joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035110
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov edx, 0x4004667f
mov rbp, rcx
call fcn.1400364b0
cmp dword [rsp + 0x58], 0
je 0x140035214
lea r9, [rsp + 0x60]
mov edx, 0xffff
mov r8d, 0x1008
mov rcx, rbp
call fcn.140036270
cmp dword [rsp + 0x60], 2
jne 0x140035214
movsxd r8, dword [rsp + 0x58]
xor ebx, ebx
xor edi, edi
mov rsi, r8
test r8d, r8d
je 0x1400351b7
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x140035225
mov rcx, r8
cmp r8, 0x1000
jb 0x14003519b
call fcn.140006210
jmp 0x1400351a0
call fcn.14003e268
lea rdi, [rsi + rax]
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call fcn.1400293d0
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rbp + 0x10]
mov r9d, 2
mov qword [rsp + 0x28], 0
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rsp + 0x58], eax
test rbx, rbx
je 0x140035214
sub rdi, rbx
cmp rdi, 0x1000
jb 0x140035209
mov rcx, qword [rbx - 8]
add rdi, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14003522b
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.14003e260
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
call fcn.14000e2b0
int3
call fcn.140052c24
int3

Function at 0x140035540
Capabilities:
Check os version

Disassembly:
sub rsp, 0xc8
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140035578
cmp dword [rsp + 0x24], 6
jb 0x140035578
jne 0x14003556e
cmp dword [rsp + 0x28], 2
jb 0x140035578
xor al, al
add rsp, 0xc8
ret
mov al, 1
add rsp, 0xc8
ret

Function at 0x1400355d0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x140035605
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.14002b030
mov edx, eax
mov rcx, rsi
call rbx
mov rcx, rdi
call fcn.14002b820
mov ebx, eax
mov rcx, rdi
call fcn.14002afb0
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140035692
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140035605
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002bb40
nop
mov rdx, rax
mov ecx, ebx
call fcn.1400359c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035692
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003568d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400356a2
call fcn.14003e260
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.140052c24
int3
Function at 0x1400356b0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0xb0
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x1400356f6
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.14002b030
mov edx, eax
mov rcx, rdi
call rbx
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x138]
nop
mov rcx, rsi
call fcn.14002b820
mov ebx, eax
mov rcx, rsi
call fcn.14002afb0
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1400357c4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2734
je 0x140035797
cmp eax, 0x2733
je 0x140035797
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14002bb40
nop
mov rdx, rax
mov ecx, ebx
call fcn.1400359c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035797
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400357ec
call fcn.14003e260
mov rax, qword [rdi]
mov r8d, 7
mov rdx, r14
mov rcx, rdi
call qword [rax + 0xc8]
test al, al
je 0x1400357f2
mov rcx, rdi
call fcn.1400376d0
test eax, eax
je 0x1400357c4
mov ecx, eax
call fcn.140035950
nop
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp qword [rax + 0x138]
call fcn.140052c24
nop
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002bb40
mov rbx, rax
lea rdx, str.connect_timed_out
lea rcx, [rsp + 0x20]
call fcn.1400054e0
nop
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14000f0c0
lea rdx, [0x1400e8dd8]
lea rcx, [rsp + 0x60]
call fcn.140040698
int3

Function at 0x140035840
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x140035875
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.14002b030
mov edx, eax
mov rcx, rdi
call rbx
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x138]
mov rcx, rsi
call fcn.14002b820
mov ebx, eax
mov rcx, rsi
call fcn.14002afb0
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140035911
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2734
je 0x140035911
cmp eax, 0x2733
je 0x140035911
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14002bb40
nop
mov rdx, rax
mov ecx, ebx
call fcn.1400359c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035911
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003590c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035921
call fcn.14003e260
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.140052c24
int3
Function at 0x1400364b0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1400364cb
add rsp, 0x28
jmp fcn.1400361b0
add rsp, 0x28
ret

Function at 0x140036880
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [rcx]
mov ebp, r8d
mov rdi, rdx
xor esi, esi
mov rdx, r9
mov rbx, rcx
lea r8d, [rsi + 1]
call qword [rax + 0xc8]
test al, al
je 0x14003694c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc0]
movsxd rdx, eax
cmp qword [rdi + 8], rdx
jae 0x1400368e0
mov r8b, 1
mov rcx, rdi
call fcn.140036f60
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140036964
mov r8d, dword [rdi + 8]
mov r9d, ebp
mov rdx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jns 0x140036938
cmp byte [rbx + 0x28], 0
je 0x140036915
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1400368e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14003692a
cmp byte [rbx + 0x28], 0
jne 0x140036982
jmp 0x140036938
cmp eax, 0x274c
je 0x140036982
mov ecx, eax
call fcn.140035950
mov rdx, rsi
cmp rsi, qword [rdi + 8]
jae 0x14003694c
mov r8b, 1
mov rcx, rdi
call fcn.140036f60
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x20]
call fcn.140040698
int3
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14000f0f0
lea rdx, [0x1400e8dd8]
lea rcx, [rsp + 0x20]
call fcn.140040698
int3
Function at 0x1400369a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rsi, rdx
mov ebp, r8d
mov edx, 1
mov rdi, rcx
call fcn.1400354b0
xor r14d, r14d
nop word [rax + rax]
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140036a8f
mov rdx, qword [rsi]
lea rax, [rsp + 0xc8]
mov r8, qword [rsi + 8]
lea r9, [rsp + 0xb0]
sub r8, rdx
mov qword [rsp + 0x30], r14
sar r8, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0xb0], r14d
mov dword [rsp + 0xc8], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x140036a2a
call fcn.1400361b0
cmp byte [rdi + 0x28], r14b
je 0x140036a47
cmp dword [rsp + 0xb0], r14d
jge 0x140036a74
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1400369d0
cmp dword [rsp + 0xb0], r14d
jge 0x140036a74
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140036a66
cmp byte [rdi + 0x28], r14b
jne 0x140036aad
jmp 0x140036a74
cmp eax, 0x274c
je 0x140036aad
mov ecx, eax
call fcn.140035950
mov eax, dword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x40]
call fcn.140040698
int3
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14000f0f0
lea rdx, [0x1400e8dd8]
lea rcx, [rsp + 0x40]
call fcn.140040698
int3

Function at 0x140036ad0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov r14, rdx
mov esi, r9d
mov edx, 1
mov ebp, r8d
mov rbx, rcx
call fcn.1400354b0
mov qword [rsp + 0x80], rdi
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140036b79
mov r9d, esi
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x140036b58
cmp byte [rbx + 0x28], 0
je 0x140036b35
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140036b03
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140036b4a
cmp byte [rbx + 0x28], 0
jne 0x140036b97
jmp 0x140036b58
cmp eax, 0x274c
je 0x140036b97
mov ecx, eax
call fcn.140035950
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x80]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x20]
call fcn.140040698
int3
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.14000f0f0
lea rdx, [0x1400e8dd8]
lea rcx, [rsp + 0x20]
call fcn.140040698
int3
Function at 0x140036bc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
mov r14, r9
mov edx, 1
mov r15, r8
mov rdi, rcx
call fcn.1400354b0
mov ebp, dword [rsp + 0xe0]
xor r12d, r12d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140036cd7
mov rax, qword [r14]
mov r9, qword [r15]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x40], r12
sub r8, rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r9
lea r9, [rsp + 0xc0]
sar r8, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc0], r12d
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x140036c64
call fcn.1400361b0
cmp byte [rdi + 0x28], r12b
je 0x140036c85
cmp dword [rsp + 0xc0], r12d
jge 0x140036cb2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140036c00
cmp dword [rsp + 0xc0], r12d
jge 0x140036cb2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140036ca4
cmp byte [rdi + 0x28], r12b
jne 0x140036cf5
jmp 0x140036cb2
cmp eax, 0x274c
je 0x140036cf5
mov ecx, eax
call fcn.140035950
mov eax, dword [rsp + 0xc0]
lea r11, [rsp + 0xa0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x58]
call fcn.140040698
int3
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.14000f0f0
lea rdx, [0x1400e8dd8]
lea rcx, [rsp + 0x58]
call fcn.140040698
int3

Function at 0x140036d20
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x80
mov r14, rdx
mov rsi, r9
mov edx, 1
mov ebp, r8d
mov rbx, rcx
call fcn.1400354b0
mov r15d, dword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
mov qword [rsp + 0xa0], rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140036e02
mov rax, qword [r12]
mov r9d, r15d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rax, qword [rsi]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
jns 0x140036dda
cmp byte [rbx + 0x28], 0
je 0x140036db7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140036d70
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140036dcc
cmp byte [rbx + 0x28], 0
jne 0x140036e20
jmp 0x140036dda
cmp eax, 0x274c
je 0x140036e20
mov ecx, eax
call fcn.140035950
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [rsp + 0xa0]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x30]
call fcn.140040698
int3
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14000f0f0
lea rdx, [0x1400e8dd8]
lea rcx, [rsp + 0x30]
call fcn.140040698
int3
Function at 0x140037020
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x90
mov rsi, rdx
mov ebp, r8d
mov edx, 2
mov rdi, rcx
call fcn.1400354b0
xor r14d, r14d
nop
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1400370e7
mov rdx, qword [rsi]
lea r9, [rsp + 0xa0]
mov r8, qword [rsi + 8]
sub r8, rdx
mov qword [rsp + 0x30], r14
sar r8, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14003709a
call fcn.1400361b0
cmp byte [rdi + 0x28], r14b
je 0x1400370b7
cmp dword [rsp + 0xa0], r14d
jge 0x1400370c6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140037050
cmp dword [rsp + 0xa0], r14d
jge 0x1400370c6
call fcn.1400361b0
mov eax, dword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x40]
call fcn.140040698
int3

Function at 0x140037110
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov r14, rdx
mov esi, r9d
mov edx, 2
mov ebp, r8d
mov rbx, rcx
call fcn.1400354b0
mov qword [rsp + 0x80], rdi
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14003719b
mov r9d, esi
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x14003717a
cmp byte [rbx + 0x28], 0
je 0x140037175
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140037143
call fcn.1400361b0
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x80]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x20]
call fcn.140040698
int3
Function at 0x1400371c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x140037207
mov rax, qword [rbx]
mov rcx, rsi
mov rdi, qword [rax + 0x150]
call fcn.14002b030
mov edx, eax
mov rcx, rbx
call rdi
mov rcx, rsi
mov dword [rsp + 0x70], r15d
call fcn.14002b820
mov rcx, rsi
mov edi, eax
call fcn.14002afb0
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8, qword [r14 + 8]
mov rcx, qword [rbx + 0x10]
sub r8, rdx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
sar r8, 4
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x14003725c
call fcn.1400361b0
mov edi, dword [rsp + 0x70]
cmp byte [rbx + 0x28], r15b
je 0x14003727b
test edi, edi
jns 0x140037284
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1400371e7
test edi, edi
jns 0x140037284
call fcn.1400361b0
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400372a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15d, dword [rsp + 0x70]
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
nop dword [rax]
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x1400372f0
mov rax, qword [rbx]
mov rcx, rsi
mov rdi, qword [rax + 0x150]
call fcn.14002b030
mov edx, eax
mov rcx, rbx
call rdi
mov rcx, rsi
call fcn.14002b820
mov rcx, rsi
mov edi, eax
call fcn.14002afb0
mov rcx, qword [rbx + 0x10]
mov r9d, r15d
mov r8d, ebp
mov dword [rsp + 0x28], edi
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp byte [rbx + 0x28], 0
mov edi, eax
je 0x140037337
test eax, eax
jns 0x140037342
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1400372d0
test edi, edi
jns 0x140037340
call fcn.1400361b0
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140037360
Capabilities:
Send data
Send data on socket

Disassembly:
mov byte [rsp + 0x10], dl
sub rsp, 0x78
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140037397
mov r9d, 1
lea rdx, [rsp + 0x88]
mov r8d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140037392
call fcn.1400361b0
add rsp, 0x78
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x20]
call fcn.140040698
int3
Function at 0x140037450
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140037484
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14003747c
call fcn.1400361b0
add rsp, 0x88
ret
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140024910
lea rdx, [0x1400e97a0]
lea rcx, [rsp + 0x30]
call fcn.140040698
int3
Function at 0x14003c8b0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, [0x1400d96b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14003c9a3
lea rdx, str.NtCancelIoFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
lea rdx, str.NtCreateFile
mov qword [0x1400f0cd0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
lea rdx, str.NtCreateKeyedEvent
mov qword [0x1400f0cd8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
lea rdx, str.NtDeviceIoControlFile
mov qword [0x1400f0ce0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
lea rdx, str.NtReleaseKeyedEvent
mov qword [0x1400f0ce8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
lea rdx, str.NtWaitForKeyedEvent
mov qword [0x1400f0cf0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
lea rdx, [0x1400acf48]
mov qword [0x1400f0cf8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003c9a3
mov qword [0x1400f0d00], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x14003e1f0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14003e21f
mov ecx, eax
call fcn.14003c800
mov eax, 0xffffffff
add rsp, 0x1c8
ret
xor eax, eax
add rsp, 0x1c8
ret

Function at 0x14003f0ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003f0f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003f0f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003f0f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003f0f6
cmp dword [rcx + 0x84], 0xe
jbe 0x14003f0f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003f0f8
xor al, al
add rsp, 0x28
ret

Function at 0x1400565b0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400563ac
Function at 0x14005fa40
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14005fa70
xor eax, eax
jmp 0x14005fb33
mov rbp, rbx
cmp word [rax], si
je 0x14005fa95
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14005fa7c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14005fa78
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14005e30c
movsxd r14, eax
test eax, eax
jne 0x14005fad3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14005fa69
mov rcx, r14
call fcn.14005a200
mov rdi, rax
test rax, rax
jne 0x14005faec
xor ecx, ecx
call fcn.140059068
jmp 0x14005fac8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14005e30c
test eax, eax
jne 0x14005fb1d
mov rcx, rdi
call fcn.140059068
jmp 0x14005fb27
xor ecx, ecx
call fcn.140059068
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140062aa8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14005b980
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140062b49
cmp ebx, dword [rsp + 0x30]
je 0x140062b42
test esi, esi
je 0x140062b42
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140062b1d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140062b2a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140062b07
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140062b2e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140062b4b
mov eax, 1
jmp 0x140062b4b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret