joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400efbd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r15d, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400efcc1
test r8, r8
js 0x1400efcc1
test rdx, rdx
je 0x1400efcb0
test r8, r8
je 0x1400efcb0
mov qword [rsp + 0x40], rbx
mov ebx, 0xc8
mov qword [rsp + 0x48], rdi
xor edi, edi
mov qword [rsp + 0x50], r12
test r8, r8
jle 0x1400efc86
mov r12d, 0x578
cmp ebx, 0xea60
jg 0x1400efc86
mov r8d, esi
lea rdx, [rdi + rbp]
sub r8d, edi
mov rax, rsi
sub rax, rdi
mov r9d, r15d
cmp rax, r12
mov rcx, r14
cmovg r8d, r12d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x1400efc77
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400efca7
mov ecx, ebx
call sub.KERNEL32.dll_Sleep
add ebx, ebx
jmp 0x1400efc81
cdqe
mov ebx, 0xc8
add rdi, rax
cmp rdi, rsi
jl 0x1400efc30
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rax, 0xfffffffffffffffe
jmp 0x1400efc89
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rbp, qword [rsp + 0x58]
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1400efd80
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x580]
sub rsp, 0x680
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0x570], rax
xor r12d, r12d
mov r14d, edx
mov dword [rsp + 0x40], r12d
mov esi, r8d
mov dword [rbp + 0x150], r12d
mov r15, rcx
mov dword [rbp + 0x360], r12d
mov r10d, r12d
mov r11d, r12d
mov r9d, r12d
mov r13d, 0x700
test edx, edx
je 0x1400efed6
mov r8, rcx
mov edi, r14d
nop dword [rax]
movzx ebx, word [r8 + 8]
test r13w, bx
je 0x1400efe34
mov ecx, r12d
test r10d, r10d
je 0x1400efe14
mov rdx, qword [r8]
cmp qword [rsp + rcx*8 + 0x48], rdx
je 0x1400efe14
inc ecx
cmp ecx, r10d
jb 0x1400efe06
cmp ecx, r10d
jne 0x1400efe34
cmp r10d, 0x40
jae 0x1400efe34
mov rax, qword [r8]
mov qword [rsp + rcx*8 + 0x48], rax
mov r10d, dword [rsp + 0x40]
inc r10d
mov dword [rsp + 0x40], r10d
test bl, 0x30
je 0x1400efe7c
mov ecx, r12d
test r11d, r11d
je 0x1400efe55
mov rdx, qword [r8]
cmp qword [rbp + rcx*8 + 0x158], rdx
je 0x1400efe55
inc ecx
cmp ecx, r11d
jb 0x1400efe44
cmp ecx, r11d
jne 0x1400efe7c
cmp r11d, 0x40
jae 0x1400efe7c
mov rax, qword [r8]
mov qword [rbp + rcx*8 + 0x158], rax
mov r11d, dword [rbp + 0x150]
inc r11d
mov dword [rbp + 0x150], r11d
test bl, 7
je 0x1400efec8
mov ecx, r12d
test r9d, r9d
je 0x1400efea1
mov rdx, qword [r8]
nop dword [rax]
cmp qword [rbp + rcx*8 + 0x368], rdx
je 0x1400efea1
inc ecx
cmp ecx, r9d
jb 0x1400efe90
cmp ecx, r9d
jne 0x1400efec8
cmp r9d, 0x40
jae 0x1400efec8
mov rax, qword [r8]
mov qword [rbp + rcx*8 + 0x368], rax
mov r9d, dword [rbp + 0x360]
inc r9d
mov dword [rbp + 0x360], r9d
add r8, 0x10
sub rdi, 1
jne 0x1400efdf0
mov rax, r12
test esi, esi
js 0x1400eff09
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x30], edx
sub esi, eax
imul eax, esi, 0x3e8
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
lea r9, [rbp + 0x360]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x150]
mov ecx, 1
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
test eax, eax
jle 0x1400effab
test r14d, r14d
je 0x1400effab
lea rbx, [r15 + 0xa]
mov rdi, r14
nop
mov rcx, qword [rbx - 0xa]
lea rdx, [rsp + 0x40]
mov word [rbx], r12w
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400eff61
movzx eax, word [rbx - 2]
and ax, r13w
or word [rbx], ax
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x150]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400eff80
movzx eax, word [rbx - 2]
and ax, 0x30
or word [rbx], ax
mov rcx, qword [rbx - 0xa]
lea rdx, [rbp + 0x360]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1400eff9f
movzx eax, word [rbx - 2]
and ax, 7
or word [rbx], ax
add rbx, 0x10
sub rdi, 1
jne 0x1400eff40
mov eax, esi
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x6c8]
add rsp, 0x680
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400f6bf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xb0
mov qword [rax - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rcx
mov byte [rcx + 0xc], 0
mov rcx, qword [rcx + 0x38]
xor ebp, ebp
test rcx, rcx
je 0x1400f6c3c
call fcn.140283144
mov qword [rbx + 0x38], rbp
mov eax, dword [rbx + 0x34]
add eax, 2
movsxd rcx, eax
lea rdx, [0x1404528a0]
call fcn.14028375c
mov qword [rbx + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.14001cac0
nop
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x40], rax
cmp byte [rbx + 0xc], 0
jne 0x1400f6d7d
lea rsi, [rbx + 0x18]
nop word [rax + rax]
mov dword [rsp + 0x30], reloc.ODBC32.dll_SQLFreeStmt
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, dword [rbx + 0x34]
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_recvfrom]
movsxd rdi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movsxd rcx, eax
mov qword [rbx], rcx
cmp byte [rbx + 0xc], 0
jne 0x1400f6d7d
test edi, edi
jle 0x1400f6d72
mov byte [rbx + 0x30], 1
xor al, al
cmp qword [rbx + 0x40], 0
je 0x1400f6d69
mov ecx, dword [rbx + 0x1c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
je 0x1400f6d1f
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14001c840
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.14001d690
nop
lea rcx, [rsp + 0x80]
call fcn.14001d440
jmp 0x1400f6d29
lea rcx, [rsp + 0x50]
call fcn.14001f170
movzx ecx, word [rbx + 0x1a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x48], edi
mov rax, qword [rsp + 0x40]
mov byte [rdi + rax], 0
lea eax, [rdi + 1]
movsxd rcx, eax
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], 0
mov rcx, qword [rbx + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movzx eax, byte [rbx + 0xc]
test al, al
jne 0x1400f6d7d
jmp 0x1400f6c80
je 0x1400f6d7d
cmp edi, 0xffffffff
jne 0x1400f6c80
mov rcx, qword [rbx + 0x38]
call fcn.140283144
mov qword [rbx + 0x38], rbp
lea rcx, [rsp + 0x50]
call fcn.14001d440
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400f6df0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, r8d
mov rbx, rcx
test rdx, rdx
je 0x1400f6e3e
test r8d, r8d
jle 0x1400f6e3e
cmp byte [rcx + 0x30], 0
je 0x1400f6e3e
lea rax, [rcx + 0x18]
mov dword [rsp + 0x28], reloc.ODBC32.dll_SQLFreeStmt
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, edi
je 0x1400f6e4b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movsxd rcx, eax
mov qword [rbx], rcx
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400f72e0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
movzx eax, byte [rcx + 0x20]
xor r8d, r8d
mov qword [rcx + 0x18], 0
mov rbx, rcx
lea edx, [r8 + 2]
lea ecx, [rdx + 0x15]
test al, al
jne 0x1400f7305
mov ecx, edx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x1400f732d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movsxd rcx, eax
mov eax, 0xfffffffe
mov qword [rbx + 0x18], rcx
add rsp, 0x30
pop rbx
ret
cmp byte [rbx + 0x10], 0
je 0x1400f735d
mov rcx, qword [rbx + 0x58]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov dword [rsp + 0x40], 1
mov r8d, 0x20
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x58]
lea r9, [rbx + 0x24]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1006
call qword [sym.imp.WS2_32.dll_setsockopt]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movsxd rcx, eax
xor eax, eax
mov qword [rbx + 0x18], rcx
add rsp, 0x30
pop rbx
ret

Function at 0x1400f73a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
mov qword [rcx + 0x18], rbx
mov rcx, qword [rcx + 0x58]
cmp rcx, 0xffffffffffffffff
jne 0x1400f73cb
lea eax, [rbx - 2]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi]
mov qword [rsp + 0x40], rsi
test rdx, rdx
jne 0x1400f740a
mov eax, dword [rdi + 8]
lea rdx, [0x1404528a0]
add eax, 0xa
movsxd rcx, eax
call fcn.14028375c
mov rcx, rax
mov qword [rdi], rax
mov eax, dword [rdi + 8]
xor edx, edx
add eax, 0xa
movsxd r8, eax
call fcn.140285450
mov rdx, qword [rdi]
mov rcx, qword [rdi + 0x58]
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movsxd rcx, eax
mov qword [rdi + 0x18], rcx
test esi, esi
jle 0x1400f7449
mov dword [rdi + 0xc], esi
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x40]
setne bl
lea eax, [rbx - 4]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f7460
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
xor r15d, r15d
mov qword [rcx + 0x18], r15
mov rbp, r9
mov rcx, rdx
mov esi, r8d
mov r14, rdx
call fcn.14001f680
test al, al
jne 0x1400f75ea
lea eax, [rsi - 1]
cmp eax, 0xfffd
ja 0x1400f75ea
test rbp, rbp
je 0x1400f75ea
mov edi, dword [rsp + 0xf0]
lea eax, [rdi - 1]
cmp eax, 0x2fffff
ja 0x1400f75ea
cmp qword [rbx + 0x58], 0xffffffffffffffff
jne 0x1400f74e1
lea eax, [r15 - 2]
jmp 0x1400f75ef
movzx eax, byte [rbx + 0x20]
movzx ecx, si
test al, al
je 0x1400f7535
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov eax, reloc.WS2_32.dll_socket
mov word [rsp + 0x40], ax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x48]
mov rcx, r14
mov word [rsp + 0x42], ax
call fcn.140025c10
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], SQLFreeHandle
jmp 0x1400f75b9
mov eax, 2
mov qword [rsp + 0x38], r15
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x60]
mov rcx, r14
mov word [rsp + 0x32], ax
call fcn.140022ea0
cmp qword [rax + 0x18], 0x10
jb 0x1400f7566
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rdx, qword [rsp + 0x78]
mov dword [rsp + 0x34], eax
cmp rdx, 0x10
jb 0x1400f75ac
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f75a7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400f760f
call fcn.140283144
mov dword [rsp + 0x28], reloc.ODBC32.dll_SQLFreeStmt
lea rax, [rsp + 0x30]
mov rcx, qword [rbx + 0x58]
xor r9d, r9d
mov r8d, edi
mov qword [rsp + 0x20], rax
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movsxd rcx, eax
cmp esi, edi
mov qword [rbx + 0x18], rcx
cmove ecx, r15d
mov eax, ecx
jmp 0x1400f75ef
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140283120
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140287d84
int3
Function at 0x140101320
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov rcx, rdx
call fcn.14001f680
test al, al
je 0x140101370
xor eax, eax
jmp 0x14010157b
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401019d0
mov rdi, rax
test rax, rax
je 0x140101369
mov ecx, reloc.ODBC32.dll_SQLAllocHandle
call fcn.14028314c
mov rbx, rax
mov qword [rsp + 0x38], rax
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x10], ecx
mov qword [rax + 8], rsi
mov qword [rax], 0
call sub.KERNEL32.dll_GetTickCount
mov r15d, eax
mov dword [rdi + 0x38], 0x7fff
mov ecx, SQLTablesW
call fcn.14028314c
test rax, rax
je 0x1401013d2
mov rcx, rax
call fcn.1400fc030
mov qword [rbx], rax
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140020d90
nop
cmp qword [rax + 0x18], 0x10
jb 0x1401013ed
mov rax, qword [rax]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rax
mov edx, dword [rsi + 0x624]
mov rcx, qword [rbx]
call fcn.140104410
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140101450
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010144b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401015a4
call fcn.140283144
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
lea rcx, [rsp + 0x80]
call fcn.14001cac0
nop
lea rdx, [0x1402d3f40]
lea rcx, [rsp + 0xf8]
call fcn.14001c950
nop
sub edi, r15d
mov edx, edi
lea rcx, [rsp + 0xd0]
call fcn.14001c660
nop
lea rdx, str._take_time
lea rcx, [rsp + 0xa8]
call fcn.14001c950
nop
lea rdx, str.Do_exec
lea rcx, [rsp + 0x58]
call fcn.14001c950
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
call fcn.14001d850
mov rdx, r14
mov rcx, rax
call fcn.14001d850
lea rdx, [rsp + 0xa8]
mov rcx, rax
call fcn.14001d850
lea rdx, [rsp + 0xd0]
mov rcx, rax
call fcn.14001d850
lea rdx, [rsp + 0xf8]
mov rcx, rax
call fcn.14001d850
nop
lea rcx, [rsp + 0x58]
call fcn.14001d440
nop
lea rcx, [rsp + 0xa8]
call fcn.14001d440
nop
lea rcx, [rsp + 0xd0]
call fcn.14001d440
nop
lea rcx, [rsp + 0xf8]
call fcn.14001d440
lea rcx, [rsp + 0x80]
call fcn.14002aa20
mov qword [rsp + 0x20], rax
mov r9d, 0x4bd
lea r8, str.e:worksuniaccess_unimon_blowsnow_sourcehotldbmgr.cpp
mov edx, 3
mov rcx, rsi
call fcn.140005370
nop
lea rcx, [rsp + 0x80]
call fcn.14001d440
nop
jmp 0x140101578
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140287d84
nop
int3
Function at 0x140138fc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
mov rcx, rdx
call fcn.14001f170
mov dword [rsi], 0
mov dword [rsp + 0x20], reloc.ODBC32.dll_SQLFreeStmt
mov ecx, ebx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140139058
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14001c840
nop
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001d690
nop
lea rcx, [rsp + 0x40]
call fcn.14001d440
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rsi], eax
xor eax, eax
jmp 0x14013905d
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140283120
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140139080
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov ecx, ecx
mov rdi, r8
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x20], SQLFreeHandle
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140139107
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400289d0
mov rcx, rbx
call fcn.140026680
test al, al
je 0x1401390f3
mov rcx, rbx
call fcn.14002a630
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
xor eax, eax
jmp 0x14013910c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14013ac70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], reloc.ODBC32.dll_SQLFreeStmt
lea r8, [r11 - 0x58]
lea rdx, [r11 - 0x48]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14013acf7
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14001c840
nop
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001d690
nop
lea rcx, [rsp + 0x40]
call fcn.14001d440
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
mov al, 1
jmp 0x14013acf9
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140283120
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret

Function at 0x14013afc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r15d, r9d
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test rdx, rdx
je 0x14013b0a0
test r8, r8
jle 0x14013b0a0
mov qword [rsp + 0x40], rdi
lea edi, [rbx + 5]
mov qword [rsp + 0x48], r12
mov r12d, 0x28000022
nop word [rax + rax]
mov rax, rsi
mov r8d, esi
sub r8d, ebx
sub rax, rbx
cmp rax, r12
mov rcx, rbp
cmovg r8d, r12d
cmp edi, 0x2800
jg 0x14013b090
lea rdx, [rbx + r14]
mov r9d, r15d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x14013b057
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14013b06b
mov ecx, edi
call sub.KERNEL32.dll_Sleep
add edi, edi
jmp 0x14013b061
cdqe
mov edi, 5
add rbx, rax
cmp rbx, rsi
jl 0x14013b010
mov rax, rbx
jmp 0x14013b072
mov rax, 0xfffffffffffffffe
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rax, rbx
jmp 0x14013b072
mov rax, 0xffffffffffffffff
jmp 0x14013b07c

Function at 0x14013b0b0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
test rcx, rcx
jne 0x14013b0c0
xor al, al
add rsp, 0x38
ret
movzx eax, dl
lea r9, [rsp + 0x40]
mov edx, 6
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
sete al
add rsp, 0x38
ret

Function at 0x14013b0f0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
movzx eax, dl
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov dword [rsp + 0x30], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
add rsp, 0x28
ret

Function at 0x14013b120
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
movzx eax, dl
lea r9, [rsp + 0x48]
mov edx, 0x29
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
add rsp, 0x38
ret
Function at 0x14013b150
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
test edx, edx
js 0x14013b184
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
sete al
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x14013b190
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x14013c4e0
Capabilities:
Initialize winsock library
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [rcx + 0x40], 0
mov rdi, rcx
jne 0x14013c6a5
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jb 0x14013c52b
lea rcx, str.requres_Windows_NT_2K_XP._n_n
call fcn.14002d4e0
mov eax, 0xffffffff
jmp 0x14013c6a7
mov ecx, 0x101
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14013c555
lea rcx, str.Could_not_initialize_Winsock._n
call fcn.14002d4e0
mov eax, 0xfffffffe
jmp 0x14013c6a7
mov qword [rsp + 0x1e8], rbx
lea rcx, str.kernel32.dll
mov qword [rsp + 0x1f0], rsi
mov bl, 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateToolhelp32Snapshot
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x1403b3568], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.Process32First
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov qword [0x1403b3570], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.Process32Next
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.iphlpapi.dll
mov qword [0x1403b3578], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.AllocateAndGetTcpExTableFromStack
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
lea rcx, str.iphlpapi.dll
test rax, rax
mov qword [0x1403b3548], rax
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.AllocateAndGetUdpExTableFromStack
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x1403b3550], rax
lea rcx, str.iphlpapi.dll
cmove ebx, esi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.GetExtendedTcpTable
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 1
lea rcx, str.iphlpapi.dll
test rax, rax
mov qword [0x1403b3558], rax
cmovne ebx, esi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.GetExtendedUdpTable
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
movzx ecx, bl
mov qword [0x1403b3560], rax
cmovne ecx, esi
mov byte [rdi + 0x41], cl
lea rcx, [rdi + 0x18]
call fcn.1401bb5c0
mov rbx, qword [rsp + 0x1e8]
mov byte [rdi + 0x40], sil
mov rsi, qword [rsp + 0x1f0]
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140283120
add rsp, 0x1d0
pop rdi
ret