, str.SIZE__s
mov rcx, rbx
call fcn.1802180c0
test eax, eax
jne 0x18021a34a
mov dword [rbx + 0x458], 0x15
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.180218e50
add rsp, 0x20
pop rbx
ret

Function at 0x18021aa00
Capabilities:
Check http status code

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x401], 0
mov rbx, rcx
je 0x18021aa61
mov rax, qword [rcx]
cmp byte [rax + 0x3c1], 0
jne 0x18021aa27
cmp dword [rax + 0x300], 0
je 0x18021aa57
mov r8, qword [rcx + 0x3e0]
test r8, r8
je 0x18021aa57
lea rdx, str.MDTM__s
call fcn.1802180c0
test eax, eax
jne 0x18021aae1
mov dword [rbx + 0x458], 0x10
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.18021a2a0
xor edx, edx
mov dword [rcx + 0x430], edx
mov rax, qword [rcx]
mov ecx, edx
cmp dword [rax + 0x3bc], 2
sete cl
mov dword [rbx + 0x434], ecx
cmp byte [rbx + 0x1a9], dl
je 0x18021aa9d
mov r8, qword [rbx + 0x3c8]
test r8, r8
je 0x18021aa9d
mov dword [rbx + 0x42c], edx
mov rcx, rbx
jmp 0x18021aabc
mov rcx, rbx
cmp dword [rbx + 0x3d8], edx
je 0x18021aadc
mov r8, qword [rbx + 0x3d0]
mov dword [rbx + 0x42c], 1
mov r8, qword [r8]
lea rdx, str.CWD__s
call fcn.1802180c0
test eax, eax
jne 0x18021aae1
mov dword [rbx + 0x458], 0xe
add rsp, 0x20
pop rbx
ret
call fcn.18021a350
add rsp, 0x20
pop rbx
ret
Function at 0x180221410
Capabilities:
Parse pe header

Disassembly:
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x18022142f
lea r8, [0x180000000]
cdqe
mov edx, dword [r8 + rax*4 + 0x221484]
add rdx, r8
jmp rdx
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
movzx eax, cl
ret

Function at 0x1802214f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
movzx r9d, byte [rcx]
mov r11, rdx
mov r10, rcx
test r9b, r9b
je 0x1802215e3
mov qword [rsp + 0x20], rbx
lea rbx, [0x180000000]
movzx edx, byte [r11]
test dl, dl
je 0x1802215de
movsx eax, r9b
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x18022153b
cdqe
mov ecx, dword [rbx + rax*4 + 0x221608]
add rcx, rbx
jmp rcx
mov r9b, 0x41
jmp case.default.0x18022153b
mov r9b, 0x42
jmp case.default.0x18022153b
mov r9b, 0x43
jmp case.default.0x18022153b
mov r9b, 0x44
jmp case.default.0x18022153b
mov r9b, 0x45
jmp case.default.0x18022153b
mov r9b, 0x46
jmp case.default.0x18022153b
mov r9b, 0x47
jmp case.default.0x18022153b
mov r9b, 0x48
jmp case.default.0x18022153b
mov r9b, 0x49
jmp case.default.0x18022153b
mov r9b, 0x4a
jmp case.default.0x18022153b
mov r9b, 0x4b
jmp case.default.0x18022153b
mov r9b, 0x4c
jmp case.default.0x18022153b
mov r9b, 0x4d
jmp case.default.0x18022153b
mov r9b, 0x4e
jmp case.default.0x18022153b
mov r9b, 0x4f
jmp case.default.0x18022153b
mov r9b, 0x50
jmp case.default.0x18022153b
mov r9b, 0x51
jmp case.default.0x18022153b
mov r9b, 0x52
jmp case.default.0x18022153b
mov r9b, 0x53
jmp case.default.0x18022153b
mov r9b, 0x54
jmp case.default.0x18022153b
mov r9b, 0x55
jmp case.default.0x18022153b
mov r9b, 0x56
jmp case.default.0x18022153b
mov r9b, 0x57
jmp case.default.0x18022153b
mov r9b, 0x58
jmp case.default.0x18022153b
mov r9b, 0x59
jmp case.default.0x18022153b
mov r9b, 0x5a
movzx ecx, dl
call fcn.180221410
cmp r9b, al
jne 0x1802215de
movzx r9d, byte [r10 + 1]
inc r10
inc r11
test r9b, r9b
jne 0x180221513
mov rbx, qword [rsp + 0x20]
movzx ecx, byte [r10]
call fcn.180221410
movzx ecx, byte [r11]
movzx r9d, al
call fcn.180221410
xor ecx, ecx
cmp r9b, al
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x180221670
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [rcx]
mov r10, r8
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x180221776
lea rdi, [0x180000000]
nop word [rax + rax]
movzx edx, byte [rbx]
test dl, dl
je 0x180221776
test r10, r10
je 0x18022177b
movsx eax, r9b
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x1802216d0
cdqe
mov ecx, dword [rdi + rax*4 + 0x2217b8]
add rcx, rdi
jmp rcx
mov r9b, 0x41
jmp case.default.0x1802216d0
mov r9b, 0x42
jmp case.default.0x1802216d0
mov r9b, 0x43
jmp case.default.0x1802216d0
mov r9b, 0x44
jmp case.default.0x1802216d0
mov r9b, 0x45
jmp case.default.0x1802216d0
mov r9b, 0x46
jmp case.default.0x1802216d0
mov r9b, 0x47
jmp case.default.0x1802216d0
mov r9b, 0x48
jmp case.default.0x1802216d0
mov r9b, 0x49
jmp case.default.0x1802216d0
mov r9b, 0x4a
jmp case.default.0x1802216d0
mov r9b, 0x4b
jmp case.default.0x1802216d0
mov r9b, 0x4c
jmp case.default.0x1802216d0
mov r9b, 0x4d
jmp case.default.0x1802216d0
mov r9b, 0x4e
jmp case.default.0x1802216d0
mov r9b, 0x4f
jmp case.default.0x1802216d0
mov r9b, 0x50
jmp case.default.0x1802216d0
mov r9b, 0x51
jmp case.default.0x1802216d0
mov r9b, 0x52
jmp case.default.0x1802216d0
mov r9b, 0x53
jmp case.default.0x1802216d0
mov r9b, 0x54
jmp case.default.0x1802216d0
mov r9b, 0x55
jmp case.default.0x1802216d0
mov r9b, 0x56
jmp case.default.0x1802216d0
mov r9b, 0x57
jmp case.default.0x1802216d0
mov r9b, 0x58
jmp case.default.0x1802216d0
mov r9b, 0x59
jmp case.default.0x1802216d0
mov r9b, 0x5a
movzx ecx, dl
call fcn.180221410
cmp r9b, al
jne 0x180221776
movzx r9d, byte [r11 + 1]
inc r11
dec r10
inc rbx
test r9b, r9b
jne 0x1802216a0
test r10, r10
jne 0x18022178b
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx ecx, byte [r11]
call fcn.180221410
movzx ecx, byte [rbx]
movzx r9d, al
call fcn.180221410
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
cmp r9b, al
sete cl
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x180221820
Capabilities:
Parse pe header

Disassembly:
mov r10, rcx
cmp r8, 1
jb 0x1802218f7
sub r10, rdx
lea r11, [0x180000000]
nop word [rax + rax]
movsx r9d, byte [rdx]
lea eax, [r9 - 0x61]
cmp eax, 0x19
ja case.default.0x18022185e
cdqe
mov ecx, dword [r11 + rax*4 + 0x2218fc]
add rcx, r11
jmp rcx
mov r9b, 0x41
jmp case.default.0x18022185e
mov r9b, 0x42
jmp case.default.0x18022185e
mov r9b, 0x43
jmp case.default.0x18022185e
mov r9b, 0x44
jmp case.default.0x18022185e
mov r9b, 0x45
jmp case.default.0x18022185e
mov r9b, 0x46
jmp case.default.0x18022185e
mov r9b, 0x47
jmp case.default.0x18022185e
mov r9b, 0x48
jmp case.default.0x18022185e
mov r9b, 0x49
jmp case.default.0x18022185e
mov r9b, 0x4a
jmp case.default.0x18022185e
mov r9b, 0x4b
jmp case.default.0x18022185e
mov r9b, 0x4c
jmp case.default.0x18022185e
mov r9b, 0x4d
jmp case.default.0x18022185e
mov r9b, 0x4e
jmp case.default.0x18022185e
mov r9b, 0x4f
jmp case.default.0x18022185e
mov r9b, 0x50
jmp case.default.0x18022185e
mov r9b, 0x51
jmp case.default.0x18022185e
mov r9b, 0x52
jmp case.default.0x18022185e
mov r9b, 0x53
jmp case.default.0x18022185e
mov r9b, 0x54
jmp case.default.0x18022185e
mov r9b, 0x55
jmp case.default.0x18022185e
mov r9b, 0x56
jmp case.default.0x18022185e
mov r9b, 0x57
jmp case.default.0x18022185e
mov r9b, 0x58
jmp case.default.0x18022185e
mov r9b, 0x59
jmp case.default.0x18022185e
mov r9b, 0x5a
mov byte [r10 + rdx], r9b
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1802218f7
dec r8
jne 0x180221840
repz ret

Function at 0x180221970
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.MSVCR100.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1802219d7
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1802219d7
lea rcx, [rsp + 0x20]
call qword [case.0x18020c598.1]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227610
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227610
add rsp, 0x148
ret
jmp 0x180221970

Function at 0x180221a00
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.MSVCR100.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1802219d7
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1802219d7
lea rcx, [rsp + 0x20]
call qword [case.0x18020c598.1]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227610
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227610
add rsp, 0x148
ret
jmp 0x180221970
Function at 0x180225b30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rbp, r8
cmp dword [rcx + 8], 2
mov rdi, rdx
sete sil
test sil, sil
je 0x180225b6e
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rdi
call qword [rbx + 0x18]
jmp 0x180225baa
cmp qword [rbx + 0x10], 0
jne 0x180225b95
mov rcx, qword [rcx + 0x10]
lea rdx, [0x18030a8d4]
call qword [sym.imp.MSVCR100.dll_fopen]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x180225b95
or rax, 0xffffffffffffffff
jmp 0x180225bda
mov r9, qword [rbx + 0x10]
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fread]
mov rdi, rax
test rax, rax
je 0x180225bb7
cmp rax, rbp
jbe 0x180225bd7
test sil, sil
jne 0x180225bce
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.MSVCR100.dll_fclose]
mov qword [rbx + 0x10], 0
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1802274d0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
repne scasb al, byte [rdi]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x98badcfe
not rcx
mov dword [rsp + 0x2c], 0x10325476
lea r8, [rcx - 1]
lea rcx, [rsp + 0x20]
call fcn.1802272e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1802273b0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180227610
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret

Function at 0x180227893
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1803c1370]
jne 0x18022762a
rol rcx, 0x10
test cx, 0xffff
jne 0x180227626
repz ret
ror rcx, 0x10
jmp 0x1802277ec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1803dbc20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1803dbd18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180227871
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1803dbc20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180227893
mov rax, qword [rsp + 0x88]
mov qword [0x1803dbd18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1803dbcb8], rax
mov rax, qword [0x1803dbd18]
mov qword [0x1803dbb90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1803dbca0], rax
mov dword [0x1803dbb80], 0xc0000409
mov dword [0x1803dbb84], 1
mov rax, qword [0x1803c1370]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1803c1378]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1803dbc18], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180352090]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1803dbc18], 0
jne 0x18022791a
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18022e330
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x38
cmp dword [0x1803dc298], 0
jne 0x18022e3b2
lea rcx, [0x1803dc0f0]
xor edx, edx
mov r8d, 0x198
mov dword [0x1803dc298], 1
call sub.MSVCR100.dll_memset
lea rdx, [0x1803dc0f0]
mov ecx, 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x18022e3b2
call sub.WS2_32.dll_WSAGetLastError
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 9]
mov r8d, eax
lea ecx, [rdx - 7]
call sym.VBoxRT.dll_ERR_put_error
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x70]
lea r8d, [r9 + 0x7a]
lea ecx, [rdx - 0x50]
call sym.VBoxRT.dll_ERR_put_error
or eax, 0xffffffff
add rsp, 0x38
ret
mov eax, 1
add rsp, 0x38
ret

Function at 0x18022e3f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
movsxd rcx, ecx
call sub.WS2_32.dll_ioctlsocket
mov ebx, eax
test eax, eax
jns 0x18022e425
call sub.WS2_32.dll_WSAGetLastError
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 5]
mov r8d, eax
lea ecx, [rdx - 3]
call sym.VBoxRT.dll_ERR_put_error
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x18022e680
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, 6
lea r9, [rsp + 0x48]
movsxd rcx, ecx
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 4
call sub.WS2_32.dll_setsockopt
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x38
ret

Function at 0x18022e6c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov dword [rsp + 0x40], edx
lea r8, [rsp + 0x40]
movsxd rcx, ecx
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
xor ebx, ebx
mov edi, eax
test eax, eax
jns 0x18022e702
call sub.WS2_32.dll_WSAGetLastError
lea edx, [rbx + 5]
lea ecx, [rbx + 2]
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x20], ebx
call sym.VBoxRT.dll_ERR_put_error
test edi, edi
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret