joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140171f20
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.1401749a0
jmp fcn.140176af0

Function at 0x140171f40
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x1401720d0
sub edx, 0x40
je 0x140171fe2
sub edx, 0x20
je 0x140172090
sub edx, 0x80
je 0x140172020
cmp edx, 0x80
jne 0x1401720f7
mov rax, qword [0x1403cfac0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1403cfac8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1403cfad0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1403cfad8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1403cfae0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1403cfae8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1403cfaf0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1403cfaf8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x1403cf800]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1403cf808]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1403cf810]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1403cf818]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1403cf820]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1403cf828]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1403cf830]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1403cf838]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x140173f00
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, pe_nt_image_headers64
call fcn.140257098
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14017410c
mov rcx, rax
call fcn.1400adc90
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.14008ed50
mov byte [0x14037a770], al
call fcn.140173a10
test edi, edi
jle 0x140174107
mov ecx, edi
sub ecx, 0xa0
je 0x1401740e0
sub ecx, 0x40
je 0x1401740a0
sub ecx, 0x20
je 0x140174060
sub ecx, 0x80
je 0x140173ff0
cmp ecx, 0x80
jne 0x140174107
mov rax, qword [0x1403cfac0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1403cfac8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1403cfad0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1403cfad8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1403cfae0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1403cfae8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1403cfaf0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1403cfaf8]
jmp 0x140174044
mov rax, qword [0x1403cf800]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1403cf808]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1403cf810]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1403cf818]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1403cf820]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1403cf828]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1403cf830]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1403cf838]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x140174107
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x140174103
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x140174103
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x14017410f
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140174140
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.140173f00
Function at 0x14017a3e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14017a418
xor al, al
jmp 0x14017a4f0
lea rcx, [rsp + 0x20]
call fcn.140179920
test edi, edi
je 0x14017a43e
test rbx, rbx
je 0x14017a43e
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14017acd0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x14017a48d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14017a4a0
lea rcx, [rsp + 0x30]
call fcn.140179a20
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable._ckSha3.0
mov qword [rsp + 0x20], rax
call fcn.1400adda0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402577a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14017a560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14017a598
xor al, al
jmp 0x14017a667
lea rcx, [rsp + 0x20]
call fcn.140179920
test edi, edi
je 0x14017a5be
test rbx, rbx
je 0x14017a5be
mov r9b, select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14017acd0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x14017a60d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, setsockopt
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14017a620
lea rcx, [rsp + 0x30]
call fcn.140179a20
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.1400adda0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402577a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14017a6d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14017a708
xor al, al
jmp 0x14017a7e0
lea rcx, [rsp + 0x20]
call fcn.140179920
test edi, edi
je 0x14017a72e
test rbx, rbx
je 0x14017a72e
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14017acd0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x14017a77d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, ntohs
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14017a790
lea rcx, [rsp + 0x30]
call fcn.140179a20
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.1400adda0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402577a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14017a850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14017a888
xor al, al
jmp 0x14017a969
lea rcx, [rsp + 0x20]
call fcn.140179920
test edi, edi
je 0x14017a8ae
test rbx, rbx
je 0x14017a8ae
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.14017acd0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x14017a8fd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14017a910
lea rcx, [rsp + 0x30]
call fcn.140179a20
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.1400adda0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1402577a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14017ac00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x14017ac75
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x14017ac60
test r8b, r8b
je 0x14017ac95
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14017ac81
mov rcx, rdi
call fcn.140179a20
test sil, sil
je 0x14017acc0
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x14017acb0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14017acd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x40], rbp
movzx ecx, byte [rcx + 0x1a0]
mov esi, r8d
mov qword [rsp + 0x50], r14
mov rdi, rdx
movzx r14d, r9b
test cl, cl
je 0x14017ad97
movzx eax, r14b
movzx r9d, sil
shl al, 3
sub al, cl
movzx r8d, al
cmp r8d, esi
cmovbe r9d, r8d
xor dl, dl
lea r8, [rbx + rcx]
test r9b, r9b
je 0x14017ad37
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + r8 + 0xd8], al
cmp dl, r9b
jb 0x14017ad21
add byte [rbx + 0x1a0], dl
movzx ecx, byte [rbx + 0x1a0]
movzx eax, dl
add rdi, rax
movzx eax, dl
sub esi, eax
mov eax, r14d
shl eax, 3
cmp ecx, eax
jne 0x14017ad97
test r14b, r14b
je 0x14017ad84
lea rcx, [rbx + 0x10]
mov rdx, r14
nop word [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14017ad70
mov rcx, rbx
add rcx, 0x10
call fcn.140179a20
mov byte [rbx + 0x1a0], 0
mov ebp, r14d
shl ebp, 3
cmp esi, ebp
jb 0x14017adfe
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov r12d, ebp
nop
test r14b, r14b
je 0x14017ade2
mov r8, rdi
lea rax, [rbx + 0x10]
sub r8, rbx
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + rax - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14017add0
lea rcx, [rbx + 0x10]
call fcn.140179a20
sub esi, ebp
add rdi, r12
cmp esi, ebp
jae 0x14017adb0
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test esi, esi
je 0x14017ae27
nop
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + rbx + 0xd8], al
movzx eax, dl
cmp eax, esi
jb 0x14017ae10
add byte [rbx + 0x1a0], dl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14017af80
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov esi, ecx
test ecx, ecx
js 0x14017b018
test rbx, rbx
je 0x14017b018
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea r8, str.getEntropy
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400d0c20
nop
xor bpl, bpl
call fcn.1400cfe00
mov rdi, rax
test rax, rax
jne 0x14017afe1
xor bl, bl
jmp 0x14017b009
mov r8, rbx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx ebx, bpl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
lea rcx, [rsp + 0x20]
call fcn.1400d0d40
movzx eax, bl
jmp 0x14017b01a
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402577a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140193530
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 0x18]
cmp eax, ecx
jb 0x1401935ac
cmp eax, dword [rbx + 0x28]
jb 0x1401935ac
sub eax, ecx
mov ecx, eax
je 0x14019362e
mov r8, qword [rbx + 8]
mov eax, 1
add r8, rcx
cmove r8, rax
mov r9, qword [rbx + 0x20]
add r9, qword [rbx + 0x10]
imul rax, r9, 0x3e8
cqo
idiv r8
mov ecx, 0xffffffff
cmp rax, rcx
jg 0x14019362e
mov qword [rbx + 0x30], r9
mov qword [rbx + 0x38], rax
jmp 0x14019362e
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.1400d2710
nop
cmp byte [0x1403ce355], 0
je 0x140193603
mov eax, dword [rbx + 0x44]
cmp eax, 1
jne 0x1401935e3
lea rdx, str.resetSendPerfMon
jmp 0x1401935f6
cmp eax, 2
lea rdx, str.resetReceivePerfMon
je 0x1401935f6
lea rdx, str.resetPerformanceMon
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call qword [rax + 0x30]
xor edi, edi
mov dword [rbx + 0x28], edi
mov qword [rbx + 0x20], rdi
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 0x18], eax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
lea rcx, [rsp + 0x20]
call fcn.1400d2740
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1402577a0
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x1b0
pop rdi
ret

Function at 0x140196210
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x14019621c
mov al, 1
ret
jmp fcn.14014d460

Function at 0x140197bb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x2a0], 2
je fcn.140198b10
jmp fcn.140198c20
Function at 0x1401983d0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x1401983ff
xor al, al
jmp 0x140198490
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x140198470
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x140198475
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402577a0
add rsp, 0x80
pop rbx
ret

Function at 0x140198910
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x1401989b1
mov r8d, dword [rcx + 0xdc]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x1401989ac
and r8d, 0xfffff000
mov dword [rcx + 0xdc], r8d
cmp byte [rdx + 0x169], 0
je 0x140198985
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_RCVBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xdc]
lea rdx, str.recvBufSize
mov rcx, rsi
call fcn.1400d1420
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xdc]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401989c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x140198a61
mov r8d, dword [rcx + 0xd8]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x140198a5c
and r8d, 0xfffff000
mov dword [rcx + 0xd8], r8d
cmp byte [rdx + 0x169], 0
je 0x140198a35
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_SNDBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd8]
lea rdx, str.sendBufSize
mov rcx, rsi
call fcn.1400d1420
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xd8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140198b10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea r8, str.ck_getsockname_ipv4
mov rdx, r9
lea rcx, [rsp + 0x38]
call fcn.1400d0c20
nop
mov rcx, rsi
call fcn.1400bc350
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x140198bdf
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x140198bbb
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov rcx, rsi
call fcn.1400b7ff0
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x140198bf1
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.14019b510
jmp 0x140198bef
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.1400d0d40
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402577a0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140198c20
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14037d7c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea r8, str.ck_getsockname_ipv6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400d0c20
nop
mov rcx, rsi
call fcn.1400bc350
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x140198cef
mov dword [rsp + 0x20], 0x1c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x140198ccb
mov rcx, rsi
call fcn.1400bc350
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14019a480
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x140198d01
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname_ipv6
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.14019b510
jmp 0x140198cff
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.1400d0d40
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402577a0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret