joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001109b
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400151c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14002a166]
call fcn.1400113ed
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0xffffefff
mov dword [rbp + 0x44], 0
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x160]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x140015262
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x160]
movsx eax, byte [rcx + rax]
mov ecx, dword [rbp + 0x24]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x64], 0
jmp 0x140015231
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 8
jge 0x140015258
mov eax, dword [rbp + 0x24]
and eax, 1
imul eax, eax, 0xffffffff
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x24]
shr eax, 1
mov ecx, dword [rbp + 4]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rbp + 0x24], eax
jmp 0x140015229
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
jmp 0x1400151f4
mov eax, dword [rbp + 0x24]
not eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011235
Capabilities:
Terminate process

Disassembly:
jmp 0x140018c90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112c1
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019fe0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a000
xor al, al
jmp 0x14001a081
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a013
xor al, al
jmp 0x14001a081
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001a03d
xor al, al
jmp 0x14001a081
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a051
xor al, al
jmp 0x14001a081
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001a063
xor al, al
jmp 0x14001a081
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001a07f
xor al, al
jmp 0x14001a081
mov al, 1
add rsp, 0x38
ret
Function at 0x140012800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14002a0a1]
call fcn.1400113ed
mov dword [rbp + 4], 0
jmp 0x14001283f
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 8
jge 0x1400128df
movsxd rax, dword [rbp + 4]
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x110]
movzx ecx, word [rdx + rcx*2]
mov dword [rbp + 0xd4], ecx
mov edx, dword [rbp + 0x120]
movzx ecx, dl
mov edx, dword [rbp + 0xd4]
sar edx, cl
mov ecx, edx
and ecx, 0x1111
mov rdx, qword [rbp + 0x100]
movzx eax, word [rdx + rax*2]
xor eax, ecx
mov dword [rbp + 0xd8], eax
movsxd rax, dword [rbp + 4]
mov rcx, qword [rbp + 0x100]
movzx edx, word [rbp + 0xd8]
mov word [rcx + rax*2], dx
movzx eax, word [rbp + 0xd8]
and eax, 0x1111
mov ecx, dword [rbp + 0x118]
shl eax, cl
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x108]
movzx ecx, word [rdx + rcx*2]
or ecx, eax
mov eax, ecx
movsxd rcx, dword [rbp + 4]
mov rdx, qword [rbp + 0x108]
mov word [rdx + rcx*2], ax
jmp 0x140012837
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x2fc520b40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc521c20
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc521542
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc544108]
test eax, eax
je 0x2fc5215da
lea rax, [0x2fc5440e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc544110]
mov qword [rbp - 8], rax
jmp 0x2fc5215be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc5215b2
cmp qword [rbp - 0x10], 0
je 0x2fc5215b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc521578
lea rax, [0x2fc5440e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5215db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5216e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc521708
mov eax, 0
jmp 0x2fc521756
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc521731
mov eax, 0
jmp 0x2fc521756
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc521751
mov eax, 0
jmp 0x2fc521756
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc52175c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5217da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5217d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5217d1
mov rax, qword [rbp - 8]
jmp 0x2fc5217ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc5217a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc532bf0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc533cd0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc5335f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc556108]
test eax, eax
je 0x2fc53368a
lea rax, [0x2fc5560e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc556110]
mov qword [rbp - 8], rax
jmp 0x2fc53366e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc533662
cmp qword [rbp - 0x10], 0
je 0x2fc533662
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc533628
lea rax, [0x2fc5560e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53368b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc533790
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5337b8
mov eax, 0
jmp 0x2fc533806
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5337e1
mov eax, 0
jmp 0x2fc533806
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc533801
mov eax, 0
jmp 0x2fc533806
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53380c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc53388a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc533881
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc533881
mov rax, qword [rbp - 8]
jmp 0x2fc53389f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc533854
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180060d10
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1802d63c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
mov qword [rbp - 0x39], rcx
xor ebx, ebx
mov dword [rbp - 0x55], ebx
lea rcx, [rbp - 0x29]
call fcn.180060fc0
nop
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.18005f4c0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x180060d96
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060d91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060e8b
call fcn.180130d88
movdqa xmm0, xmmword [0x180206e80]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov dword [rbp - 0x59], ebx
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
lea rdx, [rbp - 0x59]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x180060e91
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbx
mov edx, r14d
mov rcx, rsi
call fcn.1800606a0
mov rcx, qword [rsi]
lea rbx, [rcx + r14]
mov r8d, r14d
xor edx, edx
call fcn.1801eeca0
mov qword [rsi + 8], rbx
mov dword [rbp - 0x55], 1
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
mov r9, qword [rsi]
mov r8d, r14d
mov edx, dword [rbp - 0x59]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x180060ecf
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x180060e5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060e59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180060e85
call fcn.180130d88
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180131440
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18017a460
nop
call fcn.18017a460
int3
lea rcx, [rbp + 0x17]
call fcn.180060f10
nop
lea rcx, str.Failed_to_GetFileVersionInfoSize._Error:_
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], 0x2b
mov r8, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x51]
call fcn.18005dc20
lea rdx, [0x1802d2f58]
lea rcx, [rbp - 0x51]
call fcn.180169f74
nop
lea rcx, [rbp + 0x17]
call fcn.180060f10
nop
lea rcx, str.Failed_to_GetFileVersionInfo._Error:_
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], 0x27
mov r8, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x51]
call fcn.18005dc20
lea rdx, [0x1802d2f58]
lea rcx, [rbp - 0x51]
call fcn.180169f74
int3
Function at 0x180097c10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x180097c52
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180097df0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1802d63c0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x230]
mov r14, qword [rcx + r8*8 + 0x1e8]
add rbx, rax
mov rax, qword [rcx + 0x410]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x180097efc
lea rax, [0x180097ca0]
cmp qword [rcx + r8*8 + 0x210], rax
jne 0x180097efc
cmp qword [rbx], 0
je 0x180097e81
test rdi, rdi
je 0x180097efc
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1800adf50
cmp eax, 0xffffffff
je 0x180097efc
test al, 1
je 0x180097efc
mov rcx, qword [rbx]
test rcx, rcx
jne 0x180097edb
mov eax, dword [rbp + 0x734]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.1801a9624]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x180097f36
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x180097efc
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x180097f75
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x180097f45
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x180097f75
mov dword [rsi], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x180097f78
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800a1ce0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.180097980
mov dword [rbp + 0xde4], edi
mov dword [rsi], 0x37
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180131440
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180098760
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1802d63c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180098813
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.1800a1ce0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.180097980
jmp 0x1800988db
movzx ecx, word [rsp + 0x30]
mov edx, ecx
sub edx, 1
je 0x1800988b0
sub edx, 1
je 0x18009885a
cmp edx, 0x15
jne 0x180098861
lea rdx, [rsp + 0x38]
mov r8, rbx
mov r9d, 0x2e
call fcn.1800b3cd0
test rax, rax
je 0x180098861
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
jmp 0x1800988db
lea rdx, [rsp + 0x34]
jmp 0x180098832
mov byte [rbx], 0
mov dword [rdi], 0
call fcn.18017a630
mov dword [rax], 0x273f
call fcn.18017a630
mov ebx, dword [rax]
call fcn.18017a630
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1800a1ce0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.180097980
jmp 0x1800988db
cmp dword [rsp + 0x20], 2
jle 0x1800988d2
lea r9, [rsp + 0x32]
mov edx, 0x2e
lea r8, [0x18020bed0]
mov rcx, rbx
call fcn.18009b080
jmp 0x1800988d5
mov byte [rbx], 0
mov dword [rdi], 0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180131440
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800ab770
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rdi
push r13
push r14
sub rsp, 0x68
mov rax, qword [0x1802d63c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov r13, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1800ab797
mov qword [rsp + 0xa0], rbp
xor r14d, r14d
cmp byte [rdx], 0x5b
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
jne 0x1800ab906
cmp rbx, 4
jb 0x1800ab91a
inc rdi
sub rbx, 2
cmp byte [rdi + rbx], 0x5d
jne 0x1800ab91a
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rdi
call fcn.1801bfca0
cmp rbx, rax
je 0x1800ab8a8
cmp byte [rdi + rax], 0x25
lea r15, [rdi + rax]
mov rbx, rax
jne 0x1800ab91a
lea r8d, [r14 + 2]
mov ebp, r14d
lea rdx, [0x1802112cc]
lea rcx, [r15 + 1]
lea rsi, [r15 + 1]
call fcn.1801ac8a0
test eax, eax
jne 0x1800ab839
movzx eax, byte [r15 + 3]
lea rcx, [r15 + 3]
test al, al
je 0x1800ab839
cmp al, 0x5d
cmovne rsi, rcx
movzx eax, byte [rsi]
test al, al
je 0x1800ab91a
mov rcx, r14
cmp al, 0x5d
je 0x1800ab864
cmp rcx, 0xf
jge 0x1800ab864
inc rsi
mov byte [rsp + rcx + 0x20], al
inc ebp
inc rcx
movzx eax, byte [rsi]
test al, al
jne 0x1800ab847
test ebp, ebp
je 0x1800ab91a
cmp byte [rsi], 0x5d
jne 0x1800ab91a
movsxd rax, ebp
cmp rax, 0x10
jae 0x1800ab921
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], r14b
call qword [case.0x180089a39.0]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x1800ab8a2
mov eax, 7
jmp 0x1800ab8d7
mov word [r15], 0x5d
lea r8, [rsp + 0x30]
mov byte [rdi + rbx], r14b
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800ab91a
mov byte [rdi + rbx], 0x5d
cmp byte [rdi], r14b
mov eax, select
cmove r14d, eax
mov eax, r14d
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180131440
add rsp, 0x68
pop r14
pop r13
pop rdi
pop rbx
ret
lea rdx, [0x1802112d0]
mov rcx, rdi
call fcn.1801bf3a0
cmp rbx, rax
je 0x1800ab8c8
mov eax, 3
jmp 0x1800ab8d7
call fcn.180131988
int3
Function at 0x1800b3860
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1802d63c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov edx, 1
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
mov esi, 2
mov dword [rbp - 0x3c], 1
mov ecx, esi
mov rdi, r9
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800b38b2
jmp 0x1800b3a7b
mov qword [rsp + 0x90], r14
mov ecx, 0x7f000001
xor r14d, r14d
mov word [rbp - 0x38], si
mov qword [rbp - 0x30], r14
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rbp - 0x3c]
mov word [rbp - 0x36], r14w
mov edx, 0xffff
mov dword [rbp - 0x34], eax
lea r8d, [r14 + 4]
mov qword [rdi + 8], 0xffffffffffffffff
mov rcx, rbx
mov qword [rdi], 0xffffffffffffffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800b3a52
lea r8d, [r14 + 0x10]
mov rcx, rbx
lea rdx, [rbp - 0x38]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1800b3a52
lea r8, [rbp - 0x40]
mov rcx, rbx
lea rdx, [rbp - 0x38]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1800b3a52
cmp dword [rbp - 0x40], 0x10
jl 0x1800b3a52
lea edx, [r14 + 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1800b3a52
xor r8d, r8d
lea edx, [r14 + 1]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x1800b3a52
lea r8d, [r14 + 0x10]
mov rcx, rax
lea rdx, [rbp - 0x38]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1800b3a52
lea edx, [r14 + 1]
mov rcx, rbx
call fcn.1800b3ca0
test eax, eax
js 0x1800b3a52
lea edx, [r14 + 1]
mov qword [rbp - 0x18], rbx
mov r8d, 0x2710
mov dword [rbp - 0x10], 0x300
lea rcx, [rbp - 0x18]
call fcn.1800adb30
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1800b3a52
mov rcx, qword [rdi]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1800b3a52
cmp dword [rbp - 0x40], 0x10
jl 0x1800b3a52
mov rcx, qword [rdi + 8]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov dword [rbp - 0x40], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x1800b3a52
cmp dword [rbp - 0x40], 0x10
jl 0x1800b3a52
movzx eax, word [rbp - 0x28]
cmp word [rbp - 0x38], ax
jne 0x1800b3a52
mov eax, dword [rbp - 0x24]
cmp dword [rbp - 0x34], eax
jne 0x1800b3a52
movzx eax, word [rbp - 0x26]
cmp word [rbp - 0x36], ax
jne 0x1800b3a52
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1800b3a73
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rdi + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180131440
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret