joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140194ce0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
xor edi, edi
movzx esi, r8b
mov rbx, rcx
cmp eax, 0x64
jb 0x140194d1d
lea rdx, str.Couldnt_set_desired_mode
call fcn.14016eee0
lea eax, [rdi + 0x11]
jmp 0x140194d79
cmp edx, 0xc8
je 0x140194d34
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.14016f070
cmp sil, 0x13
jne 0x140194d47
mov rdx, rbp
mov rcx, rbx
call fcn.140194930
jmp 0x140194d75
cmp sil, 0x14
jne 0x140194d57
mov rcx, rbx
call fcn.1401936e0
jmp 0x140194d75
cmp sil, 0x15
jne 0x140194d62
mov r8b, reloc.WS2_32.dll_listen
jmp 0x140194d6b
cmp sil, 0x16
jne 0x140194d77
mov r8b, ntohs
mov dl, 1
mov rcx, rbx
call fcn.140194420
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401985f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x198]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x140198671
sub r8d, 1
je 0x140198648
cmp r8d, 1
jne 0x140198685
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140198669
cmp ecx, r8d
jne 0x140198685
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
jmp fcn.140198810
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x140198669
cmp ecx, 1
jne 0x140198685
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
jmp fcn.140198810
ret

Function at 0x140198690
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x198]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x140198734
sub r8d, 2
je 0x1401986ed
cmp r8d, 1
jne 0x140198726
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x1401986e0
cmp ecx, r8d
jne 0x140198726
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
ret
mov dword [r9 + r10*4 + 0xc08], 0
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x140198727
cmp ecx, 1
jne 0x140198726
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
jmp fcn.140198810
ret
mov dword [r9 + r10*4 + 0xc08], 1
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x140198719
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
jmp fcn.140198810

Function at 0x140198760
Capabilities:
Send data
Send data on socket

Disassembly:
mov r9, qword [rcx + 0x198]
mov r11, rcx
movsxd r10, edx
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x1401987ed
sub r8d, 1
je 0x1401987be
cmp r8d, 1
jne 0x140198804
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x1401987e2
cmp ecx, r8d
jne 0x140198804
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.140198810
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x1401987e2
cmp ecx, 1
jne 0x140198804
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.140198810
ret
Function at 0x140198810
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rsp + 0x38], 0xff
mov rcx, qword [rcx + 0x20]
mov edi, r8d
mov esi, edx
mov byte [rsp + 0x3a], dil
xor r9d, r9d
mov byte [rsp + 0x39], sil
lea rdx, [rsp + 0x38]
mov rcx, qword [rcx + 0x1d8]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14019886f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.14016eee0
mov r9d, edi
lea rdx, str.SENT
mov r8d, esi
mov rcx, rbx
call fcn.140198030
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140198a10
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140198bbf
push rsi
push rdi
push r15
sub rsp, 0x30
mov rdi, qword [rcx + 0x198]
mov rsi, rcx
mov r15, qword [rcx + 0x20]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rbp
lea rbx, [rdi + 0x1eb8]
mov qword [rsp + 0x20], r14
lea r14, [rdi + 0x1cb8]
mov qword [rbx], r14
cmp r14, rbx
jae 0x140198a5b
mov byte [r14], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140198a69
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140198a77
mov byte [rax], Ordinal_33
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx ebp, ax
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r8d, ax
mov word [rsp + 0x50], ax
cmp rcx, rbx
jae 0x140198ab0
mov byte [rcx], bpl
inc qword [rbx]
mov rdx, qword [rbx]
mov rbp, qword [rsp + 0x28]
cmp rdx, rbx
jae 0x140198ac7
movzx ecx, byte [rsp + 0x59]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140198ad5
mov byte [rax], r8b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x140198ae7
movzx eax, byte [rsp + 0x51]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140198af5
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140198b03
mov byte [rax], 0xf0
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov r9, rax
mov qword [rdi + 0x1ec0], rax
sub r9, r14
mov qword [rbx], r14
sub r9, 2
mov edx, 0x3e
mov rcx, rsi
call fcn.140198170
mov rcx, qword [r15 + 0x1d8]
xor r9d, r9d
mov rdx, r14
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
test eax, eax
jns 0x140198b6b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.14016eee0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, rsi
call fcn.1401988a0
mov rcx, qword [r15 + 0x1d8]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140198bb7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.14016eee0
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x140199de0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x20]
mov rsi, rcx
xor r9d, r9d
xor edi, edi
mov rbx, qword [rax + 0x600]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rbx + 0x144]
mov rdx, qword [rbx + 0x150]
add r8d, 4
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rbx + 0x13c], eax
cmp dword [rbx + 0x138], edi
jne 0x140199e76
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xb8]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x138], eax
mov r8d, dword [rbx + 0x13c]
cmp r8d, 4
jge 0x140199eb6
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.14016eee0
mov dword [rbx + 0xc], 7
mov eax, edi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1401b4da0
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rbx + 0x150]
movzx ecx, byte [rax]
movzx edx, byte [rax + 1]
shl ecx, 8
or edx, ecx
mov dword [rbx + 0xc], edx
sub edx, 3
je 0x140199fb0
sub edx, 1
je 0x140199f89
sub edx, 1
je 0x140199f1b
cmp edx, 1
je 0x140199f03
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x14022a9f0]
call fcn.14016eee0
jmp 0x140199f89
add r8d, 0xfffffffe
lea rdx, [rax + 2]
mov rcx, rbx
call fcn.140199a50
mov edi, eax
test eax, eax
je 0x140199f89
jmp 0x140199e9b
mov qword [rsp + 0xf8], rbp
xor edx, edx
lea rbp, [rax + 4]
mov qword [rsp + 0x100], r14
lea eax, [r8 - 4]
movsxd r14, eax
mov rax, qword [rbx + 0x150]
mov r8, r14
movzx ecx, byte [rax + 2]
movzx eax, byte [rax + 3]
shl ecx, 8
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rbp
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140199f79
sub rax, rbp
cmp rax, r14
jae 0x140199f79
mov r8, rbp
lea rdx, str.TFTP_error:__s
mov rcx, rsi
call fcn.14016f070
mov rbp, qword [rsp + 0xf8]
mov r14, qword [rsp + 0x100]
mov rcx, rsi
call fcn.1401806c0
test eax, eax
je 0x140199e99
mov edx, 5
mov rcx, rbx
call fcn.14019aa00
mov eax, Ordinal_46
jmp 0x140199e9b
cmp r8d, 4
jle 0x140199f89
movzx ecx, byte [rax + 2]
movzx eax, byte [rax + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x14c]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140199f89
lea eax, [r8 - 4]
mov edx, 1
mov r8, qword [rbx + 0x150]
mov rcx, rsi
add r8, 4
movsxd r9, eax
call fcn.14016f5d0
mov edi, eax
test eax, eax
je 0x140199f89
mov edx, 5
mov rcx, rbx
call fcn.14019aa00
jmp 0x140199e99
Function at 0x14019aa00
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rcx]
mov r9, qword [rcx + 0x10]
test r8d, r8d
je 0x14019aa67
sub r8d, 1
je 0x14019aa5e
sub r8d, 1
je 0x14019aa55
lea rdx, [0x14022a9f0]
mov rcx, r9
cmp r8d, 1
je 0x14019aa42
lea r8, str.Internal_state_machine_error
call fcn.14016eee0
mov eax, 0x47
add rsp, 0x28
ret
lea r8, str.TFTP_finished
call fcn.14016f070
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.14019ab70
add rsp, 0x28
jmp fcn.14019a010
add rsp, 0x28
jmp fcn.14019a350
Function at 0x1401a4ab0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1404bd588]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x1401a4b14
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.1401a7010
test al, al
je 0x1401a4b08
mov dword [0x1404bd588], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x1404bd588], 1
jmp 0x1401a4b19
cmp eax, 2
je 0x1401a4b6b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1401a4b4a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x1401a4b6b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1401a5560
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rcx + 0x10]
mov rdi, rdx
mov rsi, rcx
mov r8d, dword [rbx + 0x14]
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401a55ba
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rbx + 0xe0]
mov rcx, rdi
mov r8d, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
jmp fcn.1401a5c30
mov rdx, rdi
mov rcx, rsi
call fcn.1401a5980
cmp dword [rbx], 5
lea rax, str.QUIC
lea rcx, [rbx + 0xe0]
lea rdx, [rbx + 0x114]
lea r9, [0x14023737c]
cmove r9, rax
lea r8, str._s_socket__qd_connected:___s:_d_______s:_d_
mov eax, dword [rbx + 0x110]
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0x144]
mov qword [rsp + 0x38], rcx
mov rcx, rdi
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x98]
mov qword [rsp + 0x28], rdx
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.14016f110
mov rcx, qword [rbx + 0x98]
mov edx, 1
call fcn.1401ac530
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1401a5780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x148
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rax, qword [rcx]
mov rdi, rcx
mov rsi, r9
mov rbp, r8
mov rcx, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x1401a581e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1401a57e5
mov dword [rsi], 0x51
jmp 0x1401a581a
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov ecx, ebx
call fcn.140182020
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.14016eee0
mov rax, qword [rdi + 8]
mov dword [rax + 0xd64], ebx
mov dword [rsi], Ordinal_60
or rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x28], edx
mov rdx, qword [rdi]
mov dword [rsp + 0x20], ebx
call fcn.14016f110
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401b4da0
add rsp, 0x148
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401a5980
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rsi, rdx
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rax + 0x318]
test dword [rcx + 0x84], 0x800
jne 0x1401a5a9f
xor edx, edx
mov dword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1401a5a2f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140182020
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.14016eee0
mov eax, 2
jmp 0x1401a5aa1
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x144]
lea r8, [rbx + 0x114]
lea rcx, [rsp + 0x30]
call fcn.140170600
test al, al
jne 0x1401a5a9f
mov qword [rsp + 0x1e0], rdi
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ebx, dword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140182020
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.14016eee0
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x1401a5aa1
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1401b4da0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret

Function at 0x1401a5d60
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0xaa3], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401a5dcf
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d
mov rcx, rbx
call fcn.14016f070
jmp 0x1401a5e5e
mov ecx, dword [rbx + 0xa14]
mov dword [rsp + 0x58], 1
call fcn.140171a90
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xa18]
call fcn.140171a90
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, recvfrom
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1401a5e5e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
mov r9d, eax
mov rcx, rbx
call fcn.14016f070
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1401b4da0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401a5e80
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140256ad8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rbx, rcx
lea r9, [rsp + 0x30]
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401a5ef6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.140182020
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
call fcn.14016f070
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401b4da0
add rsp, 0x150
pop rbx
ret
Function at 0x1401b2f60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1401b2fa2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1401b2fe5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1401b3042
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1401b3000
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401b3083
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140239e51]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140239e52]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401b3050
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1401b52c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401b530e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401b530e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401b530e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401b530e
cmp dword [rcx + 0x84], 0xe
jbe 0x1401b530e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401b5310
xor al, al
add rsp, 0x28
ret
Function at 0x1401b5648
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1401b56cc
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1401b56cc
dec r8
sub rdx, 1
jne 0x1401b56b2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140001db0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001dd1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001dfe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001e00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001e59
test ecx, ecx
jle 0x140001e39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001e59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001e59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al