joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r13, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140031303
movzx eax, word [r12 + rbx*2]
mov rdx, r13
mov ecx, dword [r15 + rbx*4]
add rcx, rsi
mov ebp, dword [r14 + rax*4]
add rbp, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140031322
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x1400312dc
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbp
jmp 0x140031305

Function at 0x140031330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r10, rdx
mov r9, rcx
test rcx, rcx
je 0x1400313b1
test rdx, rdx
je 0x1400313b1
movsxd rax, dword [rcx + 0x3c]
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov edx, dword [r8 + 0x20]
add rdi, rcx
mov esi, dword [r8 + 0x24]
add rdx, rcx
mov ebp, dword [r8 + 0x18]
add rsi, rcx
xor ecx, ecx
test ebp, ebp
je 0x1400313b1
mov eax, dword [rdx]
mov rbx, r10
add rax, r9
sub rbx, rax
movzx r8d, byte [rax]
movzx r11d, byte [rax + rbx]
sub r8d, r11d
jne 0x1400313a2
inc rax
test r11d, r11d
jne 0x14003138c
test r8d, r8d
je 0x1400313c8
inc ecx
add rdx, 4
cmp ecx, ebp
jb 0x140031381
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rsi + rcx*2]
mov eax, dword [rdi + rcx*4]
add rax, r9
jmp 0x1400313b3
Function at 0x14000a870
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x14000a880
mov byte [rcx + 0xd], r10b
ret
Function at 0x1400108d0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x70
mov rax, qword [0x14016d408]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbp, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [0x14012ca00]
xor r8d, r8d
lea r9, [rsp + 0x38]
xor edx, edx
xor r14d, r14d
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x1400109ef
mov rax, qword [rsp + 0x38]
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
mov rdi, rbx
cmp word [rax + rdi*2 + 2], r14w
lea rdi, [rdi + 1]
jne 0x140010931
lea rdi, [rdi*2 + 2]
mov qword [rsp + 0x40], r14
mov rcx, rdi
call fcn.1400e11b0
mov r9, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov rsi, rax
call fcn.1400e98c0
mov rdi, qword [rsp + 0xa0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], r14b
jne 0x140010990
mov r8, rbx
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.140007bd0
mov rcx, rsi
call fcn.1400e117c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movups xmm0, xmmword [rsp + 0x48]
mov rsi, qword [rsp + 0x98]
mov rax, rbp
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400e0e00
add rsp, 0x70
pop r14
pop rbp
pop rbx
ret
mov rcx, 0xffffffffffffffff
call fcn.1400e7c80
int3
Function at 0x140011200
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14016d408]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140011260
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140007bd0
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e0e00
add rsp, 0x150
pop rbx
ret
Function at 0x1400186c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x14016d408]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, rcx
mov qword [rbp - 0x80], rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x138
lea rcx, [rbp - 0x50]
call fcn.1400e3690
mov byte [rsp + 0x20], 0x75
mov byte [rsp + 0x21], 0x81
mov byte [rsp + 0x22], 0x81
mov byte [rsp + 0x23], 0x7d
mov byte [rsp + 0x24], 0x80
mov byte [rsp + 0x25], 0x47
mov byte [rsp + 0x26], 0x3c
mov byte [rsp + 0x27], 0x3c
mov byte [rsp + 0x28], 0x7a
mov byte [rsp + 0x29], 0x86
mov byte [rsp + 0x2a], WSAStartup
mov byte [rsp + 0x2b], 0x85
mov byte [rsp + 0x2c], 0x81
mov byte [rsp + 0x2d], WSAStartup
mov byte [rsp + 0x2e], 0x7f
mov byte [rsp + 0x2f], 0x7b
mov byte [rsp + 0x30], WSASetLastError
mov byte [rsp + 0x31], 0x79
mov byte [rsp + 0x32], 0x76
mov byte [rsp + 0x33], 0x7d
mov byte [rsp + 0x34], 0x3b
mov byte [rsp + 0x35], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x36], 0x7c
mov byte [rsp + 0x37], 0x7a
mov byte [rsp + 0x38], 0x3c
mov byte [rsp + 0x39], 0x7f
mov byte [rsp + 0x3a], WSASetLastError
mov byte [rsp + 0x3b], 0x84
mov byte [rsp + 0x3c], bl
movzx eax, byte [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rsp + rbx + 0x20]
sub al, 0xd
mov byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x1c
jb 0x1400187a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400187d1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140007bd0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.1400183a0
mov rbx, rax
xor edx, edx
mov r8d, 0x298
lea rcx, [rbp + 0xf0]
call fcn.1400e3690
lea rcx, [rbp + 0xf0]
call fcn.140090bd0
nop
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.140091f10
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xf0]
call fcn.140091410
nop
lea rcx, [rbp + 0xf0]
call fcn.140019280
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140018898
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018893
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001892d
call fcn.1400e117c
movdqa xmm0, xmmword [0x1401534e0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
lea r9, [fcn.1400070e0]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x60]
call fcn.1400e0e5c
mov r8, qword [rbp - 0x28]
test r8, r8
je 0x140018933
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rcx, qword [rbp - 0x38]
cmp r8, 1
jne 0x1400188f0
lea rdx, [0x140152bf0]
call fcn.1400e3d60
test eax, eax
je 0x140018933
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.140007290
nop
lea rcx, [rbp - 0x50]
call fcn.140018940
mov rax, rdi
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400e0e00
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400e82e4
nop
mov ecx, 0xffffffff
call fcn.1400e7c80
int3
Function at 0x14001c170
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x29
jb 0x14001c180
mov byte [rcx + 0x2d], 0
ret

Function at 0x140022380
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 9
jb 0x140022390
mov byte [rcx + 0xd], 0
ret

Function at 0x1400223e0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 4
jb 0x1400223f0
mov byte [rcx + 8], 0
ret

Function at 0x140022410
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xc
jb 0x140022420
mov byte [rcx + 0x10], 0
ret

Function at 0x140022470
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, socket
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140022480
mov byte [rcx + 0x1a], r10b
ret

Function at 0x1400224a0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, reloc.WS2_32.dll_listen
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x1400224b0
mov byte [rcx + 0x11], r10b
ret

Function at 0x1400224d0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x16
jb 0x1400224e0
mov byte [rcx + 0x1a], 0
ret

Function at 0x140022560
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x24
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140022570
mov byte [rcx + 0x28], r10b
ret

Function at 0x140022590
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x13
jb 0x1400225a0
mov byte [rcx + 0x17], 0
ret

Function at 0x1400225c0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x24
jb 0x1400225d0
mov byte [rcx + 0x28], 0
ret
Function at 0x1400225f0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, reloc.WS2_32.dll_select
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140022600
mov byte [rcx + 0x16], r10b
ret

Function at 0x140023a70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140023ad1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140023a90
mov ecx, dword [r9]
jmp 0x140023bb8
cmp ecx, 0x4e0
jb 0x140023bb8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140023af0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140023b40
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14002cc70
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14002cc92
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14002cd0c
mov rdi, r14
mov rcx, rbx
call fcn.1400131e0
test rax, rax
jle 0x14002cce4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400e2ff0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002ccfc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x14002cd04
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14002cca6
sub r14, rdi
jmp 0x14002cdef
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002cd23
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002cd25
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002cd57
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400e2ff0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14002cdec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002cd92
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14002cdcd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400ec790
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14002cdec
cmp rbp, rax
ja 0x14002cda0
test rbp, rbp
je 0x14002cdec
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400ec790
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x14002e6a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14002e6d4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14002e6c0
ret
Function at 0x140033ce0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140033dac
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140033dac
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140033dc5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140033d9c
cmp byte [rax], 0x5c
jne 0x140033d96
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140033d96
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140033d82
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140033d93
test r8b, 0x10
jne 0x140033d96
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140033d96
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400304e0
test edi, edi
jne 0x140033d00
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400304d0
int3
Function at 0x14004b1e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x14004b222
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14004b3c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x14016d408]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x218]
mov r14, qword [rcx + r8*8 + 0x1d0]
add rbx, rax
mov rax, qword [rcx + 0x3e8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x14004b4ca
lea rax, [0x14004b270]
cmp qword [rcx + r8*8 + 0x1f8], rax
jne 0x14004b4ca
cmp qword [rbx], 0
je 0x14004b451
test rdi, rdi
je 0x14004b4ca
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.14005ea30
cmp eax, 0xffffffff
je 0x14004b4ca
test al, 1
je 0x14004b4ca
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14004b4a9
mov eax, dword [rbp + 0x6ec]
lea ecx, [rax + rax]
mov qword [rbx + 8], rcx
call qword [section..data]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x14004b504
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x14004b4ca
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x14004b543
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x14004b513
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x14004b543
mov dword [rsi], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x14004b546
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.140060e10
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.14004afd0
mov dword [rbp + 0xd94], edi
mov dword [rsi], gethostname
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400e0e00
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14004ba60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x268], 0
je 0x14004ba7d
call fcn.140044760
test eax, eax
je 0x14004baa9
mov al, 1
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1d0]
cmp rcx, 0xffffffffffffffff
je 0x14004baa9
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14004bcf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x14016d408]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14004bda3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140060e10
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.14004afd0
jmp 0x14004be6b
movzx ecx, word [rsp + 0x30]
mov edx, ecx
sub edx, 1
je 0x14004be40
sub edx, 1
je 0x14004bdea
cmp edx, 0x15
jne 0x14004bdf1
lea rdx, [rsp + 0x38]
mov r8, rbx
mov r9d, 0x2e
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x14004bdf1
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
jmp 0x14004be6b
lea rdx, [rsp + 0x34]
jmp 0x14004bdc2
mov byte [rbx], 0
mov dword [rdi], 0
call fcn.1400fa834
mov dword [rax], 0x273f
call fcn.1400fa834
mov ebx, dword [rax]
call fcn.1400fa834
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140060e10
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.14004afd0
jmp 0x14004be6b
cmp dword [rsp + 0x20], 2
jle 0x14004be62
lea r9, [rsp + 0x32]
mov edx, 0x2e
lea r8, [0x14012cb90]
mov rcx, rbx
call fcn.140037d00
jmp 0x14004be65
mov byte [rbx], 0
mov dword [rdi], 0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400e0e00
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004c7a0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x140173e40]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x14004c804
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.14007d380
test al, al
je 0x14004c7f8
mov dword [0x140173e40], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x140173e40], 1
jmp 0x14004c809
cmp eax, 2
je 0x14004c85b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14004c83a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x14004c85b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret