joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005a30
Capabilities:
Encode data using base64

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, qword [r9 + 0xa8]
mov r11, rcx
cmp qword [r9 + 0xa0], rax
jae 0x140005c6b
mov rax, qword [r9 + 0x98]
movzx esi, word [0x1400fdf10]
xor r10d, r10d
lea rcx, [0x1400fde20]
jmp 0x140005b60
cmp rdx, 1
jbe 0x140005b77
sub rdx, 2
mov word [r11], si
lea rbx, [r11 + 2]
add r10, 2
mov qword [r9 + 0x98], 0
cmp rdx, 3
jbe 0x140005b77
mov r11, qword [r9 + 0xa0]
mov rax, qword [r9 + 0xa8]
sub rax, r11
cmp rax, 2
jbe 0x140005b90
movsx eax, byte [r9 + r11 + 0xb0]
add r10, 4
sub rdx, 4
movzx edi, byte [r9 + r11 + 0xb1]
shl eax, 8
movzx eax, ax
or eax, edi
lea rdi, [r11 + 3]
mov qword [r9 + 0xa0], rdi
shl eax, 8
movzx r12d, byte [r9 + r11 + 0xb2]
lea r11, [rbx + 4]
mov edi, eax
or r12d, eax
shr eax, 0xc
mov r13d, r12d
and r12d, 0x3f
mov ebp, eax
shr edi, 0x12
sar r13d, 6
movzx eax, byte [rcx + r12]
and ebp, 0x3f
movzx edi, byte [rcx + rdi]
and r13d, 0x3f
movzx ebp, byte [rcx + rbp]
movzx r12d, byte [rcx + r13]
shl eax, 8
or eax, r12d
shl eax, 8
or eax, ebp
shl eax, 8
or eax, edi
mov dword [rbx], eax
mov rax, qword [r9 + 0x98]
mov rbx, qword [r9 + 0xa8]
add rax, 4
mov qword [r9 + 0x98], rax
cmp qword [r9 + 0xa0], rbx
jae 0x140005c50
cmp rax, 0x48
ja 0x140005a70
mov rbx, r11
cmp rdx, 3
ja 0x140005a9f
test r10, r10
je 0x140005c7d
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r8b, r8b
je 0x140005b80
mov eax, 0x3d3d
mov word [rbx + 2], ax
mov rax, qword [r9 + 0xa8]
mov rcx, qword [r9 + 0xa0]
cmp rax, rcx
je 0x140005b80
sub rax, rcx
xor edx, edx
cmp rax, 2
jne 0x140005bcb
movsx edx, byte [r9 + rcx + 0xb1]
shl edx, 8
movzx edx, dx
movsx eax, byte [r9 + rcx + 0xb0]
lea r8, [0x1400fde20]
xor ecx, ecx
shl eax, 0x10
and eax, 0xff0000
or edx, eax
shr eax, 0x12
mov cl, byte [r8 + rax]
mov eax, edx
sar eax, 0xc
and eax, 0x3f
movzx eax, byte [r8 + rax]
mov ch, al
mov word [rbx], cx
mov rax, qword [r9 + 0xa0]
add rax, 1
mov qword [r9 + 0xa0], rax
cmp rax, qword [r9 + 0xa8]
je 0x140005c31
sar edx, 6
and edx, 0x3c
movzx eax, byte [r8 + rdx]
mov byte [rbx + 2], al
add qword [r9 + 0xa0], 1
add qword [r9 + 0x98], 4
add r10, 4
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r8b, r8b
je 0x140005b80
cmp rdx, 3
jbe 0x140005b77
mov rbx, r11
jmp 0x140005b95
xor r10d, r10d
test r8b, r8b
je 0x140005b80
cmp rdx, 3
ja 0x140005c63
mov r10, 0xfffffffffffffffe
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140005f60
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
mov rbx, r9
test r8, r8
je 0x140005fc0
mov r9, qword [r9 + 0x40]
test r9, r9
je 0x140005f90
mov rdx, rdi
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp sym.fread
mov rcx, qword [rbx + 0x18]
lea rdx, [0x1400fd840]
mov qword [rsp + 0x28], r8
call sym.curlx_win32_fopen
mov r8, qword [rsp + 0x28]
test rax, rax
mov qword [rbx + 0x40], rax
mov r9, rax
jne 0x140005f7e
mov rax, 0xffffffffffffffff
jmp 0x140005fc7
mov rax, 0xfffffffffffffffe
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x14000e700
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
call sym.Curl_pollset_reset
cmp qword [rbx + 0x20], 0
je case.0x14000e734.0
mov r8d, dword [rbx + 0x58]
cmp r8d, 0x11
ja case.default.0x14000e734
lea rdx, [0x1400fe344]
movsxd rax, dword [rdx + r8*4]
add rax, rdx
jmp rax
lea r8, [sym.doing_getsock]
mov rdx, rsi
mov rcx, rbx
call sym.Curl_pollset_add_socks
mov rdx, rsi
mov rcx, rbx
call sym.Curl_conn_adjust_pollset
mov edx, dword [rsi + 0x28]
test edx, edx
jne case.0x14000e734.0
test byte [rbx + 0x140], 0x30
jne case.0x14000e734.0
xor edx, edx
mov rcx, rbx
call sym.Curl_conn_is_ip_connected
test al, al
jne 0x14000e7f8
add rsp, 0x28
pop rbx
pop rsi
ret
lea r8, [sym.perform_getsock]
jmp 0x14000e747
lea r8, [sym.connecting_getsock]
jmp 0x14000e747
lea r8, [sym.protocol_getsock]
jmp 0x14000e747
lea r8, [sym.Curl_resolv_getsock]
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.Curl_pollset_add_socks
lea r8, [sym.domore_getsock]
jmp 0x14000e747
lea rdx, str.multi_getsock:_unexpected_multi_state__d
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.Curl_failf
test byte [rbx + 0xa37], 0x10
je case.0x14000e734.0
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14000e81c
mov eax, dword [rax + 8]
test eax, eax
jle case.0x14000e734.0
lea rdx, str.WARNING:_no_socket_in_pollset__transfer_may_stall_
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.Curl_infof
Function at 0x140016370
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
xor edx, edx
call sym.memset
xor ecx, ecx
mov r9d, 2
mov r8d, ebx
mov rdx, rax
call sym.BCryptGenRandom
test eax, eax
setne al
movzx eax, al
add eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400163b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov r12, rdx
mov rbx, r8
test r8, r8
je 0x1400164bd
lea rbp, [rsp + 0x2c]
jmp 0x140016422
test eax, eax
jne 0x14001649b
mov eax, dword [rsp + 0x2c]
mov edx, eax
mov byte [r12], al
shr edx, 8
cmp rbx, 1
je 0x140016416
mov byte [r12 + 1], dl
mov edx, eax
shr edx, 0x10
cmp rbx, 2
je 0x140016416
mov byte [r12 + 2], dl
shr eax, 0x18
cmp rbx, 3
je 0x140016416
mov byte [r12 + 3], al
add r12, rsi
sub rbx, rsi
je 0x1400164b0
mov esi, 4
mov r8d, 4
mov rdx, rbp
mov rcx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
call sym.Curl_ssl_random
cmp eax, 4
jne 0x1400163d8
cmp byte [0x140147094], 0
je 0x140016470
imul eax, dword [0x140147090], 0x41c64e6d
add eax, 0x3039
mov dword [0x140147090], eax
rol eax, 0x10
jmp 0x1400163e4
xor ecx, ecx
mov r9d, 2
mov rdx, rbp
mov r8d, 4
mov dword [rsp + 0x2c], 0
call sym.BCryptGenRandom
test eax, eax
je 0x1400163e0
mov eax, 2
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, 0x2b
jmp 0x14001649b

Function at 0x140016550
Capabilities:
Generate random numbers via winapi

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
mov rbp, r8
cmp r8, 1
je 0x140016608
mov r12, rdx
lea rbx, [rsp + 0x2c]
jmp 0x140016591
test eax, eax
jne 0x14001664b
mov eax, dword [rsp + 0x2c]
cmp eax, 0xfffffffb
jbe 0x1400165d1
mov r8d, 4
mov rdx, rbx
mov rcx, rsi
call sym.Curl_ssl_random
cmp eax, 4
jne 0x140016580
cmp byte [0x140147094], 0
je 0x140016620
imul eax, dword [0x140147090], 0x41c64e6d
add eax, 0x3039
mov dword [0x140147090], eax
rol eax, 0x10
mov dword [rsp + 0x2c], eax
cmp eax, 0xfffffffb
ja 0x140016591
mov edx, eax
mov ecx, 0x84210843
add r12, 1
shr edx, 1
imul rdx, rcx
shr rdx, 0x24
imul edx, edx, 0x3e
sub eax, edx
lea rdx, [0x1400fefa0]
movzx eax, byte [rdx + rax]
mov byte [r12 - 1], al
lea rax, [rdi + rbp - 1]
cmp r12, rax
jne 0x140016591
mov rdi, r12
xor eax, eax
mov byte [rdi], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor ecx, ecx
mov r9d, 2
mov rdx, rbx
mov r8d, 4
mov dword [rsp + 0x2c], 0
call sym.BCryptGenRandom
test eax, eax
je 0x140016588
mov eax, 2
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140016660
Capabilities:
Move file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
lea rbx, [rsp + 0x30]
mov rdi, rcx
lea r12, [rsp + 0x20]
mov rsi, rdx
mov rcx, rbx
call sym.Curl_now
mov rcx, rdi
movdqu xmm6, xmmword [rsp + 0x30]
call sym.curlx_convert_UTF8_to_wchar
mov rcx, rsi
mov rdi, rax
call sym.curlx_convert_UTF8_to_wchar
mov rbp, qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, rax
jmp 0x1400166e0
mov rcx, rbx
call sym.Curl_now
mov rdx, r12
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm6
call sym.Curl_timediff
cmp rax, 0x3e8
ja 0x140016720
mov ecx, 1
call r13
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call rbp
test eax, eax
je 0x1400166b8
test rdi, rdi
je 0x1400166ff
mov rcx, rdi
call sym.free
test rsi, rsi
je 0x14001670c
mov rcx, rsi
call sym.free
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test rdi, rdi
je 0x14001672d
mov rcx, rdi
call sym.free
test rsi, rsi
je 0x14001673a
mov rcx, rsi
call sym.free
mov eax, 1
jmp 0x14001670e
Function at 0x140017970
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400179b0
test edx, edx
je 0x1400179b0
mov r9d, edx
mov rax, rcx
shl r9, 4
add r9, rcx
jmp 0x140017999
add rax, 0x10
cmp rax, r9
je 0x1400179b0
cmp qword [rax], 0xffffffffffffffff
je 0x140017990
add rsp, 0x28
jmp sym.Curl_poll.part.0
test r8, r8
je 0x1400179cc
js 0x1400179d3
mov eax, 0xfffffffe
cmp r8, rax
cmovle rax, r8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 0xffffffff
jmp 0x1400179ce

Function at 0x140020530
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400205d0
lea rdx, str.LoadLibraryExW
mov rcx, rax
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call r12
lea rdx, [0x140102cb2]
mov rcx, rsi
mov rdi, rax
call sym.wcspbrk
mov rbp, rax
test rax, rax
je 0x1400205a8
test rdi, rdi
je 0x1400205e8
mov r8d, 8
xor edx, edx
mov rcx, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
test rdi, rdi
je 0x140020600
lea rdx, str.AddDllDirectory
mov rcx, rbx
call r12
test rax, rax
je 0x140020600
mov r8d, 0x800
jmp 0x14002058d
xor ebp, ebp
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
xor ecx, ecx
call r13
mov ebx, eax
test eax, eax
je 0x1400205d0
mov rcx, rsi
call sym.wcslen
lea ecx, [rbx + 1]
add rcx, rax
mov rax, qword [0x140129dc0]
add rcx, rcx
call qword [rax]
mov r12, rax
test rax, rax
je 0x140020688
mov edx, ebx
mov rcx, rax
call r13
test eax, eax
je 0x140020688
mov rcx, r12
call sym.wcslen
lea rdx, [0x140102cc8]
lea rcx, [r12 + rax*2]
call sym.wcscpy
mov rcx, r12
call sym.wcslen
mov rdx, rsi
lea rcx, [r12 + rax*2]
call sym.wcscpy
test rdi, rdi
je 0x140020699
mov r8d, 8
xor edx, edx
mov rcx, r12
call rdi
mov rbp, rax
nop dword [rax + rax]
mov rax, qword [0x140129da0]
mov rcx, r12
call qword [rax]
jmp 0x1400205d2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
jmp 0x140020688
Function at 0x1400206b0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x1d0
and ecx, 2
je 0x1400206f2
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140020806
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140020800
shr ax, 8
cmp ax, 2
jne 0x140020800
call sym.Curl_sspi_global_init
mov ebx, eax
test eax, eax
je 0x140020710
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
lea rcx, [0x140102ccc]
call sym.Curl_load_library
mov qword [0x1401470d0], rax
test rax, rax
je 0x140020744
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140020744
mov qword [0x1401470b8], rax
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x140020799
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeAddrInfoExW
mov rcx, rax
call rdi
lea rdx, str.GetAddrInfoExCancel
mov rcx, rsi
mov qword [0x1401470b0], rax
call rdi
lea rdx, str.GetAddrInfoExW
mov rcx, rsi
mov qword [0x1401470a8], rax
call rdi
mov qword [0x1401470a0], rax
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
mov edx, 2
mov ecx, 6
mov byte [0x1401470c1], al
call sym.curlx_verify_windows_version
lea rcx, [0x1401470c8]
mov byte [0x1401470c0], al
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 2
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
Function at 0x14002b880
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sym.read
cdqe
add rsp, 0x28
ret
Function at 0x14002fd20
Capabilities:
Convert ip address from string

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx]
mov edx, dword [rdx + 8]
not edx
mov rbx, rcx
mov esi, r8d
and edx, 0xa
je 0x14002fe20
mov rbp, qword [rax + 0x50]
mov r13, qword [rax + 0x58]
mov r12d, dword [rax + 0x79c]
test rbp, rbp
je 0x14002fe00
mov rdi, qword [rbx]
test rdi, rdi
je 0x14002fd7e
mov rdx, rdi
mov rcx, rbp
call sym.strcmp
test eax, eax
je 0x14002fe00
mov rcx, qword [rbx + 8]
mov r14, qword [0x140129da0]
cmp rdi, rcx
je 0x14002fd91
call qword [r14]
mov rcx, qword [rbx + 0x10]
call qword [r14]
mov rcx, qword [rbx]
call qword [r14]
mov r15, qword [0x140129de0]
pxor xmm0, xmm0
mov rcx, rbp
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
call qword [r15]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
je 0x14002ff30
test r13, r13
je 0x14002fde4
mov rdx, r13
mov rcx, rbp
call sym.strcmp
test eax, eax
jne 0x14002fe40
mov qword [rbx + 8], rdi
cmp byte [rdi], 0
jne 0x14002feb0
mov dword [rbx + 0x18], 0
cmp byte [rdi], 0
jne 0x14002fe60
nop dword [rax]
mov dword [rbx + 0x1c], r12d
xor eax, eax
mov dword [rbx + 0x20], esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [rax + 0xd8]
mov r13, qword [rax + 0xe0]
mov r12d, dword [rax + 0xe8]
jmp 0x14002fd5a
mov rcx, r13
call qword [r15]
mov qword [rbx + 8], rax
test rax, rax
je 0x14002ff8f
mov rdi, qword [rbx]
test rdi, rdi
je 0x14002fdf1
jmp 0x14002fde8
mov rcx, rdi
call sym.strlen
mov rbp, rax
test rax, rax
jne 0x14002fee0
mov edx, 1
mov rax, qword [0x140129d40]
mov ecx, 1
call qword [rax]
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
je 0x14002ff7a
mov rdx, qword [rbx]
mov r8, rbp
call sym.Curl_strntolower
mov rax, qword [rbx + 0x10]
mov byte [rax + rbp], 0
jmp 0x14002fe00
lea r13, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
mov rbp, qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, r13
call rbp
mov edx, 1
test eax, eax
je 0x14002ff08
mov dword [rbx + 0x18], edx
jmp 0x14002fe00
lea rax, [rax - 1]
cmp byte [rdi + rbp - 1], 0x2e
cmovne rax, rbp
cmp rax, 0xfffe
ja 0x14002fe00
lea rdx, [rax + 1]
mov rbp, rax
jmp 0x14002fe75
mov r8, r13
mov rdx, rdi
mov ecx, 0x17
call rbp
test eax, eax
jne 0x14002ff70
mov dword [rbx + 0x18], 0
mov rdi, qword [rbx]
jmp 0x14002fdf8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002ff3c
call qword [r14]
mov rcx, qword [rbx + 0x10]
call qword [r14]
mov rcx, qword [rbx]
call qword [r14]
pxor xmm0, xmm0
mov qword [rbx + 0x10], 0
mov eax, 0x1b
mov dword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
jmp 0x14002fe09
mov edx, 2
jmp 0x14002fed2
mov rax, qword [rbx + 8]
cmp rax, qword [rbx]
je 0x14002ff40
mov rcx, rax
call qword [r14]
mov rcx, qword [rbx + 0x10]
jmp 0x14002ff40
cmp qword [rbx], 0
je 0x14002ff3c
xor ecx, ecx
jmp 0x14002ff39
Function at 0x1400323b0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r8, [0x140104546]
mov edx, 0xc
mov r9d, dword [rcx + 0x84]
mov rbp, qword [rcx + 0xe8]
lea rsi, [rsp + 0x24]
mov rbx, rcx
mov rcx, rsi
call sym.curl_msnprintf
mov rcx, qword [rbx + 0x88]
mov rdx, rsi
lea r9, [rbx + 0xb0]
lea r8, [rbx + 0xb8]
call sym.Curl_getaddrinfo_ex
mov esi, eax
test eax, eax
jne 0x140032510
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x80]
test eax, eax
jne 0x140032480
mov rcx, qword [rbx + 0xa0]
cmp rcx, 0xffffffffffffffff
jne 0x140032450
mov dword [rbx + 0x80], 1
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r9d, r9d
mov byte [rsp + 0x23], 1
lea rdx, [rsp + 0x23]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14003242a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0xa8], eax
jmp 0x14003242a
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x78]
mov rsi, qword [0x140129da0]
test rcx, rcx
je 0x1400324a6
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x78]
call qword [rsi]
mov rcx, qword [rbx + 0x88]
call qword [rsi]
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x1400324c0
call sym.Curl_freeaddrinfo
mov rcx, qword [rbx + 0xa0]
cmp rcx, 0xffffffffffffffff
jne 0x140032530
lea rdi, [rbx + 8]
mov qword [rbx], 0
xor eax, eax
mov qword [rbx + 0xe8], 0
and rdi, 0xfffffffffffffff8
sub rbx, rdi
lea ecx, [rbx + 0xf0]
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, rbp
call qword [rsi]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rdi
test eax, eax
jne 0x140032540
mov dword [rbx + 0xa8], esi
jmp 0x140032409
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1400324cd
call rdi
mov edx, 8
test eax, eax
cmove eax, edx
mov dword [rbx + 0xa8], eax
jmp 0x140032409
Function at 0x140034ed0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov r12, qword [rcx + 0x10]
mov r13, qword [rsp + 0x1b0]
mov dword [r13], 0
mov rbp, r9
mov rdi, rcx
mov rbx, rdx
xor r9d, r9d
mov rdx, r8
mov rcx, qword [r12 + 0x98]
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_recv]
movsxd r14, eax
mov rsi, r14
cmp r14d, 0xffffffff
je 0x140034fa0
test rbx, rbx
je 0x140034f31
test byte [rbx + 0xa37], 0x10
jne 0x140034f60
test r14, r14
jle 0x140034f45
test byte [r12 + 0x150], 1
je 0x140034fe8
mov rax, r14
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x140034f73
mov edx, dword [rax + 8]
test edx, edx
jle 0x140034f31
mov rax, qword [rdi]
mov eax, dword [rax + 0xc]
test eax, eax
jle 0x140034f31
mov eax, dword [r13]
mov dword [rsp + 0x20], esi
mov r9, rbp
mov rdx, rdi
lea r8, str.recv_len_zu______d__err_d
mov rcx, rbx
mov dword [rsp + 0x28], eax
call sym.Curl_trc_cf_infof
jmp 0x140034f31
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r15d, eax
cmp eax, 0x2733
jne 0x140035010
mov dword [r13], 0x51
test rbx, rbx
je 0x140034f45
test byte [rbx + 0xa37], 0x10
je 0x140034f45
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x140035050
mov ecx, dword [rax + 8]
test ecx, ecx
jg 0x140034f73
jmp 0x140034f45
lea rcx, [rsp + 0x30]
call sym.Curl_now
movdqu xmm0, xmmword [rsp + 0x30]
or byte [r12 + 0x150], 1
movups xmmword [r12 + 0x128], xmm0
jmp 0x140034f45
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Recv_failure:__s
mov rcx, rbx
mov r8, rax
call sym.Curl_failf
mov dword [rbx + 0xc64], r15d
mov dword [r13], 0x38
jmp 0x140034fbd
mov rax, qword [rdi]
mov r8d, dword [rax + 0xc]
test r8d, r8d
jle 0x140034f45
jmp 0x140034f7d
Function at 0x140035070
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
movaps xmmword [rsp + 0x190], xmm6
mov r12, qword [rsp + 0x210]
mov r13, qword [rcx + 0x10]
mov dword [r12], 0
movsxd rax, dword [rcx + 0x20]
mov rbx, rcx
mov rsi, rdx
mov rdx, r8
mov r8, qword [rcx + 0x18]
mov rcx, qword [r13 + 0x98]
add rax, 0x44
mov rbp, r9
xor r9d, r9d
mov r14, qword [r8 + rax*8]
mov qword [r8 + rax*8], rcx
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_send]
movsxd r15, eax
mov rdi, r15
cmp r15d, 0xffffffff
je 0x140035208
mov ecx, dword [r12]
test ecx, ecx
je 0x140035150
test rsi, rsi
je 0x140035119
test byte [rsi + 0xa37], 0x10
je 0x140035119
mov rax, qword [rsi + 0x11e8]
test rax, rax
je 0x14003510b
mov edx, dword [rax + 8]
test edx, edx
jle 0x140035119
mov rax, qword [rbx]
mov eax, dword [rax + 0xc]
test eax, eax
jg 0x140035228
mov rax, qword [rbx + 0x18]
movsxd rdx, dword [rbx + 0x20]
mov qword [rax + rdx*8 + 0x220], r14
movaps xmm6, xmmword [rsp + 0x190]
mov rax, r15
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
call sym.Curl_now
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
movdqu xmm0, xmmword [r13 + 0x138]
movdqu xmm6, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x60], xmm0
call sym.Curl_timediff
cmp rax, 0x3e8
jle 0x1400350ea
lea r10, [rsp + 0x8c]
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 4
mov edx, 0x4004747b
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x58], r10
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x1400351f7
mov eax, dword [rsp + 0x8c]
cmp dword [r13 + 0x148], eax
jne 0x140035290
movups xmmword [r13 + 0x138], xmm6
jmp 0x1400350ea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, eax
cmp eax, 0x2733
jne 0x140035250
mov dword [r12], 0x51
jmp 0x1400350ea
mov eax, dword [r12]
mov dword [rsp + 0x20], edi
mov r9, rbp
mov rdx, rbx
lea r8, str.send_len_zu______d__err_d
mov rcx, rsi
mov dword [rsp + 0x28], eax
call sym.Curl_trc_cf_infof
jmp 0x140035119
lea rdx, [rsp + 0x90]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Send_failure:__s
mov rcx, rsi
mov r8, rax
call sym.Curl_failf
mov dword [rsi + 0xc64], r13d
mov dword [r12], 0x37
jmp 0x1400350ef
mov r9, qword [rsp + 0x58]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [r13 + 0x98]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400351f7
mov eax, dword [rsp + 0x8c]
mov dword [r13 + 0x148], eax
jmp 0x1400351f7
Function at 0x140035420
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x428
mov rax, rcx
mov rbx, r8
mov rcx, rdx
test byte [rax + 0x24], 1
je 0x140035492
mov rsi, qword [rax + 0x10]
test rdx, rdx
je 0x140035480
test byte [rdx + 0xa37], 0x10
je 0x140035480
mov rdx, qword [rdx + 0x11e8]
test rdx, rdx
je 0x14003545f
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x140035480
mov rdx, qword [rax]
mov edx, dword [rdx + 0xc]
test edx, edx
jle 0x140035480
mov r9, qword [rsi + 0x98]
lea r8, str.cf_socket_shutdown__zd_
mov rdx, rax
call sym.Curl_trc_cf_infof
nop
mov rcx, qword [rsi + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x140035492
cmp dword [rsi], 3
je 0x1400354a8
xor eax, eax
mov byte [rbx], 1
add rsp, 0x428
pop rbx
pop rsi
ret
mov edx, 1
call sym.curlx_nonblock
test eax, eax
js 0x140035492
mov rcx, qword [rsi + 0x98]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recv]
jmp 0x140035492

Function at 0x1400354e0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x140
mov r8d, 1
mov rbx, rcx
mov dword [rsp + 0x3c], 1
mov rcx, rdx
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
test rbx, rbx
je 0x14003551d
test eax, eax
js 0x140035530
add rsp, 0x140
pop rbx
ret
test byte [rbx + 0xa37], 0x10
je 0x14003551d
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14003554c
mov eax, dword [rax + 8]
test eax, eax
jle 0x14003551d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
mov r8, rax
call sym.Curl_infof
jmp 0x14003551d