joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f70
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], edx
add ecx, 1
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x407832
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x405f70

Function at 0x405fc0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rcx, rdx
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
mov byte [rbp + rax], 0xa
test rbx, rbx
jle 0x406093
lea rax, [rsp + 0x50]
lea r14d, [rdi + 1]
xor esi, esi
lea r13, [rsp + 0x40]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov r15, qword [sym.imp.WS2_32.dll_send]
mov qword [rsp + 0x38], rax
jmp 0x40602b
sub rbx, rax
add rsi, rax
test rbx, rbx
jle 0x406093
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x58], rdi
mov ecx, r14d
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], r13
mov r8, qword [rsp + 0x38]
call r12
test eax, eax
jle 0x4060a0
xor r9d, r9d
lea rdx, [rbp + rsi]
mov r8d, ebx
mov rcx, rdi
call r15
cdqe
test rax, rax
jns 0x406020
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4060a0
xor eax, eax
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x40602b
mov eax, 1
jmp 0x4060a2
xor eax, eax
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x407820
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], edx
add ecx, 1
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x407832
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x405f70
Function at 0x409580
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
mov rbx, r8
mov qword [rsp + 0x40], rcx
mov rcx, rdx
mov rsi, rdx
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rdi, rax
call sub.msvcrt.dll_strlen
lea rcx, [rdi + rax + 0x50]
call sub.msvcrt.dll_malloc
lea rdx, str._id_:_2___method_:__mining.authorize____params_:____s_____s__
mov r9, rbx
mov r8, rsi
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_sprintf
cmp byte [0x007ef090], 0
je 0x4095f0
lea rdx, [0x0065cb28]
mov r8, rbp
mov ecx, 4
call fcn.004060f0
mov rdi, qword [rsp + 0x40]
mov rax, rdi
add rax, 0x130
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.00600c90
mov rdi, qword [rdi + 0x118]
mov rdx, rbp
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x409615
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
cmove rdx, rcx
add al, al
sbb rdx, 3
sub rdx, rbp
lea rbx, [rdx + 1]
mov byte [rbp + rdx], 0xa
test rbx, rbx
jle 0x409700
lea rax, [rsp + 0x60]
lea r14d, [rdi + 1]
xor esi, esi
lea r13, [rsp + 0x50]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov r15, qword [sym.imp.WS2_32.dll_send]
mov qword [rsp + 0x38], rax
jmp 0x40968c
sub rbx, rax
add rsi, rax
test rbx, rbx
jle 0x409700
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x68], rdi
mov ecx, r14d
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x20], r13
mov r8, qword [rsp + 0x38]
call r12
test eax, eax
jle 0x4097d0
xor r9d, r9d
lea rdx, [rbp + rsi]
mov r8d, ebx
mov rcx, rdi
call r15
cdqe
test rax, rax
jns 0x409681
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4097d0
xor eax, eax
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x40968c
nop dword [rax]
mov rcx, qword [rsp + 0x48]
call fcn.006008b0
mov rsi, qword [rsp + 0x40]
jmp 0x409719
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rsi
call fcn.00407840
test rax, rax
mov rbx, rax
je 0x4097da
mov rdx, rax
mov rcx, rsi
call fcn.00408640
test al, al
jne 0x409711
lea rdi, [rsp + 0x60]
mov rcx, rbx
mov rdx, rdi
call fcn.005f9b10
mov rcx, rbx
mov rsi, rax
call sub.msvcrt.dll_free
test rsi, rsi
je 0x4097fa
lea rdx, str.result
mov rcx, rsi
call fcn.005fa400
lea rdx, str.error
mov rbx, rax
mov rcx, rsi
call fcn.005fa400
test rbx, rbx
je 0x40979a
cmp dword [rbx], 6
je 0x40979a
test rax, rax
mov ebx, 1
je 0x4097aa
cmp dword [rax], 7
je 0x4097aa
lea rdx, str.Stratum_authentication_failed
xor ecx, ecx
xor ebx, ebx
call fcn.004060f0
mov rcx, rbp
call sub.msvcrt.dll_free
mov eax, dword [rsi + 4]
cmp eax, 0xffffffff
je 0x4097e4
sub eax, 1
test eax, eax
mov dword [rsi + 4], eax
jne 0x4097e4
mov rcx, rsi
call fcn.005faa90
jmp 0x4097e4
mov rcx, qword [rsp + 0x48]
call fcn.006008b0
mov rcx, rbp
xor ebx, ebx
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, dword [rsp + 0x100]
lea rdx, str.JSON_decode_failed__d_:__s
mov r9, rdi
xor ecx, ecx
call fcn.004060f0
jmp 0x4097da
Function at 0x40b780
Capabilities:
Hash data using sha256

Disassembly:
mov rax, qword [0x0065cfc0]
mov qword [rcx], rax
mov rax, qword [0x0065cfc8]
mov qword [rcx + 8], rax
mov rax, qword [0x0065cfd0]
mov qword [rcx + 0x10], rax
mov rax, qword [0x0065cfd8]
mov qword [rcx + 0x18], rax
ret
Function at 0x449800
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
mov edx, 2
je 0x449830
mov eax, edx
add rsp, 0x1c8
ret
movzx eax, word [rsp + 0x20]
cmp al, 2
je 0x449850
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, 2
mov eax, edx
add rsp, 0x1c8
ret
shr ax, 8
cmp al, 2
jne 0x449839
call fcn.0044cee0
mov edx, eax
jmp 0x449820

Function at 0x4498f0
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
mov edx, dword [0x007ef724]
mov ebx, ecx
lea eax, [rdx + 1]
mov dword [0x007ef724], eax
xor eax, eax
test edx, edx
jne 0x44996c
lea rax, [sub.msvcrt.dll_malloc]
test cl, 1
mov qword [sub.msvcrt.dll_malloc], rax
lea rax, [sub.msvcrt.dll_free]
mov qword [sub.msvcrt.dll_free], rax
lea rax, [sub.msvcrt.dll_realloc]
mov qword [sub.msvcrt.dll_realloc], rax
lea rax, [sub.msvcrt.dll__strdup_1]
mov qword [sub.msvcrt.dll__strdup_1], rax
lea rax, [sub.msvcrt.dll_calloc]
mov qword [sub.msvcrt.dll_calloc], rax
jne 0x4499c0
test bl, 2
je 0x449974
call fcn.00449800
test eax, eax
je 0x449974
mov eax, 2
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_GetACP]
lea rcx, [0x0065d7d6]
mov esi, eax
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4499d0
xor ecx, ecx
call sym.minerd.exe_libssh2_init
test eax, eax
jne 0x449967
test bl, 4
je 0x4499a7
mov dword [0x007ef740], 1
mov dword [0x007ef720], ebx
call fcn.0044f030
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
call fcn.0044a8f0
test eax, eax
jne 0x449959
mov eax, 2
jmp 0x44996c
test esi, esi
je 0x44998d
lea rdi, [rsp + 0x20]
lea r8, str.CHARSETcp_u
mov r9d, esi
mov edx, 0x3c
mov rcx, rdi
call fcn.0044b120
mov rcx, rdi
call sub.msvcrt.dll__putenv
jmp 0x44998d
Function at 0x44d2a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
cmp byte [rcx + 0x299], 0
mov rdi, qword [rcx]
mov rbx, rcx
mov rsi, rdx
jne 0x44d3b0
lea rbp, [rsp + 0x2c]
lea r12, [rsp + 0x30]
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov rcx, rsi
mov r8, rbp
mov rdx, r12
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x44d322
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.0045d930
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.0044ea90
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea r13, [rsp + 0xb0]
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov r8, rbp
mov rcx, rsi
mov rdx, r13
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x44d3d0
lea rdx, [rbx + 0xde]
lea r8, [rbx + 0x10c]
mov rcx, r12
call fcn.0044d080
test al, al
jne 0x44d390
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.0045d930
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.0044ea90
jmp 0x44d312
lea rdx, [rbx + 0x110]
lea r8, [rbx + 0x140]
mov rcx, r13
call fcn.0044d080
test al, al
je 0x44d410
nop word [rax + rax]
mov rcx, rbx
call fcn.0044d1d0
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.0045d930
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.0044ea90
nop
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
mov edx, eax
mov esi, eax
call fcn.0045d930
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov r8d, esi
mov rcx, rdi
call fcn.0044ea90
jmp 0x44d312

Function at 0x44d440
Capabilities:
Check os version
Set socket configuration

Disassembly:
push rdi
push rbx
sub rsp, 0xe8
mov eax, dword [0x007ef760]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
test eax, eax
je 0x44d4e0
cmp eax, 2
je 0x44d4a4
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x44d4b0
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jle 0x44d4b0
add rsp, 0xe8
pop rbx
pop rdi
ret
lea r9, [rsp + 0x34]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0xe8
pop rbx
pop rdi
ret
lea rdx, [rsp + 0x40]
xor eax, eax
mov ecx, 0x12
mov dword [0x007ef760], 1
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rsp + 0x40], 0x94
mov rcx, rdx
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x44d530
cmp dword [rsp + 0x44], 5
jbe 0x44d530
mov dword [0x007ef760], 2
jmp 0x44d4a4
mov eax, dword [0x007ef760]
jmp 0x44d46e
Function at 0x44d540
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [rcx + 0x7a0]
mov rax, 0xffffffffffffffff
mov rbx, rcx
mov rdi, rdx
test rsi, rsi
je 0x44d5a4
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x44d5a4
mov rcx, qword [rcx + 0xb8]
lea rdx, [rsp + 0x30]
lea r8, [0x0044cfe0]
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x38], 0
call fcn.0045ece0
cmp byte [rsp + 0x38], 0
jne 0x44d5b0
mov qword [rbx + 0x7a0], 0
mov rax, 0xffffffffffffffff
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x44d5b8
mov qword [rdi], rsi
cmp byte [rsi + 0x1c8], 0
mov rbx, qword [rsi + 0x190]
je 0x44d5e0
mov rcx, rsi
call fcn.0044af80
test eax, eax
je 0x44d59d
mov rax, rbx
jmp 0x44d5a4
lea rdx, [rsp + 0x2f]
mov r9d, 2
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x44d59d
jmp 0x44d5d4
Function at 0x44e5c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x240]
mov rbx, rcx
mov rdi, r8
mov rbp, r9
test rax, rax
je 0x44e600
mov rcx, qword [rcx + 0x198]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call rax
mov esi, eax
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor esi, esi
cmp edx, 2
ja 0x44e5f0
mov r10d, edx
mov r9, qword [rbx + 0x190]
lea rax, [0x0065e0c0]
lea rcx, [r10 + r10*2]
mov r8d, 1
mov edx, 2
add rcx, rax
call sub.msvcrt.dll_fwrite
mov r9, qword [rbx + 0x190]
mov r8d, 1
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_fwrite
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x44e6e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rax, 0xffffffffffffffff
je 0x44e704
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov eax, 0x51
cmp edx, 0x2733
mov edx, 0x38
cmovne eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x44eb50
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x70]
mov rax, r8
movsxd rdx, edx
mov r8, r9
mov rsi, rcx
xor r9d, r9d
mov rcx, qword [rcx + rdx*8 + 0x190]
mov rdx, rax
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rdi], 0
cmp rbx, 0xffffffffffffffff
je 0x44eba0
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebp, eax
je 0x44ebf0
mov rcx, rsi
mov edx, eax
call fcn.0045d930
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.0044ea90
mov rax, qword [rsi]
mov dword [rax + 0x880c], ebp
mov rax, rbx
mov dword [rdi], 0x37
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rdi], 0x51
xor ebx, ebx
jmp 0x44eb8c
Function at 0x45a530
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x490], 0
mov rsi, rcx
mov r12d, edx
je 0x45a6a5
cmp qword [rcx + 0x668], 0
je 0x45a55f
call fcn.00459fb0
mov r8d, 2
mov edx, 2
mov rcx, rsi
call fcn.0045ce90
mov rbx, qword [rsi + 0x678]
mov rdi, qword [rsi + 0x490]
test rbx, rbx
je 0x45a58c
mov ecx, dword [rbx + 0x14]
test ecx, ecx
jne 0x45a5c5
test r12d, r12d
je 0x45a5ac
mov rax, qword [rsi + 0x28]
mov rcx, qword [rsi + 0x678]
test rax, rax
je 0x45a5a7
cmp rcx, qword [rax + 0x28]
je 0x45a5ac
call fcn.0045a430
mov edx, 2
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.0045cee0
lea rcx, [0x0065ede5]
mov rdx, rdi
call fcn.0047a1d0
test eax, eax
jne 0x45a690
lea rdx, [0x0065edf5]
mov rcx, rdi
call sub.msvcrt.dll_fopen
test rax, rax
mov rbp, rax
je 0x45a66f
xor r13d, r13d
lea rcx, str._Netscape_HTTP_Cookie_File_n_http:__curl.haxx.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
mov r9, rbp
mov r8d, 0x87
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbx]
test rbx, rbx
jne 0x45a647
jmp 0x45a6e0
lea rdx, [0x0065ee99]
mov r8, rax
mov rcx, rbp
call fcn.0044c620
mov rcx, rdi
call qword [sub.msvcrt.dll_free]
mov rbx, qword [rbx]
test rbx, rbx
je 0x45a6e0
mov rcx, rbx
call fcn.00459100
test rax, rax
mov rdi, rax
jne 0x45a620
lea rdx, str._n_Fatal_libcurl_error_n
mov rcx, rbp
call fcn.0044c620
test r13b, r13b
je 0x45a700
mov r8, qword [rsi + 0x490]
lea rdx, str.WARNING:_failed_to_save_cookies_in__s_n
mov rcx, rsi
call fcn.0044e9e0
jmp 0x45a58c
call qword [sym.imp.msvcrt.dll___iob_func]
mov r13d, 1
lea rbp, [rax + 0x30]
jmp 0x45a5f6
test edx, edx
je 0x45a6c5
mov rcx, qword [rcx + 0x668]
test rcx, rcx
je 0x45a6c5
call fcn.0044a5d0
mov qword [rsi + 0x668], 0
mov r8d, 2
mov edx, 2
mov rcx, rsi
call fcn.0045ce90
jmp 0x45a58c
test r13b, r13b
jne 0x45a58c
mov rcx, rbp
nop dword [rax]
call sub.msvcrt.dll_fclose
jmp 0x45a58c
mov rcx, rbp
call sub.msvcrt.dll_fclose
jmp 0x45a66f
Function at 0x45ed90
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [rsp + 0x2c]
test edx, edx
mov edx, 0x8004667e
setne al
mov dword [rsp + 0x2c], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x45f270
Capabilities:
Resolve dns

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov qword [r9], 0
mov r13, r9
lea r9, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov r12d, eax
jne 0x45f3b3
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x45f3fc
xor ebp, ebp
xor edi, edi
jmp 0x45f2c9
cmp edx, 0x17
mov esi, 0x1c
je 0x45f2d6
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x45f395
mov edx, dword [rbx + 4]
cmp edx, 2
jne 0x45f2b2
mov esi, 0x10
cmp qword [rbx + 0x20], 0
je 0x45f2bc
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x45f2bc
cmp rsi, rdx
ja 0x45f2bc
mov ecx, 0x30
call qword [sub.msvcrt.dll_malloc]
test rax, rax
mov r14, rax
je 0x45f3f4
mov eax, dword [rbx]
mov rcx, rsi
mov dword [r14], eax
mov eax, dword [rbx + 4]
mov dword [r14 + 4], eax
mov eax, dword [rbx + 8]
mov dword [r14 + 8], eax
mov eax, dword [rbx + 0xc]
mov dword [r14 + 0x10], esi
mov qword [r14 + 0x20], 0
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x28], 0
mov dword [r14 + 0xc], eax
call qword [sub.msvcrt.dll_malloc]
test rax, rax
mov qword [r14 + 0x20], rax
je 0x45f3e3
mov rdx, qword [rbx + 0x20]
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x45f375
call qword [sub.msvcrt.dll__strdup_1]
test rax, rax
mov qword [r14 + 0x18], rax
je 0x45f3d9
test rdi, rdi
cmove rdi, r14
test rbp, rbp
je 0x45f3d1
mov rbx, qword [rbx + 0x28]
mov qword [rbp + 0x28], r14
mov rbp, r14
test rbx, rbx
jne 0x45f2c9
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x45f3a5
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
jne 0x45f3c5
test rdi, rdi
je 0x45f3fc
mov qword [r13], rdi
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdi
xor edi, edi
call fcn.0045f220
jmp 0x45f3af
mov rbp, r14
jmp 0x45f2bc
mov rcx, qword [r14 + 0x20]
call qword [sub.msvcrt.dll_free]
mov rcx, r14
mov r12d, 8
call qword [sub.msvcrt.dll_free]
jmp 0x45f395
mov r12d, 8
jmp 0x45f395
mov ecx, 0x2af9
mov r12d, 0x2af9
xor edi, edi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
jmp 0x45f3af
Function at 0x465610
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
mov rsi, qword [rcx + 0x198]
mov rdi, qword [rcx]
lea r12, [rsp + 0x2c]
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov r8, r12
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x465680
mov rdx, rsi
mov rcx, rbx
call fcn.0044d600
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.0044ea90
mov eax, 0x1e
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rbp
mov r8, r12
mov rcx, rsi
mov dword [rsp + 0x2c], pe_nt_image_headers64
call qword [sym.imp.WS2_32.dll_accept]
mov rdx, rsi
mov rbp, rax
mov rcx, rbx
call fcn.0044d600
cmp rbp, 0xffffffffffffffff
je 0x46565a
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.0044e9e0
mov qword [rbx + 0x198], rbp
mov edx, 1
mov rcx, rbp
call fcn.0045ed90
mov rax, qword [rdi + 0x250]
mov byte [rbx + 0x1a1], 1
test rax, rax
je 0x4656f7
mov rcx, qword [rdi + 0x258]
mov r8d, 1
mov rdx, rbp
call rax
test eax, eax
jne 0x465710
xor eax, eax
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, rbp
mov rcx, rbx
call fcn.0044d600
mov eax, 0x2a
mov qword [rbx + 0x198], 0xffffffffffffffff
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4666b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dl, 1
mov rsi, rcx
mov edi, r8d
sbb ebx, ebx
and ebx, 8
add ebx, 0x41
cmp bl, byte [rcx + 0x628]
je 0x466700
lea rcx, [rcx + 0x590]
lea rdx, str.TYPE__c
movsx r8d, bl
call fcn.00483070
test eax, eax
jne 0x4666f7
mov dword [rsi + 0x638], edi
mov byte [rsi + 0x628], bl
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, r8d
mov dword [rsi + 0x638], r8d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.00466c30

Function at 0x466720
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, qword [rcx]
cmp byte [rax + 0x43f], 0
mov r8, qword [rax + 0x91d8]
je 0x466770
cmp qword [rcx + 0x610], 0
je 0x466770
movzx edx, byte [rax + 0x433]
movsx r9d, byte [rcx + 0x628]
cmp dl, 1
sbb eax, eax
and eax, 8
add eax, 0x41
cmp r9d, eax
je 0x466770
mov dword [r8 + 0x18], 1
mov r8d, 0x13
jmp fcn.004666b0
jmp 0x466bd0
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rax, qword [rax + 0x91d8]
cmp dword [rax + 0x18], 1
je 0x466bf5
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00466b70
mov r8, qword [rcx + 0x610]
test r8, r8
je 0x466be8
lea rcx, [rcx + 0x590]
lea rdx, str.SIZE__s
call fcn.00483070
test eax, eax
jne 0x466c22
mov dword [rbx + 0x638], 0x17
add rsp, 0x20
pop rbx
ret
Function at 0x466780
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
cmp byte [rax + 0x431], 0
jne 0x46679e
mov eax, dword [rax + 0x348]
test eax, eax
je 0x4667d1
mov r8, qword [rbx + 0x610]
test r8, r8
je 0x4667d1
lea rcx, [rbx + 0x590]
lea rdx, str.MDTM__s
call fcn.00483070
test eax, eax
jne 0x4667cb
mov dword [rbx + 0x638], 0x12
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.00466720

Function at 0x4667e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp esi, 0xd
mov r8, qword [rcx + 0x91d8]
jb 0x466894
cmp esi, 0xe
jbe 0x466950
cmp esi, 0xf
jne 0x466894
mov rax, qword [rcx + 0x310]
test dl, dl
je 0x4668a3
test rax, rax
mov dword [rbx + 0x62c], 0
je 0x4668b3
mov r9d, dword [rbx + 0x62c]
test r9d, r9d
jle 0x466859
xor edx, edx
jmp 0x466848
test rax, rax
je 0x4668b3
add edx, 1
mov rax, qword [rax + 8]
cmp edx, r9d
jne 0x466843
test rax, rax
je 0x4668b3
mov r8, qword [rax]
cmp byte [r8], 0x2a
je 0x466960
mov dword [rbx + 0x630], 0
lea rcx, [rbx + 0x590]
lea rdx, [0x00661fbf]
call fcn.00483070
test eax, eax
jne 0x46688d
mov dword [rbx + 0x638], esi
add rsp, 0x28
pop rbx
pop rsi
ret
test dl, dl
mov rax, qword [rcx + 0x308]
jne 0x466820
add dword [rbx + 0x62c], 1
test rax, rax
jne 0x466833
cmp esi, 0xe
je 0x4669c0
cmp esi, 0xf
je 0x4669b0
cmp esi, 0xd
je 0x466973
cmp byte [rbx + 0x61a], 0
jne 0x466a1b
xor eax, eax
cmp dword [rcx + 0x41c], 2
mov dword [rbx + 0x630], 0
sete al
cmp byte [rbx + 0x299], 0
mov dword [rbx + 0x634], eax
jne 0x4669e1
mov eax, dword [rbx + 0x608]
test eax, eax
je 0x466a1b
mov rax, qword [rbx + 0x600]
lea rcx, [rbx + 0x590]
lea rdx, str.CWD__s
mov dword [rbx + 0x62c], 1
mov r8, qword [rax]
call fcn.00483070
test eax, eax
jne 0x46688d
mov dword [rbx + 0x638], 0x10
jmp 0x46688d
mov rax, qword [rcx + 0x318]
jmp 0x466818
add r8, 1
mov dword [rbx + 0x630], 1
jmp 0x466870
mov eax, dword [r8 + 0x18]
test eax, eax
jne 0x4669d0
mov rdx, qword [rbx + 0x650]
cmp rdx, 0xffffffffffffffff
je 0x466a29
call fcn.0045c430
mov rdx, qword [rbx + 0x650]
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00464740
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
xor edx, edx
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.004649f0
mov dword [rbx + 0x638], 0
xor eax, eax
jmp 0x46688d
mov r8, qword [rbx + 0x5f8]
test r8, r8
je 0x466904
lea rcx, [rbx + 0x590]
lea rdx, str.CWD__s
mov dword [rbx + 0x62c], 0
call fcn.00483070
test eax, eax
je 0x466941
jmp 0x46688d
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00466780
mov r8, qword [rbx + 0x610]
lea rcx, [rbx + 0x590]
lea rdx, str.SIZE__s
call fcn.00483070
test eax, eax
jne 0x46688d
mov dword [rbx + 0x638], 0x18
jmp 0x46688d