joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c240
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x38]
lea rdx, [0x1402ffc40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14001c2ce
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
cmp word [rax + rcx*2], 0
jne 0x14001c27e
mov rax, qword [rsp + 0x30]
shl rax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret

Function at 0x14001ce60
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140300280]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ncrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jge 0x14001ce96
jmp 0x14001ceb1
mov r9d, 1
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ncrypt.dll_BCryptGenRandom]
cmp qword [rsp + 0x20], 0
je 0x14001cec6
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ncrypt.dll_BCryptCloseAlgorithmProvider]
add rsp, 0x38
ret
Function at 0x14002d640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 8], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x58], 0x10
jae 0x14002d683
jmp 0x14002d7b8
mov rax, qword [rsp + 0x10]
and rax, 3
test rax, rax
je 0x14002d6ce
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax]
mov byte [rsp], al
mov rax, qword [rsp + 0x10]
inc rax
mov qword [rsp + 0x10], rax
movzx eax, byte [rsp]
cmp eax, 0x80
jl 0x14002d6cc
movzx eax, byte [rsp]
cmp eax, 0xbf
jg 0x14002d6cc
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
jmp 0x14002d683
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
and rax, 0xfffffffffffffffc
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x18], rax
je 0x14002d7ae
mov rax, qword [rsp + 0x18]
mov eax, dword [rax]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x18]
add rax, 4
mov qword [rsp + 0x18], rax
mov eax, dword [rsp + 4]
and eax, 0x80808080
test eax, eax
jne 0x14002d734
jmp 0x14002d7a9
mov eax, dword [rsp + 4]
xor eax, 0x80808080
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
and eax, 0xc0000000
test eax, eax
jne 0x14002d75b
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
and eax, 0xc00000
test eax, eax
jne 0x14002d775
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
and eax, 0xc000
test eax, eax
jne 0x14002d78f
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
and eax, 0xc0
test eax, eax
jne 0x14002d7a9
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
jmp 0x14002d6fc
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x10], rax
je 0x14002d804
mov rax, qword [rsp + 0x10]
movzx eax, byte [rax]
mov byte [rsp + 1], al
mov rax, qword [rsp + 0x10]
inc rax
mov qword [rsp + 0x10], rax
movzx eax, byte [rsp + 1]
cmp eax, 0x80
jl 0x14002d802
movzx eax, byte [rsp + 1]
cmp eax, 0xbf
jg 0x14002d802
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
jmp 0x14002d7b8
xor eax, eax
test eax, eax
jne 0x14002d804
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
xor eax, eax
test eax, eax
jne 0x14002d81f
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140066390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
xor eax, eax
test eax, eax
jne 0x14006639d
xor eax, eax
test eax, eax
jne 0x1400663a3
mov eax, dword [rsp + 0x28]
xor rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov rax, qword [rsp]
and rax, 0xff
mov qword [rsp], rax
xor eax, eax
test eax, eax
jne 0x1400663c4
mov eax, dword [rsp]
add rsp, 0x18
ret
Function at 0x14007afb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], 0
xor eax, eax
test eax, eax
jne 0x14007afdd
xor eax, eax
test eax, eax
jne 0x14007afe3
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x758]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x758]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x20], rax
jbe 0x14007b12e
mov rax, qword [rsp + 0x20]
sub rax, 0x18
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
cmp qword [rax + 8], rcx
je 0x14007b068
xor eax, eax
test eax, eax
jne 0x14007b060
jmp 0x14007b032
xor eax, eax
test eax, eax
jne 0x14007b068
xor eax, eax
test eax, eax
jne 0x14007b06e
cmp dword [rsp + 0x80], 0
je 0x14007b090
mov dword [rsp + 0x28], 1
jmp 0x14007b12e
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
and eax, 2
test eax, eax
je 0x14007b0ad
mov dword [rsp + 0x28], 1
jmp 0x14007b12e
mov eax, 8
imul rax, rax, 0xf
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x240]
mov rax, qword [rax + rcx]
cmp qword [rsp + 0x78], rax
je 0x14007b123
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x34], 0xadb
xor eax, eax
test eax, eax
jne 0x14007b0dd
xor eax, eax
test eax, eax
jne 0x14007b0e3
mov eax, dword [rsp + 0x30]
shl eax, 0x18
or eax, dword [rsp + 0x34]
lea r9, str.invalid_label
mov r8d, eax
lea rdx, [0x140334398]
mov rcx, qword [rsp + 0x40]
call fcn.14002cc10
xor eax, eax
test eax, eax
jne 0x14007b0cd
xor eax, eax
test eax, eax
jne 0x14007b0cd
xor eax, eax
test eax, eax
jne 0x14007b11b
jmp 0x14007b129
xor eax, eax
test eax, eax
jne 0x14007b123
jmp 0x14007b032
cmp dword [rsp + 0x28], 0
jne 0x14007b189
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x3c], 0xae5
xor eax, eax
test eax, eax
jne 0x14007b145
xor eax, eax
test eax, eax
jne 0x14007b14b
mov eax, dword [rsp + 0x38]
shl eax, 0x18
or eax, dword [rsp + 0x3c]
lea r9, [0x140334388]
mov r8d, eax
lea rdx, [0x140334368]
mov rcx, qword [rsp + 0x40]
call fcn.14002cc10
xor eax, eax
test eax, eax
jne 0x14007b135
xor eax, eax
test eax, eax
jne 0x14007b135
xor eax, eax
test eax, eax
jne 0x14007b183
xor eax, eax
test eax, eax
jne 0x14007b189
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 4]
mov dword [rax], ecx
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x10]
mov dword [rax], ecx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x14]
mov dword [rax], ecx
mov rax, qword [rsp + 0x50]
sub rax, 0x18
cmp qword [rsp + 0x20], rax
jne 0x14007b1df
mov dword [rsp + 0x2c], 1
jmp 0x14007b1e7
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x2c]
mov dword [rax], ecx
add rsp, 0x68
ret
Function at 0x1400b6250
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x468
mov rax, qword [0x140325ed8]
xor rax, rsp
mov qword [rsp + 0x450], rax
lea r9, [rsp + 0x28]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x478]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x1400b64bd
mov eax, 1
imul rax, rax, 0
movsx eax, byte [rsp + rax + 0x50]
test eax, eax
je 0x1400b64bd
mov rcx, qword [rsp + 0x470]
call fcn.14003b390
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
lea r8, [0x14033b384]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x470]
call fcn.1400320c0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [rsp + 0x24], eax
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1400b63be
mov rax, qword [rsp + 0x30]
test rax, rax
jl 0x1400b6329
cvtsi2sd xmm0, rax
jmp 0x1400b6342
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movaps xmm0, xmm1
movaps xmm1, xmm0
mov rcx, qword [rsp + 0x470]
call fcn.14003a070
lea r8, [0x14033b37c]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x470]
call fcn.1400320c0
mov rax, qword [rsp + 0x38]
test rax, rax
jl 0x1400b637c
cvtsi2sd xmm0, rax
jmp 0x1400b6395
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movaps xmm0, xmm1
movaps xmm1, xmm0
mov rcx, qword [rsp + 0x470]
call fcn.14003a070
lea r8, str.free
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x470]
call fcn.1400320c0
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
je 0x1400b63eb
cmp dword [rsp + 0x20], 3
je 0x1400b6401
cmp dword [rsp + 0x20], 4
je 0x1400b6417
cmp dword [rsp + 0x20], 5
je 0x1400b642d
cmp dword [rsp + 0x20], 6
je 0x1400b6443
jmp 0x1400b6459
lea rdx, str.REMOVABLE
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
jmp 0x1400b646d
lea rdx, str.FIXED
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
jmp 0x1400b646d
lea rdx, str.REMOTE
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
jmp 0x1400b646d
lea rdx, str.CDROM
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
jmp 0x1400b646d
lea rdx, str.RAMDISK
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
jmp 0x1400b646d
lea rdx, [0x14033b358]
mov rcx, qword [rsp + 0x470]
call fcn.14003a550
lea r8, [0x14033b34c]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x470]
call fcn.1400320c0
xor r8d, r8d
lea rdx, [0x1400b6210]
mov rcx, qword [rsp + 0x470]
call fcn.14003c020
lea r8, [0x14033b340]
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x470]
call fcn.1400320c0
mov eax, 1
jmp 0x1400b64bf
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14026d940
add rsp, 0x468
ret
Function at 0x1400f8ed0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x90]
call fcn.1400307b0
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x30]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x90]
call fcn.1400359f0
mov rcx, qword [rsp + 0x90]
call fcn.14003ad10
lea r8, [0x1403a7b68]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x90]
call fcn.1400c8020
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x90]
call fcn.14003d530
cmp qword [rsp + 0x38], 0
je 0x1400f9058
mov eax, dword [rsp + 0x30]
inc eax
cdqe
add rax, 8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140113f90
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.140001020
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov byte [rax + 8], 0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140113dd0
test eax, eax
je 0x1400f9012
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
cmp qword [rax - 0x10], 0
jbe 0x1400f8ff0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
mov rax, qword [rax - 0x18]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x1400f8ff9
mov qword [rsp + 0x58], 0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x60], rax
jmp 0x1400f901b
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x140101290]
mov rax, qword [rsp + 0x38]
mov r8, qword [rax]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call fcn.1400c7a90
jmp 0x1400f90fe
mov eax, dword [rsp + 0x30]
add eax, 4
cdqe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140113f90
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
add eax, 4
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x48]
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x48]
add rax, 4
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.140001020
mov eax, dword [rsp + 0x30]
add eax, 4
mov dword [rsp + 0x50], eax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
mov r8d, ecx
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x90]
call fcn.14003d530
mov rcx, qword [rsp + 0x48]
call fcn.14027a7c0
add rsp, 0x88
ret
Function at 0x1401095b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140109617
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140109617
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
add rsp, 0x38
ret
Function at 0x14010b570
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0xfffffffc
mov rax, qword [rsp + 0x40]
add rax, 0x288
mov rcx, rax
call fcn.1400ac740
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x2d0]
cmp qword [rax], 0
jbe 0x14010b7c9
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x280], 0
jne 0x14010b7c9
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x258], 0
jne 0x14010b61d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, gethostname
call fcn.140113f90
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x2c], 3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x280], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x278], rcx
mov dword [rsp + 0x24], 0
jmp 0x14010b7c9
mov edx, reloc.WS2_32.dll_ntohs
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x2c0]
call fcn.140176750
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x2d0]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x2d0]
xor r9d, r9d
mov r8d, dword [rax]
mov rdx, qword [rcx + 8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x14010b7c9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x2d0]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jge 0x14010b787
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x2d0]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax]
sub eax, ecx
cdqe
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov ecx, gethostname
call fcn.140113f90
mov qword [rsp + 0x28], rax
mov edx, gethostname
mov rcx, qword [rsp + 0x28]
call fcn.140114170
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x2d0]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x2c], 3
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x2d0]
movsxd rdx, dword [rsp + 0x20]
add rdx, qword [rcx + 8]
mov rcx, rdx
mov rdx, qword [rsp + 0x28]
movsxd rdx, dword [rdx + 8]
mov r9, rax
mov r8, rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax]
call fcn.140001020
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x280], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x278], rcx
mov dword [rsp + 0x24], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x2c0]
call fcn.140176780
cdqe
mov rcx, rax
call fcn.1400014e0
jmp 0x14010b7c9
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x2d0]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jne 0x14010b7c9
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x2c0]
call fcn.140176780
cdqe
mov rcx, rax
call fcn.1400014e0
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x40]
add rax, 0x288
mov rcx, rax
call fcn.1400ac720
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x14010e8d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x70], 0
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x74], 0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x68], rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x220], rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x240], rcx
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x258], 1
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x254], 0
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x2a4], 0
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x14010e999
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x38]
add rax, qword [rcx + 0x20]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax + rcx]
mov qword [rsp + 0x40], rax
jmp 0x14010e9a2
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, str.AsyncSocket__p__Initialized
mov r8d, 2
mov edx, 0x40
mov rcx, qword [rsp + 0x40]
call fcn.140129b00
lea rax, [0x1403cecc0]
mov rcx, qword [rsp + 0x38]
cmp qword [rcx + 0x268], rax
je 0x14010ea7c
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x274]
mov rdx, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x268]
call fcn.140281018
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14010ea55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x942
lea rdx, [0x1403a8ee0]
xor ecx, ecx
call fcn.140124df0
mov r8d, 0x942
lea rdx, [0x1403a8e70]
lea rcx, [0x1403a8ce8]
call fcn.1400012d0
mov ecx, 0xfe
call fcn.1402742dc
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x268], rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x274]
mov dword [rax + 0x270], ecx
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x25c], 0
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x260], 0
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x58
ret
Function at 0x14010ec00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1c
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x94]
test eax, eax
je 0x14010eccd
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x94]
cmp eax, 0x17
jne 0x14010ec50
mov qword [rsp + 0x30], 0x1c
jmp 0x14010ec59
mov qword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x94]
cmp eax, 0x17
jne 0x14010ec75
mov qword [rsp + 0x38], 0x1c
jmp 0x14010ec7e
mov qword [rsp + 0x38], reloc.WS2_32.dll_recv
mov rax, qword [rsp + 0x28]
add rax, 0x94
mov r9, qword [rsp + 0x30]
mov r8, rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
call fcn.140001020
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x94]
cmp eax, 0x17
jne 0x14010ecbc
mov qword [rsp + 0x40], 0x1c
jmp 0x14010ecc5
mov qword [rsp + 0x40], reloc.WS2_32.dll_recv
mov eax, dword [rsp + 0x40]
jmp 0x14010ecea
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret

Function at 0x14010ecf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140325ed8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1c
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x94]
cmp eax, 0x17
jne 0x14010ed3f
mov rax, qword [rsp + 0x20]
movzx ecx, word [rax + 0x96]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x14010edad
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x94]
cmp eax, 2
jne 0x14010ed64
mov rax, qword [rsp + 0x20]
movzx ecx, word [rax + 0x96]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x14010edad
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.WS2_32.dll_getsockname]
movzx eax, word [rsp + 0x30]
cmp eax, 0x17
jne 0x14010ed94
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x14010edad
movzx eax, word [rsp + 0x30]
cmp eax, 2
jne 0x14010edab
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x14010edad
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14026d940
add rsp, 0x68
ret
Function at 0x14010f4e0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14010ef00
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 0x20
mov edx, 0xffff
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret

Function at 0x14010f530
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.14010ef00
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
add rax, 4
mov r9d, 4
mov r8, rax
mov edx, 4
lea rcx, [rsp + 0x30]
call fcn.140001020
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_listen
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret

Function at 0x14010f5b0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x14010f5cd
jmp 0x14010f62c
mov rcx, qword [rsp + 0x50]
call fcn.14010ef00
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
add rax, 4
mov r9d, 4
mov r8, rax
mov edx, 4
lea rcx, [rsp + 0x30]
call fcn.140001020
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 4]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x30]
mov r8d, listen
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret

Function at 0x14010f640
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140325ed8]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x70], 0
jne 0x14010f66c
jmp 0x14010f6cd
mov rcx, qword [rsp + 0x70]
call fcn.14010ef00
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
add rax, 8
mov r9d, reloc.WS2_32.dll_recv
mov r8, rax
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x38]
call fcn.140001020
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, [rsp + 0x38]
mov r8d, listen
mov edx, 0x29
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14026d940
add rsp, 0x68
ret