joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007a70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rcx
xor ebx, ebx
xor ecx, ecx
mov ebp, r9d
mov r14d, r8d
mov rdi, rdx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
call fcn.140199f14
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.140199bfc
lea r8, str._a___d__b__Y__H:_M:_S_GMT
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x50]
mov r9, rax
call fcn.140199be0
lea r8, [rsp + 0x50]
lea rdx, str.Date
mov rcx, rsi
call fcn.140008880
cmp qword [rsi + 8], rbx
je 0x140007b33
mov r8, qword [rsi + 0x10]
cmp ebp, 2
jne 0x140007b05
add r8, 3
jmp 0x140007b0e
cmp ebp, 1
jne 0x140007b0e
add r8, 2
lea rdx, [0x140227984]
lea rcx, [rsp + 0x50]
call fcn.140197bf8
lea r8, [rsp + 0x50]
lea rdx, str.Content_Length
mov rcx, rsi
call fcn.140008880
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, r14d
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call fcn.140008330
mov rbp, qword [rsp + 0x40]
test rbp, rbp
je 0x140007b71
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.140007e70
mov rcx, rbp
call fcn.1400266b0
lea rdx, str.Connection
mov rcx, rsi
call fcn.140008a70
test rax, rax
je 0x140007be3
lea rdx, str.close
nop dword [rax]
movzx ecx, byte [rax + rbx]
inc rbx
cmp cl, byte [rdx + rbx - 1]
jne 0x140007be3
cmp rbx, 6
jne 0x140007b90
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007be3
lea edx, [rbx - 5]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x140007bc0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14019aa20
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140007c10
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r15, r9
mov r12, r8
mov r13, rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov esi, dword [rsp + 0x420]
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x50], rax
xor ecx, ecx
call fcn.140199f14
add rax, 0xa
mov qword [rsp + 0x48], rax
cmp qword [r12], 0
jne 0x140007c93
mov dword [r15], 0x2000
mov ecx, 0x2000
call fcn.1400266b8
mov qword [r12], rax
xor esi, esi
mov eax, dword [r15]
cmp esi, eax
jl 0x140007cd1
mov rbx, qword [r12]
add eax, 0x2000
movsxd rcx, eax
call fcn.1400266b8
mov qword [r12], rax
movsxd r8, dword [r15]
mov rdx, rbx
mov rcx, rax
call fcn.140198760
mov rcx, rbx
call fcn.1400266b0
mov esi, dword [r15]
lea eax, [rsi + 0x2000]
mov dword [r15], eax
mov edi, dword [rsp + 0x30]
movsxd rcx, esi
mov r14, qword [r12]
add r14, rcx
mov r8d, dword [r15]
sub r8d, esi
xor r9d, r9d
mov rdx, r14
mov rcx, r13
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rsp + 0x50]
mov dword [rcx], eax
cmp ebx, 0xffffffff
jne 0x140007d67
mov edx, eax
sub edx, 0x2728
je 0x140007d20
sub edx, 0xb
je 0x140007d20
cmp edx, 0x14
jne 0x140007da7
xor ecx, ecx
call fcn.140199f14
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x60], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea ecx, [r9 + 0x40]
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x20], 0
je 0x140007d91
cmp ebx, 0xffffffff
je 0x140007d9a
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8d, ebx
mov rdx, r14
lea rcx, str.GetFromSocket
call fcn.14000bda0
cmp ebx, 0xffffffff
jne 0x140007e45
test edi, edi
jle 0x140007e45
jmp 0x140007cd5
mov r8d, eax
lea rdx, str.HTTP::GetFromSocket_recv_returns__d
lea rcx, [rsp + 0x270]
call fcn.140197bf8
or edx, 0xffffffff
mov rcx, qword [0x14027d328]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d200], 0
je 0x140007e38
call fcn.140009400
lea rcx, [0x140227d9c]
lea rdx, [0x140227da0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d200]
call fcn.140197bc8
mov rdi, rax
test rax, rax
je 0x140007e38
lea rcx, [rsp + 0x2b0]
call fcn.14000c430
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x2b0]
lea rdx, str._n_s__s_n
mov rcx, rdi
call fcn.14019c0ec
mov rcx, rdi
call fcn.14019be84
mov rcx, qword [0x14027d328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
jmp 0x140007e4c
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009400
Capabilities:
Move file

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp byte [0x14027d200], 0
je 0x140009539
cmp dword [0x14027d0e0], 0
je 0x140009539
mov qword [rsp + 0x240], rbx
call fcn.140009360
test al, al
je 0x140009535
mov r8d, dword [reloc.WS2_32.dll_accept]
lea rdx, str._04d
lea rcx, [rsp + 0x130]
call fcn.140197bf8
or rcx, 0xffffffffffffffff
lea rbx, [0x14027d200]
mov rax, rcx
inc rax
cmp byte [rbx + rax], 0
jne 0x140009471
lea rdx, [rsp + 0x130]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140009482
add rax, rcx
cmp rax, 0x104
ja 0x140009535
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rcx + rbx]
lea rcx, [rcx + 1]
mov byte [rsp + rcx + 0x1f], al
test al, al
jne 0x1400094a0
lea rdx, [rsp + 0x20]
dec rdx
nop dword [rax + rax]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x1400094c0
lea rcx, [rsp + 0x130]
xor r8d, r8d
nop word [rax + rax]
movzx eax, byte [rcx + r8]
lea r8, [r8 + 1]
mov byte [rdx + r8 - 1], al
test al, al
jne 0x1400094e0
lea rcx, [rsp + 0x20]
call fcn.14019d564
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14019d41c
test eax, eax
jne 0x140009513
inc dword [reloc.WS2_32.dll_accept]
mov al, 1
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x248
ret
xor al, al
jmp 0x140009515
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x248
ret
Function at 0x14000a6a0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x198
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx eax, word [rsp + 0x1d0]
mov r11, r8
xor r8d, r8d
mov rbx, rcx
mov dword [rcx], r8d
mov ecx, 2
mov dword [rsp + 0x34], r9d
mov r10, rdx
mov word [rsp + 0x32], ax
mov word [rsp + 0x30], cx
lea r9, [rsp + 0x38]
nop dword [rax]
inc r8d
mov byte [r9], 0
lea r9, [r9 + 1]
movsxd rax, r8d
cmp rax, 8
jb 0x14000a6f0
xor r9d, r9d
lea rax, [rsp + 0x30]
mov rdx, r11
lea r8d, [r9 + 8]
mov rcx, r10
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14000a7dc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Broadcast_Send_sendto_returns__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.140197bf8
mov rcx, qword [0x14027d328]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d200], 0
je 0x14000a7cd
call fcn.140009400
lea rcx, [0x140227d9c]
lea rdx, [0x140227da0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d200]
call fcn.140197bc8
mov rbx, rax
test rax, rax
je 0x14000a7cd
lea rcx, [rsp + 0x80]
call fcn.14000c430
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, str._n_s__s_n
mov rcx, rbx
call fcn.14019c0ec
mov rcx, rbx
call fcn.14019be84
mov rcx, qword [0x14027d328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000a81e
cmp dword [0x14027d0e0], 0
je 0x14000a820
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsp + 0x34]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, str.Bcast_sent_to__s_port__d
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov r8, rax
call fcn.140197bf8
lea rcx, [rsp + 0x40]
call fcn.14000c360
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x198
pop rdi
pop rbx
ret
Function at 0x14000c500
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
xor edi, edi
call fcn.14019ab30
test rbx, rbx
je 0x14000c5df
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x14027d390], eax
cmp eax, 0xffffffff
je 0x14000c55c
lea rax, [0x14027d390]
jmp 0x14000c5be
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x14000c570
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000c5b4
lea edx, [rax + 0x2e]
lea rcx, [rsp + 0x20]
call fcn.140198cc8
test rax, rax
je 0x14000c5bb
lea rcx, [rsp + 0x20]
mov byte [rax], dil
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000c5bb
mov rax, qword [rax + 0x18]
mov rdi, qword [rax]
mov rax, rdi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019aa20
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x14000c57f
xor eax, eax
jmp 0x14000c5be
Function at 0x14000c600
Capabilities:
Connect socket
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebx, ebx
mov ebp, 2
or rdi, 0xffffffffffffffff
mov rsi, rdx
mov r14, rcx
mov dword [rcx], ebx
mov word [rsp + 0x28], bp
test r8w, r8w
je 0x14000c64a
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c66c
lea rcx, str.TrilliumDirector
xor edx, edx
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
jne 0x14000c668
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c66c
movzx eax, word [rax + 0x18]
mov rcx, rsi
mov word [rsp + 0x2a], ax
call fcn.14000c500
test rax, rax
je 0x14000c71d
mov eax, dword [rax]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], eax
nop dword [rax]
inc ebx
mov byte [rcx], 0
lea rcx, [rcx + 1]
movsxd rax, ebx
cmp rax, 8
jb 0x14000c690
cmp dword [0x14027d0e0], 0
je 0x14000c6e4
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsp + 0x2c]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, str.Connecting_to__s_port__d
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov r8, rax
call fcn.140197bf8
lea rcx, [rsp + 0x40]
call fcn.14000c360
xor r8d, r8d
mov ecx, ebp
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c71d
lea rdx, [rsp + 0x28]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14000c71d
mov rax, rdi
jmp 0x14000c817
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [r14], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.ConnectToSocket_returns__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.140197bf8
mov rcx, qword [0x14027d328]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d200], 0
je 0x14000c7c5
call fcn.140009400
lea rcx, [0x140227d9c]
lea rdx, [0x140227da0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d200]
call fcn.140197bc8
mov rbx, rax
test rax, rax
je 0x14000c7c5
lea rcx, [rsp + 0x80]
call fcn.14000c430
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, str._n_s__s_n
mov rcx, rbx
call fcn.14019c0ec
mov rcx, rbx
call fcn.14019be84
mov rcx, qword [0x14027d328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c813
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop word [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000c7f0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000c840
Capabilities:
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebx, ebx
mov rsi, rdx
mov ebp, r8d
mov r14, rcx
mov dword [rcx], ebx
mov r15d, 2
lea edx, [rbx + 1]
xor r8d, r8d
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c975
lea r8, [rsp + 0x28]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x28], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movzx ecx, word [rsi]
mov word [rsp + 0x30], r15w
test ebp, ebp
je 0x14000c8c3
mov word [rsp + 0x32], cx
jmp 0x14000c8f7
test cx, cx
je 0x14000c8d0
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c8f2
lea rcx, str.TrilliumDirector
xor edx, edx
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
jne 0x14000c8ee
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c8f2
movzx eax, word [rax + 0x18]
mov word [rsp + 0x32], ax
mov dword [rsp + 0x34], ebx
mov rax, rbx
nop
inc ebx
mov byte [rsp + rax + 0x38], 0
movsxd rax, ebx
mov dword [rsp + 0x24], ebx
cmp rax, 8
jb 0x14000c900
lea rdx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
mov dword [rsp + 0x24], eax
cmp eax, 0xffffffff
je 0x14000c975
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, 0x7fffffff
mov rcx, rdi
mov word [rsi], ax
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x14000c975
mov rax, rdi
jmp 0x14000ca67
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [r14], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.ListenOnSocket_returns__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.140197bf8
mov rcx, qword [0x14027d328]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d200], 0
je 0x14000ca0f
call fcn.140009400
lea rcx, [0x140227d9c]
lea rdx, [0x140227da0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d200]
call fcn.140197bc8
mov rbx, rax
test rax, rax
je 0x14000ca0f
lea rcx, [rsp + 0x80]
call fcn.14000c430
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, str._n_s__s_n
mov rcx, rbx
call fcn.14019c0ec
mov rcx, rbx
call fcn.14019be84
mov rcx, qword [0x14027d328]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ca63
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000ca40
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14019aa20
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ca90
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ebp, 2
mov rsi, rcx
xor ebx, ebx
mov dword [rcx], ebx
mov ecx, ebp
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000cb90
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x38], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x34]
lea r8d, [rbx + 0x20]
mov edx, 0xffff
mov rcx, rdi
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea rcx, str.TrilliumDirector
xor edx, edx
mov word [rsp + 0x40], bp
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
jne 0x14000cb44
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000cb48
movzx eax, word [rax + 0x18]
mov word [rsp + 0x42], ax
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x48]
nop word [rax + rax]
inc ebx
mov byte [rcx], 0
lea rcx, [rcx + 1]
movsxd rax, ebx
cmp rax, 8
jb 0x14000cb60
lea rdx, [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x14000cb90
mov rax, rdi
jmp 0x14000cc07
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsi], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.GetBroadcastSocket_returns__d
lea rcx, [rsp + 0x50]
mov r8d, eax
call fcn.140197bf8
lea rcx, [rsp + 0x50]
call fcn.14000c360
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000cc03
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000cbe0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14019aa20
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000cc30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [rcx - 1]
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14000cc73
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
nop
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000cc50
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
add rsp, 0x20
pop rbx
ret
Function at 0x14000cc80
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000cce3
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14000ccd8
shr ax, 8
test al, al
jne 0x14000ccd8
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x276c
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x1d8
ret
Function at 0x14000d4c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r8d, cx
mov esi, edx
lea rcx, [rsp + 0x34]
xor edx, edx
xor edi, edi
call fcn.14000c600
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d504
mov eax, dword [rsp + 0x34]
jmp 0x14000d5d5
mov ecx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_listen
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x38], eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov byte [rsp + 0x44], 1
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], eax
lea rax, str.Srv___Srv
mov r9d, esi
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
mov byte [rsp + 0x45], dil
mov qword [rsp + 0x20], rax
call fcn.140009ed0
cmp eax, 0xffffffff
jne 0x14000d590
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test rbx, rbx
je 0x14000d5d3
mov edx, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000d5b0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14019aa20
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000ec10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0xf8]
mov rsi, rcx
mov rcx, qword [r9]
mov r12, rdx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], r15
mov rbx, r9
xor ebp, ebp
call fcn.14000d690
mov rdi, qword [rsp + 0x38]
cmp eax, 0xfffffffe
je 0x14000edaa
cmp eax, 0xffffffff
je 0x14000ed48
test eax, eax
je 0x14000ed93
test rdi, rdi
je 0x14000ee21
movzx r8d, byte [rdi + 0xc]
mov ecx, r8d
dec ecx
je 0x14000ed1e
sub ecx, 3
je 0x14000ed06
sub ecx, 2
je 0x14000eceb
dec ecx
je 0x14000ecde
cmp ecx, 2
je 0x14000eccc
lea rdx, str.ProcessLoop_encountered_unexpected_request__2.2x
lea rcx, [rsp + 0x40]
call fcn.140197bf8
lea rcx, [rsp + 0x40]
call fcn.14000c360
jmp 0x14000ee14
mov rcx, qword [rbx]
mov rdx, rdi
call fcn.14000f0b0
mov ebp, eax
jmp 0x14000ee14
mov rcx, qword [rbx]
call fcn.14000a310
jmp 0x14000ee14
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rbx]
mov r9, rdi
mov rcx, rsi
call fcn.14000f1a0
jmp 0x14000ee14
mov r9, qword [rbx]
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.14000efc0
jmp 0x14000ee14
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcessId
cmp ebx, eax
je 0x14000ed3e
lea rdx, str.Shutdown_request_has_been_received_from_an_external_process
xor ecx, ecx
call qword [rsi + 0x28]
mov ebp, 0xfffffffe
jmp 0x14000ee14
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rsi, qword [rbx]
mov ebp, eax
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ed93
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rsi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000ed70
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [r14]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000ee04
mov rax, qword [r15]
mov rdx, qword [rbx]
mov rcx, r15
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x14000ee14
mov rcx, qword [r14]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [rbx]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ee04
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_shutdown]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rsi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000ede1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test rdi, rdi
je 0x14000ee21
mov rcx, rdi
call fcn.1401982c4
mov eax, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14019aa20
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret