joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100261e0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x10026b70
Capabilities:
Get mac address on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov dword [rcx], 0
mov rbp, rcx
mov qword [rsp + 0x78], rdi
mov ecx, 0x2c0
mov qword [rsp + 0x50], r12
xor r12b, r12b
mov esi, edx
call qword [sym.imp.msvcrt.dll_malloc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x2c0
mov rcx, rax
mov rdi, rax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10026bdd
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x10026d41
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x60], rbx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x10026d2b
test rdi, rdi
mov rbx, rdi
je 0x10026d39
cmp dword [rbx + 0x194], 6
jne 0x10026d1f
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
mov r11, rax
je 0x10026d1f
lea r9, [rbx + 0x1b8]
test r9, r9
je 0x10026d1f
nop
nop
nop
lea r8, [r9 + 8]
mov rax, r11
sub r8, r11
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x10026c63
inc rax
test ecx, ecx
jne 0x10026c50
test edx, edx
je 0x10026c74
mov r9, qword [r9]
test r9, r9
jne 0x10026c40
jmp 0x10026d1f
movzx edx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x19b]
movzx r11d, byte [rbx + 0x19a]
movzx r9d, byte [rbx + 0x199]
movzx r8d, byte [rbx + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
lea rdx, [0x10048d88]
lea rcx, [rbp + 4]
mov r12b, 1
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
movzx r11d, byte [rbx + 0x198]
mov byte [rbp + 0x84], r11b
movzx eax, byte [rbx + 0x199]
mov byte [rbp + 0x85], al
movzx eax, byte [rbx + 0x19a]
mov byte [rbp + 0x86], al
movzx eax, byte [rbx + 0x19b]
mov byte [rbp + 0x87], al
movzx eax, byte [rbx + 0x19c]
mov byte [rbp + 0x88], al
movzx eax, byte [rbx + 0x19d]
mov dword [rbp], 1
mov byte [rbp + 0x89], al
mov rbx, qword [rbx]
test rbx, rbx
jne 0x10026c03
test rdi, rdi
je 0x10026d39
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x60]
mov al, r12b
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x58
ret
Function at 0x10027450
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor al, al
add rsp, 0x28
ret

Function at 0x10027470
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
cmp ecx, 1
jl 0x1002747e
cmp ecx, 3
jle 0x100274b0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
movzx r11d, ax
jne 0x10027498
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
mov ecx, 3
cmp r11w, 0x404
cmove eax, ecx
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x10027580
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [0x10058650]
mov qword [rsp + 0x100], rax
cmp byte [0x1005ce30], 0
jne 0x100277b9
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x64]
xor ebx, ebx
xor edx, edx
mov r8d, 0x98
mov dword [rsp + 0x60], ebx
mov qword [r11 + 0x20], rdi
call sub.msvcrt.dll_memset
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x2c]
xor edx, edx
mov dword [rsp + 0x28], ebx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov dword [0x1005ce54], ebx
call fcn.10021f70
lea rdx, [0x10049048]
test rdx, rdx
mov rsi, rbx
je 0x1002761b
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1002761b
mov rcx, rdx
call sub.KERNEL32.dll_LoadLibraryA
mov rsi, rax
lea rdx, [0x10049058]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
mov rcx, rsi
mov rdi, rax
call fcn.10021f70
test rdi, rdi
mov rsi, qword [rsp + 0x130]
je 0x1002764b
lea rcx, [rsp + 0x28]
call rdi
jmp 0x10027656
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1002777c
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
movzx eax, word [rsp + 0x6c]
cmp edx, 5
mov dword [0x1005ce44], edx
mov dword [0x1005ce48], ecx
mov dword [0x1005ce50], eax
jne 0x10027733
test ecx, ecx
jne 0x100276ac
mov dword [0x1005ce40], 1
jmp 0x100277a9
cmp ecx, 1
jne 0x100276c0
mov dword [0x1005ce40], 2
jmp 0x100277a9
cmp ecx, 2
jne 0x100277a9
cmp byte [rsp + 0xfa], 1
jne 0x100276ea
cmp word [rsp + 0x28], 9
jne 0x100276ea
mov dword [0x1005ce40], 3
jmp 0x100277a9
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10027727
cmp word [rsp + 0xf8], 0x8000
je 0x10027727
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100277a9
mov dword [0x1005ce40], 5
jmp 0x100277a9
mov dword [0x1005ce40], 4
jmp 0x100277a9
cmp edx, 6
jne 0x100277a9
test ecx, ecx
jne 0x10027751
cmp byte [rsp + 0xfa], 1
setne bl
add ebx, edx
mov dword [0x1005ce40], ebx
jmp 0x100277a9
cmp ecx, 1
jne 0x1002776b
cmp byte [rsp + 0xfa], cl
sete bl
add ebx, 8
mov dword [0x1005ce40], ebx
jmp 0x100277a9
cmp ecx, 2
jne 0x100277a9
mov dword [0x1005ce40], 0xa
jmp 0x100277a9
xor ecx, ecx
call fcn.100205e0
lea rdx, [0x10049070]
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.10027af0
lea rdx, str._comm__detect_OS_type_failed:__s
mov rcx, rax
mov r8, rdi
call fcn.10027bf0
mov rbx, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x138]
mov byte [0x1005ce30], 1
mov rcx, qword [rsp + 0x100]
call fcn.10042170
add rsp, 0x118
ret
Function at 0x10027b10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
lea rsi, [0x1005cee0]
xor edx, edx
mov r8d, 0x5000
mov rcx, rsi
mov qword [rsp + 0x40], rdi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x30]
lea rdi, [rsp + 0x70]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x32], rax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
movzx r11d, word [rsp + 0x3c]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x100490e0]
mov rcx, rsi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_swprintf]
mov rdx, qword [rsp + 0x68]
mov r8, rdi
movsxd rbx, eax
lea rcx, [rsi + rbx*2]
call qword [sym.imp.msvcrt.dll_vswprintf]
lea rdx, [0x10049108]
add eax, ebx
cdqe
lea rcx, [rsi + rax*2]
call qword [sym.imp.msvcrt.dll_swprintf]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x10027bf0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2801
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], rdi
call fcn.10001fc0
xor eax, eax
lea rcx, [rsp + 0x30]
lea rsi, [rsp + 0x90]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x32], rax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
movzx r11d, word [rsp + 0x3c]
mov rdi, qword [rsp + 0x50]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.__02u:_02u:_02u__s
mov rcx, rdi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
mov rdx, qword [rsp + 0x88]
mov r8, rsi
movsxd rbx, eax
lea rcx, [rdi + rbx]
call qword [sym.imp.msvcrt.dll_vsprintf]
lea rdx, [0x100490dc]
add ebx, eax
movsxd rcx, ebx
add rcx, rdi
call qword [sym.imp.msvcrt.dll_sprintf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rdi, rdi
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
je 0x10027cde
mov rcx, rdi
call fcn.10041bb0
mov rdi, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x10029b40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x10058650]
mov qword [rsp + 0xe0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rbp, rcx
mov rbx, rdx
lea rcx, [rsp + 0x51]
mov r8d, 0x87
xor edx, edx
mov qword [r11 - 8], rsi
mov byte [rsp + 0x50], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x50]
xor esi, esi
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x10029c69
mov qword [rsp + 0xf8], rdi
movsxd rdi, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [rsp + 0x30], eax
je 0x10029c58
lea rcx, [rsp + 0x38]
mov edx, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call fcn.10001fc0
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10029c4b
lea edx, [rsi + 1]
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call fcn.10001fc0
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.10028d50
mov rsi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, rbp
call fcn.10029280
test rsi, rsi
je 0x10029c4b
mov rcx, rsi
call fcn.10041bb0
test rbx, rbx
je 0x10029c58
mov rcx, rbx
call fcn.10041bb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
call fcn.10042170
add rsp, 0x108
ret

Function at 0x1002afe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rcx, qword [rcx]
mov rax, r8
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rdi, rdx
lea rdx, [r11 - 0x18]
mov qword [r11 - 0x20], rdx
lea rdx, [r11 - 0x14]
lea r9, [r11 - 0x10]
mov qword [r11 - 0x28], rdx
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, eax
jne 0x1002b03b
mov ecx, dword [rsp + 0x34]
mov dword [rdi], ecx
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.RegQueryValueEx_failed:_d.
mov ecx, 4
mov r8d, eax
call fcn.10020320
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x1002b070
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2878
call fcn.100421a0
sub rsp, rax
mov rax, qword [0x10058650]
mov qword [rsp + 0x2840], rax
mov qword [rsp + 0x2870], rbx
mov qword [rsp + 0x2868], rbp
mov rbx, rcx
mov qword [rsp + 0x2860], rsi
mov rbp, rdx
mov rsi, r8
lea rcx, [rsp + 0x41]
mov r8d, 0x27ff
xor edx, edx
mov qword [rsp + 0x2858], rdi
mov dword [rsp + 0x30], 0x2800
mov byte [rsp + 0x40], 0
mov rdi, r9
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
lea r11, [rsp + 0x30]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rdi, qword [rsp + 0x2858]
test eax, eax
mov ebx, eax
jne 0x1002b145
mov rax, qword [rsi]
mov edx, dword [rsp + 0x30]
test rax, rax
je 0x1002b11e
cmp rax, rdx
jbe 0x1002b121
mov qword [rsi], rdx
mov r8, qword [rsi]
test r8, r8
je 0x1002b143
lea rdx, [rsp + 0x40]
dec r8
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncpy]
mov r11, qword [rsi]
mov byte [r11 + rbp - 1], 0
mov eax, ebx
mov rsi, qword [rsp + 0x2860]
mov rbp, qword [rsp + 0x2868]
mov rbx, qword [rsp + 0x2870]
mov rcx, qword [rsp + 0x2840]
call fcn.10042170
add rsp, 0x2878
ret

Function at 0x1002b1d0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x1002b210
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
pop rdi
ret
Function at 0x1002d760
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x48], r13
mov ebp, r8d
mov rbx, rdx
mov r13, rcx
jne 0x1002d7c6
lea rdx, [0x10049608]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:_Invalid_Socket.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
test rdx, rdx
jne 0x1002d80f
lea rdx, [0x10049648]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:_NULL_buffer.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
test r8d, r8d
mov esi, r12d
je 0x1002d8a4
nop
nop
mov rcx, qword [r13]
movsxd rdx, r12d
xor r9d, r9d
add rdx, rbx
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov esi, eax
je 0x1002d85a
test eax, eax
je 0x1002d8a4
add r12d, eax
sub ebp, eax
jne 0x1002d830
jmp 0x1002d8a4
mov qword [rsp + 0x78], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.100205e0
lea rdx, [0x10049680]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10027af0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10027bf0
mov rdi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
test ebp, ebp
mov rbp, qword [rsp + 0x68]
cmove esi, r12d
mov r12, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x58
ret
Function at 0x1002d8d0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r13
mov ebp, r9d
mov r13, rcx
mov rbx, r8
mov rdi, rdx
jne 0x1002d92f
lea rdx, [0x100496b0]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:_Invalid_Socket.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
jmp 0x1002da09
test rbx, rbx
jne 0x1002d967
lea rdx, [0x100496f0]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:_NULL_buffer.
mov rcx, rax
call fcn.10027bf0
lea eax, [rbx - 1]
jmp 0x1002da09
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
test r9d, r9d
mov esi, r12d
je 0x1002d9f7
mov rcx, qword [r13]
movsxd rdx, r12d
xor r9d, r9d
mov r8d, ebp
add rdx, rbx
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
mov esi, eax
je 0x1002d9b7
test eax, eax
je 0x1002d9f7
add r12d, eax
sub ebp, eax
jne 0x1002d980
jmp 0x1002d9f7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.100205e0
lea rdx, [0x10049730]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10027af0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10027bf0
test ebp, ebp
cmove esi, r12d
mov r12, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1002dae0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rcx
mov rcx, qword [rcx]
mov ebx, r8d
cmp rcx, 0xffffffffffffffff
jne 0x1002db3c
lea rdx, [0x10049760]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:_Invalid_Socket.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
test rdx, rdx
jne 0x1002db80
lea rdx, [0x100497a0]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:_NULL_buffer.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
cmp byte [rsi + 8], 0
mov qword [rsp + 0x58], rbp
je 0x1002dba4
mov r8d, 1
test ebx, ebx
cmovg r8d, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
jmp 0x1002dbd2
lea rax, [rsp + 0x30]
mov r8d, 1
test ebx, ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
cmovg r8d, ebx
xor r9d, r9d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1002dc23
mov qword [rsp + 0x68], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.100205e0
lea rdx, [0x100497d8]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10027af0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10027bf0
mov rdi, qword [rsp + 0x68]
jmp 0x1002dc56
test ebp, ebp
jne 0x1002dc56
test ebx, ebx
jle 0x1002dc56
lea rdx, [0x10049808]
lea rcx, [rsp + 0x30]
call fcn.10027af0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_info:_The_connection_has_been_gracefully_closed.
mov rcx, rax
call fcn.10027bf0
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x1002dc80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov rdi, r9
mov r13d, r8d
mov rbx, rdx
mov r12, rcx
jne 0x1002dce1
lea rdx, [0x10049860]
lea rcx, [rsp + 0x38]
call fcn.10027af0
mov r9d, dword [r12 + 0x8c]
lea r8, [r12 + 9]
lea rdx, str._comm__Socket__s:_d_::recv_all_error:_Invalid_Socket.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
jmp 0x1002ddf8
test rdx, rdx
jne 0x1002dd1d
lea rdx, [0x100498a0]
lea rcx, [rsp + 0x38]
call fcn.10027af0
mov r9d, dword [r12 + 0x8c]
lea r8, [r12 + 9]
lea rdx, str._comm__Socket__s:_d_::recv_all_error:_NULL_buffer.
mov rcx, rax
call fcn.10027bf0
mov eax, 0xffffffff
jmp 0x1002ddf8
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor esi, esi
test r8d, r8d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov ebp, esi
jle 0x1002dde6
nop
cmp byte [r12 + 8], 0
je 0x1002dd65
mov rcx, qword [r12]
mov r8d, r13d
movsxd rdx, ebp
sub r8d, ebp
add rdx, rbx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
jmp 0x1002dd8f
mov rcx, qword [r12]
lea rax, [rsp + 0x30]
mov r8d, r13d
mov qword [rsp + 0x28], rax
movsxd rdx, ebp
sub r8d, ebp
add rdx, rbx
xor r9d, r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
test esi, esi
je 0x1002dd9f
cmp esi, 0xffffffff
je 0x1002dda4
add ebp, esi
cmp ebp, r13d
jl 0x1002dd40
cmp esi, 0xffffffff
jne 0x1002dde6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.100205e0
lea rdx, [0x100498e0]
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.10027af0
mov r9d, dword [r12 + 0x8c]
lea r8, [r12 + 9]
lea rdx, str._comm__Socket__s:_d_::recv_all_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10027bf0
cmp ebp, r13d
cmove esi, ebp
mov rbp, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1002e330
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x58
mov rax, qword [0x10058650]
mov qword [rsp + 0x48], rax
cmp byte [rcx + 8], 0
mov qword [rsp + 0x70], rsi
mov rsi, rcx
je 0x1002e362
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
jmp 0x1002e373
mov edx, 2
mov ecx, edx
lea r8d, [rdx + 0xf]
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rsi], rax
jne 0x1002e3d0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.100205e0
lea rdx, [0x10049548]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.10027af0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::create_failed:__s
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.10027bf0
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1002e439
xor eax, eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov word [rsp + 0x38], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1002e422
movzx ecx, word [rsp + 0x3a]
call qword [sym.imp.WS2_32.dll_htons]
movzx r11d, ax
mov dword [rsi + 0x8c], r11d
mov rax, qword [rsi]
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.10042170
add rsp, 0x58
ret
mov rax, rcx
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.10042170
add rsp, 0x58
ret