joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5660
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x1400a56aa
mov edx, 0x2719
mov rcx, qword [rsp + 0x88]
call fcn.1400cadd0
xor al, al
jmp 0x1400a578c
movzx eax, byte [rsp + 0x80]
test eax, eax
jne 0x1400a56de
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
and eax, 1
test eax, eax
je 0x1400a56de
mov edx, 0x2726
mov rcx, qword [rsp + 0x88]
call fcn.1400cadd0
xor al, al
jmp 0x1400a578c
call fcn.1400a5310
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x1400a56f9
mov dword [rsp + 0x20], 1
jmp 0x1400a5701
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rdx, qword [rsp + 0x88]
mov ecx, eax
call fcn.1400caf90
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jl 0x1400a578a
lea rcx, [rsp + 0x28]
call fcn.1400a05e0
mov rdi, qword [rsp + 0x88]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x1400a5774
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
or eax, 2
mov rcx, qword [rsp + 0x78]
mov byte [rcx], al
jmp 0x1400a5786
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
and eax, 0xfffffffd
mov rcx, qword [rsp + 0x78]
mov byte [rcx], al
mov al, 1
jmp 0x1400a578c
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400a59c0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4c8
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x2a0], 0
mov dword [rsp + 0x40], 0
jmp 0x1400a5a04
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x2a0]
cmp dword [rsp + 0x40], eax
jae 0x1400a5a2b
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x4e0]
cmp qword [rsp + rax*8 + 0x2a8], rcx
jne 0x1400a5a29
jmp 0x1400a5a2b
jmp 0x1400a59fa
mov eax, dword [rsp + 0x2a0]
cmp dword [rsp + 0x40], eax
jne 0x1400a5a66
cmp dword [rsp + 0x2a0], 0x40
jae 0x1400a5a66
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x4e0]
mov qword [rsp + rax*8 + 0x2a8], rcx
mov eax, dword [rsp + 0x2a0]
inc eax
mov dword [rsp + 0x2a0], eax
xor eax, eax
test eax, eax
jne 0x1400a59f0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x44], 0
jmp 0x1400a5a8b
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x44], eax
jae 0x1400a5ab2
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4e0]
cmp qword [rsp + rax*8 + 0x98], rcx
jne 0x1400a5ab0
jmp 0x1400a5ab2
jmp 0x1400a5a81
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x44], eax
jne 0x1400a5aed
cmp dword [rsp + 0x90], 0x40
jae 0x1400a5aed
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4e0]
mov qword [rsp + rax*8 + 0x98], rcx
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
xor eax, eax
test eax, eax
jne 0x1400a5a77
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0x4e0]
inc rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x2a0]
xor edx, edx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x1400a5b44
xor al, al
jmp 0x1400a5bea
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x80], 4
mov rax, qword [rsp + 0x4e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x1007
mov r8d, 0xffff
xor edx, edx
mov rcx, qword [rsp + 0x4e0]
call fcn.1400a63c0
test eax, eax
jne 0x1400a5be8
cmp dword [rsp + 0x70], 0
je 0x1400a5bcc
call fcn.1400a21e0
mov r8, rax
mov edx, dword [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400a0530
mov rdi, qword [rsp + 0x4e8]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
jmp 0x1400a5be8
lea rcx, [rsp + 0x60]
call fcn.1400a05e0
mov rdi, qword [rsp + 0x4e8]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov al, 1
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x4c8
pop rdi
pop rsi
ret
Function at 0x1400a5cd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.1400a5310
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov rdx, qword [rsp + 0xb0]
mov ecx, eax
call fcn.1400caf90
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0xb0]
call fcn.1400151e0
cmp eax, 0x40
jne 0x1400a5d91
mov edx, 0x2746
mov rcx, qword [rsp + 0xb0]
call fcn.1400cadd0
jmp 0x1400a5e00
mov rcx, qword [rsp + 0xb0]
call fcn.1400151e0
cmp eax, 0x4d2
jne 0x1400a5db9
mov edx, 0x274d
mov rcx, qword [rsp + 0xb0]
call fcn.1400cadd0
jmp 0x1400a5e00
mov rcx, qword [rsp + 0xb0]
call fcn.1400151e0
cmp eax, 0x2738
je 0x1400a5de1
mov rcx, qword [rsp + 0xb0]
call fcn.1400151e0
cmp eax, 0xea
jne 0x1400a5e00
mov rcx, qword [rsp + 0xb0]
call fcn.140004a10
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call fcn.1400a0620
cmp dword [rsp + 0x44], 0
je 0x1400a5e0e
mov eax, 0xffffffff
jmp 0x1400a5e2e
lea rcx, [rsp + 0x48]
call fcn.1400a05e0
mov rdi, qword [rsp + 0xb0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x1400a5f50
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.1400a5310
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSASend]
mov rdx, qword [rsp + 0xb0]
mov ecx, eax
call fcn.1400caf90
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0xb0]
call fcn.1400151e0
cmp eax, 0x40
jne 0x1400a600f
mov edx, 0x2746
mov rcx, qword [rsp + 0xb0]
call fcn.1400cadd0
jmp 0x1400a6035
mov rcx, qword [rsp + 0xb0]
call fcn.1400151e0
cmp eax, 0x4d2
jne 0x1400a6035
mov edx, 0x274d
mov rcx, qword [rsp + 0xb0]
call fcn.1400cadd0
cmp dword [rsp + 0x48], 0
je 0x1400a6043
mov eax, 0xffffffff
jmp 0x1400a6063
lea rcx, [rsp + 0x50]
call fcn.1400a05e0
mov rdi, qword [rsp + 0xb0]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400a6100
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.1400a5310
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdx, qword [rsp + 0x98]
mov rcx, rax
call fcn.1400caf00
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x1400a617f
mov rax, qword [rsp + 0x30]
jmp 0x1400a61d5
cmp dword [rsp + 0x80], 0x17
jne 0x1400a61b4
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov r8d, 0x1b
mov edx, 0x29
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea rcx, [rsp + 0x38]
call fcn.1400a05e0
mov rdi, qword [rsp + 0x98]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400a67c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x1400a67fe
mov edx, 0x2719
mov rcx, qword [rsp + 0x80]
call fcn.1400cadd0
mov eax, 0xffffffff
jmp 0x1400a688b
call fcn.1400a5310
mov r8, qword [rsp + 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rdx, qword [rsp + 0x80]
mov ecx, eax
call fcn.1400caf90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x1400a6887
lea rcx, [rsp + 0x28]
call fcn.1400a05e0
mov rdi, qword [rsp + 0x80]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x70], 0x8004667e
jne 0x1400a6887
mov rax, qword [rsp + 0x78]
cmp dword [rax], 0
je 0x1400a6875
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
or eax, 1
mov rcx, qword [rsp + 0x68]
mov byte [rcx], al
jmp 0x1400a6887
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0x68]
mov byte [rcx], al
mov eax, dword [rsp + 0x20]
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400a68a0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x68
call fcn.1400a5310
cmp qword [rsp + 0x88], 0
jne 0x1400a695f
cmp qword [rsp + 0x90], 0
jne 0x1400a695f
cmp qword [rsp + 0x98], 0
jne 0x1400a695f
cmp qword [rsp + 0xa0], 0
je 0x1400a695f
mov rax, qword [rsp + 0xa0]
imul eax, dword [rax], 0x3e8
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rcx + 4]
cdq
mov ecx, 0x3e8
idiv ecx
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1400a6932
mov dword [rsp + 0x30], 1
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call fcn.1400a05e0
mov rdi, qword [rsp + 0xa8]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
xor eax, eax
jmp 0x1400a6a11
cmp qword [rsp + 0xa0], 0
je 0x1400a69a5
mov rax, qword [rsp + 0xa0]
cmp dword [rax], 0
jne 0x1400a69a5
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 4], 0
jle 0x1400a69a5
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 4], 0x3e8
jge 0x1400a69a5
mov rax, qword [rsp + 0xa0]
mov dword [rax + 4], 0x3e8
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_select]
mov rdx, qword [rsp + 0xa8]
mov ecx, eax
call fcn.1400caf90
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x1400a6a0d
lea rcx, [rsp + 0x50]
call fcn.1400a05e0
mov rdi, qword [rsp + 0xa8]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x34]
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1400a6dd0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
cmp qword [rsp + 0x78], 0
je 0x1400a6e0a
mov rax, qword [rsp + 0x78]
movsx eax, byte [rax]
test eax, eax
je 0x1400a6e0a
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
jmp 0x1400a6e13
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x80], 0
je 0x1400a6e46
mov rax, qword [rsp + 0x80]
movsx eax, byte [rax]
test eax, eax
je 0x1400a6e46
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
jmp 0x1400a6e4f
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
call fcn.1400a5310
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400a6c20
mov rdi, qword [rsp + 0x98]
mov rsi, rax
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400aa220
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140008050
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a39d0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x1400aa291
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a45e0
jmp 0x1400aa380
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.1400a9a00
movzx eax, al
test eax, eax
jne 0x1400aa2cb
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a45e0
jmp 0x1400aa380
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_WSASend]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x4d2
jne 0x1400aa337
mov dword [rsp + 0x40], 0x274d
cmp dword [rsp + 0x44], 0
je 0x1400aa36a
cmp dword [rsp + 0x40], 0x3e5
je 0x1400aa36a
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a45e0
jmp 0x1400aa380
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a4520
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x68
ret
Function at 0x1400aa3a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140008050
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a39d0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x1400aa411
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a45e0
jmp 0x1400aa51b
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.1400a9a00
movzx eax, al
test eax, eax
jne 0x1400aa44b
xor r9d, r9d
mov r8d, 0x2719
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a45e0
jmp 0x1400aa51b
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x40
jne 0x1400aa4c0
mov dword [rsp + 0x40], 0x2746
jmp 0x1400aa4d2
cmp dword [rsp + 0x40], 0x4d2
jne 0x1400aa4d2
mov dword [rsp + 0x40], 0x274d
cmp dword [rsp + 0x44], 0
je 0x1400aa505
cmp dword [rsp + 0x40], 0x3e5
je 0x1400aa505
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a45e0
jmp 0x1400aa51b
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 8]
call fcn.1400a4520
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x68
ret

Function at 0x1400b22a0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x10325476
ret
Function at 0x1400b4e20
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x108
lea rdx, [0x14035288f]
mov rcx, qword [0x14041c8e8]
call fcn.140042230
mov byte [rsp + 0x30], 0
lea rax, str.vape.gg
mov qword [rsp + 0x58], rax
call fcn.140097d00
movzx eax, al
test eax, eax
je 0x1400b4e76
cmp dword [rsp + 0x110], 0
jne 0x1400b4e76
lea rax, str.chink2.vape.gg
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x30], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov ecx, 0x20
call fcn.14027f9b4
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400b4eb7
mov edx, 0x20
mov rcx, qword [rsp + 0x40]
call fcn.140003df0
mov rcx, qword [rsp + 0x40]
call fcn.1400b50a0
mov qword [rsp + 0x60], rax
jmp 0x1400b4ec0
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1400b4f7c
mov ecx, 0x190
call fcn.14027f9b4
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1400b4f50
mov edx, 0x190
mov rcx, qword [rsp + 0x48]
call fcn.140003df0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x88]
call fcn.1400082a0
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x48]
call fcn.1400b4150
mov qword [rsp + 0x68], rax
jmp 0x1400b4f59
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
mov qword [rax + 8], rcx
jmp 0x1400b500c
mov ecx, 0x178
call fcn.14027f9b4
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400b4fe5
mov edx, 0x178
mov rcx, qword [rsp + 0x50]
call fcn.140003df0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
call fcn.1400082a0
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x50]
call fcn.1400b3160
mov qword [rsp + 0x78], rax
jmp 0x1400b4fee
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x38]
mov r9, qword [rax + 8]
lea r8, [0x1400b4dd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x38]
mov r9, qword [rax + 8]
lea r8, [0x1400b4da0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call fcn.1400b3320
movzx eax, al
test eax, eax
je 0x1400b5084
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400b5062
mov rax, qword [rsp + 0x38]
add rsp, 0x108
ret

Function at 0x1400c1ba0
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x28
ret
Function at 0x1400cafe0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_connect]
add rsp, 0x28
ret

Function at 0x1400cb0a0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400cb1d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rax, qword [0x1403d66b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_getsockname]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14027f960
add rsp, 0x38
ret