joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a600
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x48
mov rbp, qword [r8 + 0x10]
xor r14d, r14d
mov r13, r9
mov rdi, r8
mov esi, r14d
mov ebx, r14d
test rbp, rbp
jle 0x14006a65d
nop
test rbx, rbx
js 0x14006a77d
cmp rbx, qword [rdi + 0x10]
jge 0x14006a77d
mov rax, qword [rdi + 8]
lea rcx, [rax + rbx*8]
call qword [sym.imp.mfc110u.dll_Ordinal_5545]
inc esi
inc rbx
add esi, eax
cmp rbx, rbp
jl 0x14006a630
lea eax, [rsi*2 + 2]
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x40], r15
mov ecx, eax
mov dword [rsp + 0x90], eax
mov ebx, eax
call sub.mfc110u.dll_Ordinal_265
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov r15, rax
call sub.MSVCR110.dll_memset
mov r12d, r14d
mov rsi, r14
test rbp, rbp
jle 0x14006a70d
nop dword [rax]
test rsi, rsi
js 0x14006a783
cmp rsi, qword [rdi + 0x10]
jge 0x14006a783
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x30]
lea rdx, [rax + rsi*8]
call qword [sym.imp.mfc110u.dll_Ordinal_280]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc110u.dll_Ordinal_5545]
lea rcx, [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
lea ecx, [rbx + 1]
movsxd rdx, ecx
movsxd rcx, r12d
mov r8, rax
lea rcx, [r15 + rcx*2]
call qword [sym.imp.MSVCR110.dll_wcscpy_s]
lea rcx, [rsp + 0x30]
inc r12d
add r12d, ebx
call qword [sym.imp.mfc110u.dll_Ordinal_1027]
inc rsi
cmp rsi, rbp
jl 0x14006a6a0
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
movsxd rax, r12d
mov word [r15 + rax*2], r14w
mov eax, dword [rsp + 0x90]
mov r9d, 7
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r14b
test r14d, r14d
jne 0x14006a758
test r13, r13
je 0x14006a758
mov dword [r13], eax
mov rcx, r15
call sub.mfc110u.dll_Ordinal_266
mov r12, qword [rsp + 0x98]
mov r15, qword [rsp + 0x40]
mov eax, r14d
add rsp, 0x48
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call sub.mfc110u.dll_Ordinal_2290
int3
call sub.mfc110u.dll_Ordinal_2290
int3
Function at 0x14006abb0
Capabilities:
Continue service

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
mov edx, 3
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x58
ret

Function at 0x14006abf0
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rbx, rcx
mov rcx, qword [rcx]
xor edi, edi
mov rsi, r9
mov rbp, r8
mov r14, rdx
test rcx, rcx
je 0x14006ac29
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbx], rdi
mov rcx, r14
call fcn.14006b0a0
mov edx, dword [rsp + 0xb8]
mov r9d, dword [rsp + 0xa0]
mov rcx, rax
mov rax, qword [rsp + 0xe8]
mov r8, rsi
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0xb0]
mov dword [rsp + 0x28], edx
mov edx, dword [rsp + 0xa8]
mov dword [rsp + 0x20], edx
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea r11, [rsp + 0x70]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
test rax, rax
setne dil
mov qword [rbx], rax
mov rbx, qword [r11 + 0x10]
mov eax, edi
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x14006acf0
Capabilities:
Pause service

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x58
ret

Function at 0x14006ade0
Capabilities:
Stop service

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx]
lea r8, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x58
ret
Function at 0x14006ae20
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, r9d
mov ebx, r8d
mov edi, edx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14]
lea rdx, [rsp + 0x20]
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14006aee5
nop word [rax + rax]
mov ecx, dword [rsp + 0x24]
cmp ecx, ebx
je 0x14006af11
cmp edi, 0xffffffff
jne 0x14006aea4
cmp ebx, 4
jne 0x14006ae90
cmp ecx, 2
je 0x14006aea4
cmp ecx, 5
jmp 0x14006aea2
cmp ebx, 7
jne 0x14006ae9a
cmp ecx, 6
jmp 0x14006aea2
cmp ebx, 1
jne 0x14006aea4
cmp ecx, 3
jne 0x14006aed1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0xffffffff
je 0x14006aebd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, edi
ja 0x14006af0a
mov rcx, qword [r14]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14006ae70
jmp 0x14006aee5
cmp dword [rsp + 0x2c], 0x42a
jne 0x14006aee5
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x41d
jmp 0x14006aedf
mov eax, 1
jmp 0x14006aee7

Function at 0x14006af20
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14006afb7
nop dword [rax]
mov ecx, dword [rsp + 0x24]
cmp ecx, 1
je 0x14006afdd
cmp ebx, 0xffffffff
jne 0x14006af73
cmp ecx, 3
jne 0x14006afa3
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xffffffff
je 0x14006af8f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
ja 0x14006afd6
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14006af60
jmp 0x14006afb7
cmp dword [rsp + 0x2c], 0x42a
jne 0x14006afb7
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x41d
jmp 0x14006afb1
mov eax, 1
jmp 0x14006afb9
Function at 0x14006b0e0
Capabilities:
Enumerate services

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
lea rax, [r11 - 0x24]
mov r15, rcx
mov rcx, qword [rcx]
mov qword [r11 - 0x30], rax
lea rax, [r11 + 8]
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x28]
mov rbp, r9
mov qword [r11 - 0x40], rax
xor r9d, r9d
mov esi, r8d
mov r14d, edx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x44], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov edi, eax
test eax, eax
jne 0x14006b1dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14006b1da
mov ecx, dword [rsp + 0x40]
call sub.mfc110u.dll_Ordinal_265
mov ecx, dword [rsp + 0x40]
mov r8d, esi
mov rdi, rax
lea rax, [rsp + 0x44]
mov edx, r14d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov r9, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov r14d, eax
test eax, eax
je 0x14006b1cd
lea eax, [rbx + 1]
cmp dword [rsp + 0x70], ebx
jbe 0x14006b1cd
mov rsi, qword [rsp + 0x90]
test eax, eax
je 0x14006b1cd
lea rdx, [rbx + rbx*2]
mov rcx, rbp
shl rdx, 4
add rdx, rdi
call rsi
inc ebx
cmp ebx, dword [rsp + 0x70]
jb 0x14006b1b1
mov rcx, rdi
call sub.mfc110u.dll_Ordinal_266
mov eax, r14d
jmp 0x14006b1dc
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14008c9b0
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x100
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov r12, r9
mov r15, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
xor esi, esi
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14008ca41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x50], 2
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x50]
call fcn.1400bb178
mov rcx, rbx
call qword [sym.imp.mfc110u.dll_Ordinal_1632]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x60], rcx
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14007c0b0
nop
mov rcx, qword [rsp + 0x60]
call fcn.1400b9ef0
mov rbx, rax
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x14008ca8a
call qword [sym.imp.MSVCR110.dll_free]
or rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14008ca90
inc rdx
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll__strlwr_s]
xor r9d, r9d
lea r8d, [r9 + 0x10]
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14008caef
test rbx, rbx
je 0x14008cacc
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_free]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x54], 3
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x54]
call fcn.1400bb178
test rbx, rbx
je 0x14008cafd
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_free]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x800000
mov r8, qword [rsp + 0x38]
mov edx, 0x6801
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x14008cb47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x4c], 4
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x4c]
call fcn.1400bb178
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x14008cb8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x48], 6
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x48]
call fcn.1400bb178
nop
jmp 0x14008cb93
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008cbac
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008cbbc
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x100
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x14009a620
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x890
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rsp + 0x880], rax
mov rdi, qword [rcx + 0x10]
lea r14, [rcx + 0x10]
mov rsi, rdx
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x14009a683
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdx, rsi
call qword [sym.imp.MSVCR110.dll__wcsicmp]
test eax, eax
jns 0x14009a677
mov rbx, qword [rbx + 0x10]
jmp 0x14009a67d
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14009a660
cmp rdi, qword [r14]
je 0x14009a6a0
lea rdx, [rdi + 0x20]
mov rcx, rsi
call qword [sym.imp.MSVCR110.dll__wcsicmp]
test eax, eax
js 0x14009a6a0
mov qword [rsp + 0x40], rdi
jmp 0x14009a6a8
mov rax, qword [r14]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x40]
or rdi, 0xffffffffffffffff
mov rbx, qword [rbx]
cmp rbx, qword [r14]
je 0x14009a731
mov rcx, qword [rbx + 0x830]
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], eax
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, edi
jne 0x14009a720
mov rcx, qword [rbx + 0x830]
cmp rcx, rdi
je 0x14009a70e
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + Ordinal_2099], rdi
lea rdx, [rsp + 0x58]
mov r8, rbx
mov rcx, r14
call fcn.140049570
jmp 0x14009a731
mov rax, qword [rbx + 0x830]
cmp rax, 0xffffffffffffffff
jne 0x14009a81d
mov rcx, rsi
mov qword [rsp + 0x8c0], rbp
call fcn.14009db40
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14009a7ea
mov rcx, qword [0x140122018]
mov rbx, qword [rcx + 0x1a8]
mov rcx, rsi
call fcn.14005e250
lea rdx, str.CRemoteToLocalLicenses::GetConnection___:_open_socket_to__s_successful
mov rcx, rbx
mov r8, rax
call fcn.14004c390
lea rax, [rsp + 0x60]
cmp rsi, rax
je 0x14009a7c0
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14009a780
cmp rdi, 0x401
jae 0x14009a7c0
lea rcx, [rsp + 0x60]
mov r8, rsi
mov edx, Ordinal_1027
call qword [sym.imp.MSVCR110.dll_wcscpy_s]
lea r8, [rsi + 0x802]
lea rcx, [rsp + 0x862]
mov edx, 6
call qword [sym.imp.MSVCR110.dll_wcscpy_s]
movzx eax, byte [0x1401229c0]
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x48]
xor r8d, r8d
mov rcx, r14
mov qword [rsp + reloc.mfc110u.dll_Ordinal_2160], rbp
mov byte [rsp + 0x20], al
call fcn.140099ae0
jmp 0x14009a812
mov rax, qword [0x140122018]
mov rcx, rsi
mov rbx, qword [rax + 0x1a8]
call fcn.14005e250
lea rdx, str.CRemoteToLocalLicenses::GetConnection___:_open_socket_to__s_failed
mov r8, rax
mov rcx, rbx
call fcn.14004c390
mov rax, rbp
mov rbp, qword [rsp + 0x8c0]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0x8c8]
add rsp, 0x890
pop r14
pop rdi
pop rsi
ret
Function at 0x14009cfb0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
lea rdx, str.REMOTECALL
mov r8d, 1
add rcx, 0x2e0
call fcn.1400b68f0
mov rax, qword [0x140122018]
lea rcx, [rbp + 0x258]
mov rdi, qword [rax + 0x1a8]
call fcn.1400b42e0
lea rcx, [rbp + 0x4d8]
mov rbx, rax
call fcn.14005e250
lea rdx, str.Routing_Order_to__s:__s
mov r9, rbx
mov rcx, rdi
mov r8, rax
call fcn.14004c390
lea rcx, [rbp + 0x1f8]
call fcn.1400acc60
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_free]
lea rcx, [rbp + 0x258]
call fcn.1400b42e0
lea rcx, [rbp + 0x1f8]
mov rdx, rax
call fcn.1400aca90
mov rcx, qword [0x140122018]
lea rbx, [0x14009ca50]
mov rcx, qword [rcx + 0x1a8]
lea rdx, str.Push_next_function_:_ReadResult__0x_.8X_
mov r8, rbx
call fcn.14004c390
lea rcx, [rbp + 0x498]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
call fcn.14005a080
mov rcx, rbp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.14009d0b0
Function at 0x14009d0b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea rdi, [rcx + 0x1c8]
xor esi, esi
mov r14d, 1
mov rbp, qword [rdi + 0x20]
mov dword [rdi + 0x28], r14d
mov dword [rsp + 0x70], esi
cmp byte [rbp + 0xcec], sil
je 0x14009d14d
mov rax, qword [0x140122018]
mov rbx, qword [rax + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, str.Thread_0x_.4X__CSocketAsync::WriteOrderCompletionRoutine_Error__d___0x_X
mov r8d, eax
mov r9d, r14d
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.14004c390
mov rax, qword [0x140122018]
mov rbx, qword [rax + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, str.Thread_0x_.4X__CSocketAsync::WriteOrderCompletionRoutine___OnBrokenConnection
mov r8d, eax
mov rcx, rbx
call fcn.14004c390
mov byte [rbp + 0xcec], r14b
mov rcx, rbp
mov dword [rdi + 0x28], 0xffffffff
call fcn.140056600
jmp 0x14009d288
mov eax, dword [rdi + 0x2c]
lea rcx, [rdi + 0x30]
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x78], eax
mov eax, dword [rdi + 0x50]
mov dword [rdi + 0xb28], 8
mov dword [rsp + 0x7c], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], r15
mov qword [rdi + Ordinal_2866], rax
mov eax, dword [rdi + 0x50]
mov dword [rdi + 0xb38], eax
call fcn.1400acc60
lea r9, [rsp + 0x70]
mov qword [rdi + 0xb40], rax
mov rcx, qword [rdi + 0x300]
lea rax, [0x14009d2b0]
mov qword [rsp + 0x30], rax
lea rdx, [rdi + 0xb28]
mov r8d, 2
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14009d201
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14009d201
mov rcx, qword [rdi + 0x300]
mov r14d, esi
cmp rcx, 0xffffffffffffffff
je 0x14009d201
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi + 0x300], 0xffffffffffffffff
mov r8d, dword [rdi + 0xb38]
lea rdx, [rdi + 0xb40]
lea rcx, [rdi + 0x30]
call fcn.1400acc00
mov r12, qword [rsp + 0x80]
test r14d, r14d
je 0x14009d22a
inc dword [rdi + 0x28]
jmp 0x14009d280
mov dword [rdi + 0xb28], esi
mov qword [rdi + Ordinal_2866], rsi
mov dword [rdi + 0xb38], esi
mov qword [rdi + 0xb40], rsi
mov dword [rdi + 0x28], 0xffffffff
mov rax, qword [0x140122018]
mov rbx, qword [rax + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, str.Thread_0x_.4X__CSocketAsync::WriteResultCompletionRoutine_2___OnBrokenConnection
mov r8d, eax
mov rcx, rbx
call fcn.14004c390
mov rcx, rbp
mov byte [rbp + 0xcec], 1
call fcn.140056600
mov r15, qword [rsp + 0x88]
cmp dword [rdi + 0x28], 0xffffffff
mov eax, 3
cmove esi, eax
mov eax, esi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009de40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push r12
push r15
sub rsp, 0x38
mov rbx, rcx
mov rcx, rdx
mov r12, rdx
xor r15d, r15d
call fcn.1400acc60
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_free]
mov esi, 4
mov ecx, esi
call qword [sym.imp.MSVCR110.dll_malloc]
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14009de89
mov eax, esi
add rsp, 0x38
pop r15
pop r12
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r14
xor r14b, r14b
mov rdi, rax
xor eax, eax
mov rcx, rsi
rep stosb byte [rdi], al
xor edi, edi
nop word [rax + rax]
mov r8d, esi
mov edx, edi
xor r9d, r9d
add rdx, qword [rsp + 0x70]
sub r8d, edi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov rcx, qword [0x140122018]
lea rdx, str.CSocketSync::ReadResult___rc___d__sum___d_expected___d
mov rcx, qword [rcx + 0x1a8]
mov r9d, edi
mov r8d, eax
mov ebp, eax
mov dword [rsp + 0x20], esi
call fcn.14004c390
cmp ebp, 0xffffffff
je 0x14009df62
add edi, ebp
test ebp, ebp
je 0x14009df57
cmp edi, esi
jne 0x14009deb0
test r14b, r14b
jne 0x14009df45
mov rcx, qword [rsp + 0x70]
mov esi, dword [rcx]
call qword [sym.imp.MSVCR110.dll_free]
mov ecx, esi
call qword [sym.imp.MSVCR110.dll_malloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14009df2a
mov r14b, 1
jmp 0x14009de9b
mov r15d, 4
cmp rbx, 0xffffffffffffffff
je 0x14009df94
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
or rbx, 0xffffffffffffffff
jmp 0x14009df7b
lea rdx, [rsp + 0x70]
mov r8d, esi
mov rcx, r12
call fcn.1400acc00
jmp 0x14009dfcc
mov ecx, 0x2746
call qword [sym.imp.WS2_32.dll_WSASetLastError]
cmp rbx, 0xffffffffffffffff
je 0x14009df75
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
or rbx, 0xffffffffffffffff
mov r15d, 3
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14009df94
call qword [sym.imp.MSVCR110.dll_free]
mov qword [rsp + 0x70], 0
mov rcx, qword [0x140122018]
mov rdi, qword [rcx + 0x1a8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.CSocketSync::ReadResult___SocketError:_0x_.8X___0x_.8X__
mov r8d, eax
mov r9, rbx
mov rcx, rdi
call fcn.14004c390
cmp rbx, 0xffffffffffffffff
je 0x14009dfcc
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov eax, r15d
add rsp, 0x38
pop r15
pop r12
pop rsi
pop rbx
ret
Function at 0x14009dff0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov eax, dword [r8 + 0x20]
xor esi, esi
mov r14, r8
mov qword [r11 - 0x38], rsi
mov dword [r11 + 0x1c], eax
mov ebp, edx
lea rax, [r11 + 0x18]
mov dword [r11 + 0x18], edx
mov dword [rsp + 0x40], 8
mov qword [r11 - 0x40], rsi
lea r9, [r11 + 0x10]
lea r8d, [rsi + 1]
lea rdx, [r11 - 0x28]
mov qword [r11 - 0x20], rax
mov rdi, rcx
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14009e097
mov rax, qword [0x140122018]
mov rbx, qword [rax + 0x1a8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.CSocketSync::WriteOrder___SocketError:_0x_.8X___Order__d____0x_.8X__
mov r8d, eax
mov r9d, ebp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.14004c390
cmp rdi, 0xffffffffffffffff
je 0x14009e08d
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 3
jmp 0x14009e130
mov eax, dword [r14 + 0x20]
mov rcx, r14
mov dword [rsp + 0x40], eax
call fcn.1400acc60
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x40]
mov r8d, 1
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_WSASend]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, r14
mov ebx, eax
call fcn.1400acc00
cmp ebx, 0xffffffff
jne 0x14009e12e
mov rax, qword [0x140122018]
mov rbx, qword [rax + 0x1a8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.CSocketSync::WriteOrder___SocketError:_0x_.8X___Order2__d____0x_.8X__
mov r8d, eax
mov r9d, ebp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.14004c390
cmp rdi, 0xffffffffffffffff
je 0x14009e129
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, 3
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b1990
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
shr ecx, 0x10
mov r11d, r8d
mov r10, rdx
test rdx, rdx
jne 0x1400b19a6
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x1400b1ae0
nop
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jb 0x1400b1a8f
mov r8d, edx
shr r8, 4
nop
movzx eax, byte [r10]
add r10, 0x10
add edx, 0xfffffff0
add r9d, eax
movzx eax, byte [r10 - 0xf]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
add ecx, r9d
dec r8
jne 0x1400b19d0
test edx, edx
je 0x1400b1ab1
nop word [rax + rax]
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
dec edx
jne 0x1400b1aa0
mov eax, 0x80078071
mul r9d
mov eax, 0x80078071
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
test r11d, r11d
jne 0x1400b19b0
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret