joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401017e0
Capabilities:
Power down monitor

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rsp + 0x70], 0
mov rax, r9
mov rbx, rcx
jne 0x140101998
cmp r8d, 1
jne 0x1401018b1
xor r9d, r9d
mov dword [rsp + 0x70], r8d
xor r8d, r8d
lea edx, [r9 + 1]
lea ecx, [rdx + 0x55]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, VarUI4FromDisp
mov r9d, 1
mov r8d, 0xf170
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rcx, str.User32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetWindowDisplayAffinity
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140101878
mov rcx, qword [rbx + 8]
mov edx, reloc.WS2_32.dll_recvfrom
call rax
mov rcx, qword [rbx + 8]
mov edx, 2
lea r9d, [rdx + 0x19]
lea r8d, [rdx + 6]
call qword [sym.imp.USER32.dll_RegisterHotKey]
cmp dword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rcx], 0
je 0x140101998
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp r8d, 2
jne 0x14010191f
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x56]
mov dword [rsp + 0x70], 1
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
or r9, 0xffffffffffffffff
mov edx, VarUI4FromDisp
mov r8d, 0xf170
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
mov edx, 2
call qword [sym.imp.USER32.dll_UnregisterHotKey]
cmp dword [rsp + 0x70], 0
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
je 0x140101998
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp r8d, 0x312
jne 0x140101969
mov r9, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
mov r8, rax
mov qword [rsp + 0x20], rcx
mov edx, 0x312
mov rcx, rbx
mov dword [rsp + 0x70], 1
call fcn.1400df1d0
cmp dword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
je 0x140101998
mov eax, 1
add rsp, 0x30
pop rbx
ret
cmp r8d, 0x14
jne 0x140101998
mov r9, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
mov r8, rax
mov qword [rsp + 0x20], rcx
mov edx, reloc.WS2_32.dll_sendto
mov rcx, rbx
mov dword [rsp + 0x70], 1
call fcn.1400de6b0
jmp 0x14010194f
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140102300
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rsi
push r12
push r14
sub rsp, 0x60
mov r14, rcx
mov ecx, 0x45
mov r12d, edx
mov dword [rax - 0x48], 0x14
mov dword [rax - 0x44], 0xa2
mov dword [rax - 0x40], 0xa0
mov dword [rax - 0x3c], 0xa4
mov dword [rax - 0x38], 0xa3
mov dword [rax - 0x34], 0xa1
mov dword [rax - 0x30], 0xa5
mov dword [rax - 0x2c], 0x5b
call fcn.1401e3610
mov rsi, rax
test rax, rax
je 0x1401024a7
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbp
mov dword [rsi + 0x18], 0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x58], r13
lea r13, [rsi + 0x34]
mov edi, 1
lea rax, vtable.TBufferImpl_class_TBufferAlloc__20_.0
mov qword [rsp + 0x50], r15
mov qword [rsi], rax
mov dword [rsi + 0x1c], edi
mov qword [rsi + 8], r13
mov dword [rsi + 0x10], reloc.WS2_32.dll_recvfrom
lea rbp, [rsp + 0x30]
lea r15d, [rdi + 7]
mov byte [r13], reloc.WS2_32.dll_recvfrom
nop dword [rax + rax]
mov ebx, dword [rbp]
cmp ebx, 0xa2
je 0x140102414
cmp ebx, 0xa3
je 0x140102414
cmp ebx, 0x11
je 0x140102414
cmp ebx, 0xa0
je 0x14010240d
cmp ebx, 0xa1
je 0x14010240d
cmp ebx, 0x10
je 0x14010240d
cmp ebx, 0xa4
je 0x140102406
cmp ebx, 0xa5
je 0x140102406
cmp ebx, 0x12
je 0x140102406
mov ecx, ebx
jmp 0x140102419
mov ecx, reloc.WS2_32.dll_select
jmp 0x140102419
mov ecx, reloc.WS2_32.dll_recv
jmp 0x140102419
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
cmp ebx, 0x14
jne 0x14010242f
movsx ecx, cl
and ecx, 1
jmp 0x140102435
shr ecx, 0xf
and ecx, 1
mov eax, edi
inc edi
add rbp, 4
mov byte [rax + r13], bl
mov byte [rdi + r13], cl
inc edi
sub r15, 1
jne 0x1401023c0
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
test r12d, r12d
jne 0x14010247f
mov r12d, dword [r14 + 0x360]
mov rcx, qword [r14 + 8]
mov r9d, 3
mov r8, rsi
mov rax, qword [rcx]
mov edx, r12d
mov dword [rsp + 0x20], 0
call qword [rax + reloc.WS2_32.dll_recv]
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + reloc.WS2_32.dll_htonl]
add rsp, 0x60
pop r14
pop r12
pop rsi
ret
Function at 0x140102980
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
mov esi, ecx
xor ecx, ecx
mov r12, rdx
xor edi, edi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140102b6b
mov ecx, esi
mov qword [rsp + 0x58], rbp
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x140102b60
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rbx, rax
cmp rax, r12
jae 0x140102b5b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
test rax, rax
je 0x140102b5b
mov qword [rsp + 0x68], r13
cmp esi, 1
jne 0x140102aa2
lea rcx, [rbx + 1]
mov eax, 2
mov r13, 0xffffffffffffffff
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1401e3608
lea ecx, [rbx + 1]
mov r9d, ebx
mov dword [rsp + 0x28], ecx
mov r8, r12
xor edx, edx
xor ecx, ecx
mov rsi, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsi + rbx*2], di
mov rbx, rdi
test rsi, rsi
je 0x140102a4b
mov rcx, rsi
call fcn.1400019d0
mov rbx, rax
mov rcx, rsi
call fcn.1401e3600
xor eax, eax
mov rcx, r13
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
inc ecx
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je 0x140102a8c
mov rcx, qword [rax + 8]
mov rdx, rbx
mov byte [rcx], reloc.WS2_32.dll_ntohl
mov r8d, dword [rax + 0x10]
mov rcx, qword [rax + 8]
dec r8d
inc rcx
call fcn.1401e3ed0
test rbx, rbx
je 0x140102b4d
mov rcx, rbx
call fcn.1401e36c8
jmp 0x140102b4d
shr rbx, 1
je 0x140102b4d
lea rcx, [rsp + 0x60]
mov r9d, ebx
xor r8d, r8d
mov rdx, rax
call fcn.140102850
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140102ad0
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140102ad3
mov rcx, rdi
mov rsi, rdi
test rcx, rcx
je 0x140102ae3
call fcn.1400019d0
mov rsi, rax
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
inc ecx
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je 0x140102b1d
mov rax, qword [rax + 8]
mov rdx, rsi
mov byte [rax], reloc.WS2_32.dll_ntohl
mov r8d, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
dec r8d
inc rcx
call fcn.1401e3ed0
test rsi, rsi
je 0x140102b2a
mov rcx, rsi
call fcn.1401e36c8
test rbx, rbx
je 0x140102b4d
dec dword [rbx + 0x10]
cmp dword [rbx + 0x10], 0
jg 0x140102b4d
mov rcx, qword [rbx]
test rcx, rcx
je 0x140102b45
call fcn.1401e36c8
mov rcx, rbx
call fcn.1401e32b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r13, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140104b00
Capabilities:
Create directory
Create process on windows
Get file size
Move file
Read file on windows
Shutdown system

Disassembly:
sub rcx, 0xb0
jmp method.TShareApe.6.virtual_8
Function at 0x1401077c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov rdx, rcx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r11d, eax
test eax, eax
je 0x140107844
lea edx, [rbx - 0x14]
cmp r11d, edx
jae 0x140107844
test eax, eax
je 0x140107804
lea ecx, [r11 - 1]
cmp byte [rcx + rdi], 0x5c
je 0x140107804
mov byte [r11 + rdi], 0x5c
inc r11d
mov byte [r11 + rdi], 0
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.gotohttp_ft_temp.zip]
mov qword [rdi - 1], rax
mov rax, qword [0x14023d3b0]
mov qword [rdi + 7], rax
mov eax, dword [0x14023d3b8]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x14023d3bc]
mov byte [rdi + 0x13], al
lea eax, [r11 + 0x14]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140107860
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.1401e42d0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r11d, eax
test eax, eax
je 0x140107926
cmp r11d, 0xf0
jae 0x140107926
mov qword [rsp + 0x140], rdi
test eax, eax
je 0x1401078d6
lea ecx, [r11 - 1]
cmp byte [rsp + rcx + 0x20], 0x5c
je 0x1401078d6
mov byte [rsp + r11 + 0x20], 0x5c
inc r11d
mov byte [rsp + r11 + 0x20], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
mov rax, qword [str.gotohttp_ft_temp.zip]
mov qword [rdi - 1], rax
mov rax, qword [0x14023d3b0]
mov qword [rdi + 7], rax
mov eax, dword [0x14023d3b8]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x14023d3bc]
mov byte [rdi + 0x13], al
mov rdi, qword [rsp + 0x140]
lea eax, [r11 + 0x14]
test eax, eax
je 0x140107926
lea rcx, [rsp + 0x20]
call fcn.1401e6978
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401e42a0
add rsp, 0x148
ret
Function at 0x14010db70
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
call fcn.14010a340
test eax, eax
je 0x14010dba0
mov rdx, qword [rbx + 0x298]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbx + 0x298], rax
cmp qword [rbx + 0x268], 0
mov qword [rsp + 0x90], rdi
jne 0x14010dc42
mov rcx, qword [rbx + 0x290]
call qword [sym.imp.GDI32.dll_SaveDC]
cmp dword [rbx + 0x280], 0
mov edi, eax
je 0x14010dbde
lea rcx, [0x14010db00]
mov rdx, rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [rbx + 0x258]
mov edx, dword [rbx + 0x254]
mov r8d, dword [rbx + 0x260]
mov rax, qword [rbx + 0x298]
mov r9d, dword [rbx + 0x25c]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ecx
sub r8d, ecx
mov rcx, qword [rbx + 0x290]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
sub r9d, edx
mov dword [rsp + 0x20], r8d
xor edx, edx
xor r8d, r8d
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, qword [rbx + 0x290]
mov edx, edi
call qword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x14010dc61
lea rcx, [0x14010dac0]
mov rdx, rbx
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x290]
xor edx, edx
call qword [sym.imp.GDI32.dll_SelectClipRgn]
mov rcx, qword [rbx + 0x2a8]
test rcx, rcx
je 0x14010dc79
mov rax, qword [rcx]
mov rdx, qword [rbx + 0x290]
call qword [rax]
cmp dword [0x1402e2da0], 0
mov dword [0x1402e2d88], 0x18
je 0x14010dd9d
lea rcx, [0x1402e2d88]
call qword [sym.imp.USER32.dll_GetCursorInfo]
test eax, eax
je 0x14010dd9d
cmp dword [0x1402e2d8c], 1
jne 0x14010dd9d
mov rcx, qword [0x1402e2d90]
test rcx, rcx
je 0x14010dd9d
mov edi, dword [0x1402e2d98]
mov qword [rsp + 0x80], rbp
lea rdx, [rsp + 0x50]
xor ebp, ebp
mov qword [rsp + 0x88], rsi
mov esi, dword [0x1402e2d9c]
mov dword [rsp + 0x50], ebp
call qword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x14010dd1b
mov rcx, qword [rsp + 0x68]
sub edi, dword [rsp + 0x54]
sub esi, dword [rsp + 0x58]
test rcx, rcx
je 0x14010dd0b
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14010dd1b
call qword [sym.imp.GDI32.dll_DeleteObject]
movd xmm0, dword [rbx + 0x258]
mov r9, qword [0x1402e2d90]
mov rcx, qword [rbx + 0x290]
mov dword [rsp + 0x40], 3
movd xmm1, esi
movd xmm2, edi
cvtdq2ps xmm0, xmm0
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm2, xmm2
mulss xmm1, dword [rbx + 0x27c]
mulss xmm2, dword [rbx + 0x278]
subss xmm1, xmm0
movd xmm0, dword [rbx + 0x254]
cvtdq2ps xmm0, xmm0
cvttss2si r8d, xmm1
subss xmm2, xmm0
cvttss2si edx, xmm2
call qword [sym.imp.USER32.dll_DrawIconEx]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rax, qword [rbx + 0x228]
mov rdi, qword [rsp + 0x90]
add rsp, 0x70
pop rbx
ret
Function at 0x14010e0e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
mov dword [rsp + 0x20], r9d
mov r9d, r8d
mov r8d, edx
add rcx, 0x88
mov rdx, rbx
call fcn.140110640
mov rcx, qword [rbx + 0x28]
mov edx, dword [rcx + 0xcc]
mov edi, eax
cmp edx, 1
jne 0x14010e137
mov rcx, qword [rcx + 0xd8]
mov r8d, edx
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
call sub.WS2_32.dll_send
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14010e540
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
test edx, edx
jne 0x14010e5b1
cmp qword [rcx + 0x68], 0
jne 0x14010e5e5
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 0x98]
call fcn.14000c460
mov qword [rbx + 0x68], rax
test rax, rax
je 0x14010e638
mov edx, dword [rbx + 0x48]
mov rcx, rax
call fcn.14000c580
test eax, eax
jg 0x14010e5bb
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14010e5ab
lea r9, str.Cant_set_socket_for_SSL
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x129
mov ecx, 3
call fcn.1400045a0
or edx, 0xffffffff
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
mov r9, qword [rbx + 0x60]
test r9, r9
je 0x14010e5e5
mov rcx, qword [rbx + 0x68]
xor r8d, r8d
lea edx, [r8 + 0x37]
call fcn.14000c590
mov rcx, qword [rbx + 0x60]
call fcn.1401e36c8
mov qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0x68]
mov qword [rsp + 0x50], rsi
call fcn.14000c7f0
mov esi, eax
cmp eax, 1
jne 0x14010e671
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], eax
mov eax, dword [rcx + 0xcc]
cmp eax, esi
jne 0x14010e624
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, esi
call sub.WS2_32.dll_send
xor edx, edx
mov rcx, rbx
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14010e65f
lea r9, str.Cant_alloc_SSL
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x139
mov ecx, 3
call fcn.1400045a0
mov edx, 0xfffffffe
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
mov rcx, qword [rbx + 0x68]
mov edx, eax
mov qword [rsp + 0x58], rdi
call fcn.14000cd60
cmp dword [reloc.WS2_32.dll_accept], 0
mov edi, eax
jg 0x14010e6bc
mov rcx, qword [rbx + 0x68]
call fcn.14000cd70
lea r9, str.SSL::Connect__ret___d_err_d_ssl_state0x_X
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov dword [rsp + 0x30], eax
mov r8d, 0x14d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.1400045a0
sub edi, 2
je 0x14010e6f8
cmp edi, 1
je 0x14010e6e2
mov edx, 0xfffffffd
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
jmp method.NS_Channel.2.virtual_80
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jmp 0x14010e70c
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010e728
mov rcx, qword [rcx + 0xd8]
xor r9d, r9d
lea rdx, reloc.WS2_32.dll_WSAStartup
lea r8d, [r9 + 1]
call sub.WS2_32.dll_send
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
add rsp, 0x40
pop rbx
ret
Function at 0x14010e740
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov esi, r8d
mov r12, rdx
mov rdi, rcx
test r8d, r8d
jle 0x14010e8b5
nop
mov rcx, qword [rdi + 0x68]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, r12
call fcn.14000cb10
mov ebp, eax
test eax, eax
jle 0x14010e796
add ebx, eax
cmp ebx, esi
jl 0x14010e770
jmp 0x14010e8b5
mov rcx, qword [rdi + 0x68]
mov edx, eax
call fcn.14000cd60
mov esi, eax
mov ecx, eax
test eax, eax
je 0x14010e885
sub ecx, 1
je 0x14010e885
sub ecx, 1
je 0x14010e885
sub ecx, 1
je 0x14010e817
cmp ecx, 3
je 0x14010e80a
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14010e802
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.read_data_n_d__err_d__syserr_d
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov dword [rsp + 0x30], eax
mov r8d, 0x2c5
mov ecx, 3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.1400045a0
or eax, 0xffffffff
jmp 0x14010e8b7
or eax, 0xffffffff
test ebx, ebx
cmovg eax, ebx
jmp 0x14010e8b7
cmp dword [reloc.WS2_32.dll_accept], 2
jg 0x14010e83e
lea r9, str.Want_write_while_reading_data
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x2b7
mov ecx, 2
call fcn.1400045a0
mov rcx, qword [rdi + 0x28]
mov dword [rdi + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010e86d
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rcx, qword [rdi + 0x28]
mov dword [rdi + 0x50], 1
mov r9d, dword [rcx + 0xcc]
cmp r9d, 1
jmp 0x14010e899
mov rcx, qword [rdi + 0x28]
mov dword [rdi + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010e8b5
mov rcx, qword [rcx + 0xd8]
xor r9d, r9d
lea rdx, reloc.WS2_32.dll_WSAStartup
lea r8d, [r9 + 1]
call sub.WS2_32.dll_send
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x14010e8e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
mov esi, r8d
call fcn.14000cc20
mov edi, eax
test eax, eax
jg 0x14010ea02
mov rcx, qword [rbx + 0x68]
mov edx, eax
call fcn.14000cd60
mov edx, eax
test eax, eax
je 0x14010e9c1
sub edx, 1
je 0x14010e9c1
sub edx, 1
je 0x14010e991
sub edx, 1
je 0x14010e9c1
cmp edx, 3
je 0x14010e97e
cmp dword [reloc.WS2_32.dll_accept], 3
jg 0x14010ea35
mov dword [rsp + 0x28], eax
lea r9, str.write_data_n_d__err_d
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x315
mov ecx, 3
mov dword [rsp + 0x20], edi
call fcn.1400045a0
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [reloc.WS2_32.dll_accept], 2
jg 0x14010e9b8
lea r9, str.Want_read_while_writing_data
lea rdx, str....._network_serviceNS_Channel_Ssl.cpp
mov r8d, 0x309
mov ecx, 2
call fcn.1400045a0
mov dword [rbx + 0x50], 1
jmp 0x14010ea0d
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010e9f0
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, esi
jge 0x14010ea35
mov dword [rbx + 0x54], 1
mov rcx, qword [rbx + 0x28]
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010ea35
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x14010ea50
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
mov esi, r8d
cmp rcx, 0xffffffffffffffff
jne 0x14010ea77
or eax, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
call sub.WS2_32.dll_send
mov edi, eax
test eax, eax
jns 0x14010eadb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x14010eb25
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010eac9
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x14010eaf2
or eax, 0xffffffff
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp eax, esi
jge 0x14010eb25
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x54], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010eb25
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x14010eb40
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
mov esi, r8d
cmp rcx, 0xffffffffffffffff
jne 0x14010eb67
or eax, ecx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
call sub.WS2_32.dll_recv
mov edi, eax
test eax, eax
jns 0x14010ebcb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x14010ec15
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010ebb9
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x14010ebe2
or eax, 0xffffffff
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
cmp eax, esi
jge 0x14010ec15
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0x50], 1
mov eax, dword [rcx + 0xcc]
cmp eax, 1
jne 0x14010ec15
mov rcx, qword [rcx + 0xd8]
lea rdx, reloc.WS2_32.dll_WSAStartup
xor r9d, r9d
mov r8d, eax
call sub.WS2_32.dll_send
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret