joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003ff00
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rcx
mov edi, r8d
mov esi, edx
lea rcx, [rsp + 0x68]
sub rcx, 8
lea r8, [0x1400466b0]
lea rdx, [rsp + 0x88]
call fcn.140028eb0
mov qword [rsp + 0x88], rax
call fcn.140171710
mov r9d, dword [0x1402794ec]
lea rdx, str..pipehola__d__d
mov rcx, qword [rsp + 0x88]
mov r8d, eax
call fcn.14002a0d0
mov rcx, qword [rsp + 0x88]
mov eax, 7
inc dword [0x1402794ec]
mov r8d, 1
mov qword [rsp + 0x38], 0
test edi, edi
mov dword [rsp + 0x30], 0xffffffff
mov edx, 0x40000003
mov rcx, qword [rcx]
cmovne r8d, eax
mov dword [rsp + 0x28], 0x1000
mov r9d, 0xff
mov dword [rsp + 0x20], 0x1000
call fcn.140053740
mov rbp, rax
test eax, eax
je 0x1400400ad
mov qword [rsp + 0x70], rbx
xor edx, edx
movsxd rbx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rcx, qword [rsp + 0x88]
mov edx, 0x40000000
mov eax, 0xc0000000
mov qword [rsp + 0x30], 0
cmp esi, 1
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, qword [rcx]
cmove edx, eax
xor r9d, r9d
xor r8d, r8d
call fcn.1400536c0
mov rsi, rax
test eax, eax
je 0x1400400bf
mov eax, edi
mov rcx, rbx
neg eax
sbb edx, edx
xor r9d, r9d
and edx, 2
xor r8d, r8d
mov dword [rsp + 0x80], edx
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
movsxd rcx, eax
call fcn.140171010
test rax, rax
je 0x1400400d1
mov eax, 0x44
test edi, edi
mov ebx, 0x24
mov ecx, esi
cmovne ebx, eax
lea rax, [rsp + 0x40]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.14003f620
mov dword [r14 + 4], eax
mov r9d, ebx
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, ebp
call fcn.14003f620
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], eax
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
lea rdx, str.CreateNamedPipe_failed:__m
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
lea rdx, str.CreateFile_failed:__m
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
lea rdx, str.SetNamedPipeHandleState_failed:__m
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14003ff00
Function at 0x1400400f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [0x14027e030], 0
mov r14d, r9d
mov rdi, r8
movsxd rsi, ecx
mov r15, rdx
je 0x140040186
mov rax, qword gs:[0x58]
mov ecx, 0x22cc
mov r10, qword [rax]
cmp dword [rcx + r10], 0
jne 0x140040186
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbp, rsi
mov rbx, qword [rax + rsi*8]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x140040189
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov ecx, esi
call fcn.1400402d0
jmp 0x14004029a
mov rbp, rsi
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbp*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x1400402b3
cmp qword [rbx + 0x40], 0
je 0x1400401ed
cmp dword [rbx + 0xc], 2
jne 0x1400401ed
cmp word [rbx + 0x6c], 0
je 0x1400401ed
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140047d30
jmp 0x14004029a
test eax, 0x80000004
je 0x140040210
xor eax, eax
mov r9d, r14d
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, r15
mov rcx, rbx
call fcn.140047b10
jmp 0x14004029a
test al, 1
je 0x140040276
movsxd rcx, dword [rbx + 0x70]
mov r9d, r14d
mov r8d, edi
mov rdx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140171010
mov rbx, rax
test eax, eax
jns 0x140040271
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140040255
call fcn.140176084
cmp dword [rax], 0x2738
jne 0x140040271
mov r8, rdi
lea rdx, str.buf_to_small___d__for_packet_recv
mov ecx, 0x4b0003
call fcn.14002d1f0
movsxd rax, ebx
jmp 0x14004029a
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x75c
lea rdx, str.vsock_recv
mov ecx, 0x4b0202
call fcn.14002d420
cdqe
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rdx, str.recv_from_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x140043370
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov r14, r8
lea rcx, [rsp + 0x2d8]
mov rbx, rdx
lea r8, [0x1400466b0]
sub rcx, 8
lea rdx, [rsp + 0x30]
mov rdi, r9
call fcn.140028eb0
xor edx, edx
mov qword [rsp + 0x30], rax
lea rcx, [0x1401ab520]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x68], rcx
lea rcx, [0x1401ab528]
mov qword [rsp + 0x70], rcx
lea rcx, str.except
mov qword [rsp + 0x78], rcx
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x1400435a0
mov qword [rsp + 0x2e0], rbp
mov rax, rbx
mov qword [rsp + 0x2b8], rsi
mov ebp, edx
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
cmp dword [rax], 0
mov esi, edx
jbe 0x140043561
mov r15, qword [rsp + rbp + 0x48]
lea r12, [rsp + 0x90]
cmp rax, rdi
lea r13, [rsp + 0x90]
lea rcx, [rsp + 0x90]
cmovne r12, rdx
cmp rax, r14
lea r14, [rax + 8]
cmovne r13, rdx
cmp rax, rbx
cmovne rcx, rdx
mov qword [rsp + 0x40], rcx
nop word [rax + rax]
movsxd rdi, dword [r14]
lea rax, [rsp + 0x38]
mov rdx, rcx
mov qword [rsp + 0x98], rdi
mov ecx, 1
mov qword [rsp + 0x20], rax
mov r9, r12
mov dword [rsp + 0x90], 1
mov r8, r13
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
call fcn.140171010
test eax, eax
jns 0x140043533
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov edx, dword [0x14027dfd0]
xor eax, eax
mov r8, qword [0x14027e020]
xor ebx, ebx
test edx, edx
jle 0x1400434f8
mov rcx, qword [r8 + rax*8]
test rcx, rcx
je 0x1400434f8
cmp dword [rcx + 0x70], edi
je 0x1400434f8
inc ebx
inc rax
cmp ebx, edx
jl 0x1400434e1
cmp ebx, edx
je 0x140043503
cmp qword [r8 + rax*8], 0
jne 0x140043506
or ebx, 0xffffffff
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov r8, qword [rsp + rbp + 0x68]
lea rdx, str._s__d__osfd_d_vfd_d_
mov rcx, qword [rsp + 0x30]
mov r9d, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140029d20
mov rcx, qword [rsp + 0x40]
inc esi
add r14, 8
cmp esi, dword [r15]
jb 0x140043480
mov rbx, qword [rsp + 0x2e8]
xor edx, edx
mov rdi, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2f0]
mov rax, qword [rsp + rbp + 0x50]
add rbp, 8
test rax, rax
jne 0x140043434
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2e0]
lea rdx, [0x1401ab550]
mov rcx, rax
call fcn.14002a7b0
mov r8, qword [rsp + 0x30]
lea rdx, str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
mov ecx, 0x4b0000
mov r8, qword [r8]
call fcn.14002d6c0
int3
Function at 0x1400436d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword gs:[0x58]
mov rbx, rcx
mov esi, 0x2f80
add rsi, qword [rax]
mov rax, qword [rsi]
test rax, rax
jne 0x1400436fc
call fcn.140176084
mov r14d, dword [rax]
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, qword [rbx + 0x80]
or dword [rbx + 0x68], 0x400
call fcn.140059f80
mov rcx, qword [rbx + 0x80]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
call fcn.140059eb0
mov rcx, rbx
call fcn.140048d20
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140041670]
mov r9, qword [rbx + 0x138]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rcx, eax
call fcn.140171010
xor edi, edi
mov rbp, rax
test eax, eax
jne 0x140043887
mov rax, qword [rsi]
test rax, rax
jne 0x1400437a8
call fcn.140176084
mov ecx, dword [rax]
mov edx, 4
mov dword [rsp + 0x28], reloc.WS2_32.dll_setsockopt
mov r9d, 0xe8
mov dword [rsp + 0x20], 6
lea r8d, [rdx - 3]
call fcn.14003f940
test eax, eax
je 0x1400438aa
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dfe8]
mov rcx, qword [rbx + 0xf0]
jne 0x1400437fb
mov qword [0x14027dfe8], rcx
jmp 0x140043810
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x14027dfe8]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x14004382c
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x14004383f
test rcx, rcx
je 0x14004383f
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xf0], rdi
mov qword [rbx + 0xf8], rdi
call sub.KERNEL32.dll_LeaveCriticalSection
or dword [rbx + 0x68], 0x4100000
mov rcx, rbx
call fcn.140048dc0
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140043887
mov rcx, rbx
call fcn.140040d20
mov rax, qword [rsi]
test rax, rax
jne 0x140043894
call fcn.140176084
test ebp, ebp
mov dword [rax], r14d
sete dil
mov eax, edi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x1400438c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
or dword [rbx + 0x68], 0x400
mov rcx, rbx
call fcn.140048d20
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140041670]
mov r9, qword [rbx + 0x138]
lea rdx, [rbx + 0x164]
mov r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rdi, eax
mov rcx, rdi
call fcn.140171010
test rax, rax
jne 0x140043983
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14004395f
call fcn.140176084
mov ecx, dword [rax]
mov edx, 3
mov dword [rsp + 0x20], 6
lea r9d, [rdx + 0x6a]
lea r8d, [r9 + 0x7b]
call fcn.14003f940
test eax, eax
je 0x140043a49
test edi, edi
jne 0x140043a3e
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dfe8]
mov rcx, qword [rbx + 0xf0]
jne 0x1400439b0
mov qword [0x14027dfe8], rcx
jmp 0x1400439c5
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x14027dfe8]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x1400439e1
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x1400439f4
test rcx, rcx
je 0x1400439f4
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
xor eax, eax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xf8], rax
call sub.KERNEL32.dll_LeaveCriticalSection
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140043a2f
mov rcx, rbx
call fcn.140040d20
or dword [rbx + 0x68], 0x100000
mov rcx, rbx
call fcn.140048dc0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x140044250
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
test dword [rcx + 0x68], 0x2000
mov rbx, rcx
je 0x14004426d
call sub.ntdll.dll_NtTestAlert
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 0x88]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
call fcn.14005a320
cmp dword [rsp + 0x50], 0
je 0x14004442e
mov rax, qword [rbx + 0x140]
or dword [rbx + 0x68], 0x2000
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x140]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, rbx
call fcn.140048ee0
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x1400417a0]
mov r9, qword [rbx + 0x140]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
movsxd rcx, eax
call fcn.140171010
mov ebp, 0x2f80
mov rsi, rax
test eax, eax
jne 0x140044400
mov rcx, qword gs:[0x58]
mov edi, ebp
add rdi, qword [rcx]
mov rax, qword [rdi]
test rax, rax
jne 0x140044330
call fcn.140176084
cmp dword [rax], 0xe8
jne 0x140044451
mov rax, qword [rdi]
test rax, rax
jne 0x140044349
call fcn.140176084
cmp dword [rax], 0xe8
jne 0x140044400
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dff0]
mov rcx, qword [rbx + 0xe0]
jne 0x14004437a
mov qword [0x14027dff0], rcx
jmp 0x14004438f
mov rax, qword [rbx + 0xe8]
mov qword [rax + 0xe0], rcx
mov rcx, qword [0x14027dff0]
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
je 0x1400443ab
mov rax, qword [rbx + 0xe8]
mov qword [rdx + 0xe8], rax
jmp 0x1400443be
test rcx, rcx
je 0x1400443be
mov rax, qword [rbx + 0xe8]
mov qword [rcx + 0xe8], rax
xor eax, eax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xe0], rax
mov qword [rbx + 0xe8], rax
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
btr eax, 0xd
bts eax, 0x1a
mov dword [rbx + 0x68], eax
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140044400
mov rcx, rbx
call fcn.140040d20
cmp dword [rsp + 0x50], 0
je 0x14004442e
test esi, esi
jne 0x14004443c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rbp + rcx]
test rax, rax
jne 0x140044426
call fcn.140176084
cmp dword [rax], 0xe8
jne 0x14004443c
mov eax, dword [rbx + 0x68]
test al, 0x10
jne 0x14004443c
btr eax, 0xd
mov dword [rbx + 0x68], eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
lea rdx, str.WriteFileEx_failed:__m
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x1400454f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov word [rsp + 0x48], dx
mov eax, 0x10624dd3
imul r8d
movsxd rbx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [0x14027dfc8]
mov word [rsp + 0x4a], dx
test rax, rax
je 0x140045544
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov ecx, ebx
call rax
mov ebx, eax
jmp 0x140045689
cmp qword [0x14027e030], 0
mov qword [rsp + 0x40], rdi
je 0x1400455a0
mov rax, qword gs:[0x58]
mov edx, 0x22cc
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x1400455a0
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rdi, rbx
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x1400455a3
mov ebx, 1
jmp 0x1400455a5
mov rdi, rbx
xor ebx, ebx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
test ebx, ebx
mov rbx, qword [rax + rdi*8]
jne 0x140045612
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x1400455e4
cmp dword [rbx + 0xc], 2
jne 0x1400455e4
cmp word [rbx + 0x6c], 0
jne 0x14004562f
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171010
mov rbx, rax
jmp 0x140045684
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x140045659
cmp dword [rbx + 0xc], 2
jne 0x140045659
cmp word [rbx + 0x6c], 0
je 0x140045659
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x14004564e
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
or ebx, 0xffffffff
jmp 0x140045684
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171010
mov ebx, eax
mov rdi, qword [rsp + 0x40]
test ebx, ebx
je 0x1400456a5
lea r8, str.SO_LINGER
mov ecx, 0x4b0003
lea rdx, str.failed_setsockopt__s_:__m
call fcn.14002d1f0
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1400456b0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x10], edx
push rsi
sub rsp, 0x30
movsxd rbp, ecx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rsi, [rbp*8]
lea rcx, [0x14027dfa0]
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
test byte [rbx + 0x68], 1
jne 0x140045709
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [0x14027dfc8]
mov qword [rsp + 0x40], rdi
or edi, 0xffffffff
test rax, rax
je 0x14004573a
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea edx, [rdi + 7]
mov ecx, ebp
lea r8d, [rdi + 2]
call rax
jmp 0x14004581b
cmp qword [0x14027e030], 0
je 0x14004578e
mov rax, qword gs:[0x58]
mov edx, 0x22cc
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x14004578e
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x14004578e
mov ebx, 1
jmp 0x140045790
xor ebx, ebx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
test ebx, ebx
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
je 0x1400457f2
cmp dword [rbx + 0xc], 2
jne 0x1400457f2
cmp word [rbx + 0x6c], 0
je 0x1400457f2
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400457e8
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
mov eax, edi
jmp 0x14004581b
movsxd rcx, dword [rbx + 0x70]
lea r9, [rsp + 0x48]
mov r8d, 1
mov dword [rsp + 0x20], 4
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171010
test eax, eax
je 0x14004585d
mov rax, qword [0x14027e030]
mov ecx, 3
test rax, rax
mov edx, 7
cmovne ecx, edx
jne 0x140045859
cmp ecx, 5
jbe 0x140045845
cmp dword [0x14027e44c], ecx
jl 0x140045859
or ecx, 0x4b0000
lea rdx, str.failed_setsockopt_TCP_NODELAY_:__m
call fcn.14002d1f0
mov edi, eax
mov eax, edi
jmp 0x14004585f
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140045880
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x14027dfa0]
mov dword [rsp + 0x30], edx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rbx, [rbx*8]
lea rcx, [0x14027dfa0]
mov rdi, qword [rbx + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rdi + 0x68]
test al, 1
je 0x140045977
test esi, esi
jne 0x140045913
test al, al
jns 0x140045913
movsxd rcx, dword [rdi + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
movsxd rcx, eax
call fcn.140171010
test rax, rax
je 0x140045913
lea rdx, str.WSAEventSelect:__m
mov ecx, 0x4b0003
call fcn.14002d1f0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rbx + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
movsxd rcx, dword [rbx + 0x70]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd rcx, eax
call fcn.140171010
test eax, eax
je 0x140045977
lea rdx, str.failed_ioctl_FIOBIO_:__m
mov ecx, 0x4b0003
call fcn.14002d1f0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
and dword [rdi + 0x68], 0xffffff7f
mov rbx, qword [rsp + 0x38]
neg esi
mov rsi, qword [rsp + 0x40]
sbb eax, eax
and eax, 0x80
or dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140047040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x14027dfa0]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp dword [rbx + 0xc], 2
jne 0x1400471b0
cmp esi, 0x10
jae 0x1400470c2
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400470a9
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x1400470dc
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x1400471b0
cmp word [rbx + 0x6c], 0
je 0x1400471b0
mov rcx, rbx
call fcn.140048c30
test eax, eax
jne 0x1400470af
mov eax, dword [rdi + 4]
test eax, eax
je 0x14004714e
cmp eax, dword [rbx + 0x9c]
je 0x14004714e
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047135
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x140047193
movzx eax, word [rdi + 2]
test ax, ax
je 0x140047193
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140047230
cmp dword [0x14027e04c], 0
je 0x1400471ce
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.140034150
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140171010
cmp dword [0x14027e04c], 0
mov rdi, rax
je 0x1400471f7
call fcn.1400345f0
test edi, edi
jne 0x14004721d
cmp dword [rbx + 0xc], 2
jne 0x14004721d
cmp word [rbx + 0x94], di
jne 0x14004721d
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140047230
test eax, eax
jne 0x1400470af
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140171010
test rax, rax
je 0x14004726a
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret