joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047230
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x14027dfa0]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp dword [rbx + 0xc], 2
jne 0x1400471b0
cmp esi, 0x10
jae 0x1400470c2
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400470a9
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x1400470dc
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x1400471b0
cmp word [rbx + 0x6c], 0
je 0x1400471b0
mov rcx, rbx
call fcn.140048c30
test eax, eax
jne 0x1400470af
mov eax, dword [rdi + 4]
test eax, eax
je 0x14004714e
cmp eax, dword [rbx + 0x9c]
je 0x14004714e
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047135
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x140047193
movzx eax, word [rdi + 2]
test ax, ax
je 0x140047193
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140047230
cmp dword [0x14027e04c], 0
je 0x1400471ce
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.140034150
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140171010
cmp dword [0x14027e04c], 0
mov rdi, rax
je 0x1400471f7
call fcn.1400345f0
test edi, edi
jne 0x14004721d
cmp dword [rbx + 0xc], 2
jne 0x14004721d
cmp word [rbx + 0x94], di
jne 0x14004721d
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140047230
test eax, eax
jne 0x1400470af
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140171010
test rax, rax
je 0x14004726a
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140047b10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x68]
or rdi, 0xffffffffffffffff
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
bt eax, 0x1a
jae 0x140047b65
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047b5a
call fcn.140176084
mov dword [rax], 0x2746
jmp 0x140047d12
cmp word [rcx + 0x6c], 0
je 0x140047c25
mov rcx, qword [rcx + 0x80]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140059eb0
movsxd rax, dword [rsp + 0x50]
mov r9d, r14d
movsxd rcx, dword [rbx + 0x70]
cmp rsi, rax
mov rdx, qword [rsp + 0x28]
cmovb rax, rsi
mov r8d, eax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140171010
mov rsi, rax
test eax, eax
jns 0x140047d12
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140047bde
call fcn.140176084
cmp dword [rax], 0x2738
jne 0x140047d12
mov rcx, qword [rbx + 0x80]
mov edx, esi
call fcn.140059f20
cmp dword [rsp + 0x70], 0
jne 0x140047c1d
mov rcx, qword [rbx + 0x80]
mov r8d, esi
mov rdx, rbp
call fcn.1400432f0
mov rcx, qword [rbx + 0x80]
call fcn.140059f80
movsxd rax, esi
jmp 0x140047d15
test eax, 0x4080
jne 0x140047c67
bt eax, 0xa
jb 0x140047c3f
call fcn.1400436d0
test eax, eax
jne 0x140047b3b
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jae 0x140047c67
nop dword [rax + rax]
mov edx, 1
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jb 0x140047c50
bt eax, 0xe
jae 0x140047cd7
mov rcx, qword [rbx + 0x80]
call fcn.14005a130
test eax, eax
je 0x140047cb5
cmp dword [rsp + 0x70], 0
mov edi, eax
jne 0x140047cb5
mov rcx, qword [rbx + 0x80]
mov rdx, rbp
cdqe
cmp rax, rsi
cmovb rsi, rax
mov r8d, esi
call fcn.1400432f0
test byte [rbx + 0x68], 0x20
mov edi, eax
jne 0x140047cbb
mov rcx, qword [rbx + 0x80]
call fcn.140059f80
test byte [rbx + 0x68], 0x20
je 0x140047ccb
mov rcx, qword [rbx + 0x80]
call fcn.14005a130
test eax, eax
jne 0x140047cd2
and dword [rbx + 0x68], 0xffffbfff
movsxd rax, edi
jmp 0x140047d15
test al, al
mov edx, 0x2f80
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
jns 0x140047d02
test rax, rax
jne 0x140047cfa
call fcn.140176084
mov dword [rax], 0x2733
jmp 0x140047d12
test rax, rax
jne 0x140047d0c
call fcn.140176084
mov dword [rax], 0x2714
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140048220
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rdi
sub rsp, 0x70
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov r13d, r9d
mov qword [rax - 0x38], r15
call fcn.140059e10
mov r10, qword [rsp + 0xb0]
mov rdi, rax
movzx ebx, word [rsi + 0x94]
mov ebp, 0x1c
mov r12d, dword [rsi + 0x9c]
mov dword [rsp + 0x90], reloc.WS2_32.dll_recv
movzx eax, word [r10 + 2]
mov r15d, dword [r10 + 4]
mov word [rsp + 0xb0], ax
test bx, bx
jne 0x14004832f
xor eax, eax
mov qword [rsp + 0x58], r14
movsxd r14, dword [rsi + 0x90]
lea r8d, [rbp - 0xc]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov eax, 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rcx, r14
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], ebx
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140171010
test rax, rax
je 0x1400482f2
lea rdx, str.bind_failed__m
mov ecx, 0x4b0003
call fcn.14002d1f0
jmp 0x14004832a
lea r8, [rsp + 0x30]
mov rcx, r14
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140171010
test rax, rax
je 0x140048325
lea rdx, str.getsockname_failed__m
mov ecx, 0x4b0003
call fcn.14002d1f0
jmp 0x14004832a
movzx ebx, word [rsp + 0x42]
mov r14, qword [rsp + 0x58]
mov r8d, dword [rsp + 0xa0]
mov rcx, rdi
mov rdx, qword [rsp + 0x98]
mov word [rsi + 0x94], bx
call fcn.140059d00
movzx r8d, word [rsp + 0xb0]
mov r9d, r12d
movzx edx, bx
mov dword [rsp + 0x20], r15d
mov rcx, rdi
call fcn.14005ab50
mov r9b, reloc.WS2_32.dll_recvfrom
mov r8d, r15d
mov edx, r12d
mov rcx, rdi
call fcn.14005aa50
cmp word [rsi + 0x6c], 0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x68]
je 0x1400483a5
mov edx, dword [rsi + 0x68]
mov rcx, rdi
and edx, 0x200000
shl edx, 4
call fcn.140059d90
mov ebp, 0x20
lea r8, [rsp + 0x90]
mov rcx, rdi
lea rdx, [rsp + 0x38]
call fcn.140059e60
movsxd r8, dword [rsp + 0x90]
mov r9d, r13d
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140047e30
mov r13, qword [rsp + 0x60]
mov ebx, eax
mov rsi, qword [rsp + 0xa8]
test eax, eax
jle 0x1400483e7
sub ebx, ebp
mov rcx, rdi
call fcn.140059cd0
movsxd rax, ebx
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
Function at 0x140048400
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rbx, ecx
mov rsi, r8
lea rcx, [0x14027dfa0]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea r14, [rbx*8]
lea rcx, [0x14027dfa0]
mov rbx, qword [r14 + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
je 0x1400484bb
cmp dword [rbx + 0xc], 2
jne 0x1400484bb
cmp word [rbx + 0x6c], 0
je 0x1400484bb
cmp dword [rsi], 0x10
jae 0x14004848c
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048481
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
jmp 0x140048502
mov dword [rsi], reloc.WS2_32.dll_recv
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov eax, 2
mov word [rdi], ax
mov eax, dword [rbx + 0x9c]
mov dword [rdi + 4], eax
movzx eax, word [rbx + 0x94]
mov word [rdi + 2], ax
xor eax, eax
jmp 0x140048502
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [r14 + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
jne 0x1400484f7
movsxd rcx, dword [rbx + 0x70]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x1400484fa
or eax, 0xffffffff
movsxd rcx, eax
call fcn.140171010
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140048560
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x14027dfa0]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140048687
test al, 1
je 0x1400485f7
cmp qword [rbx + 0x40], 0
je 0x1400485c6
cmp dword [rbx + 0xc], 2
jne 0x1400485c6
cmp word [rbx + 0x6c], 0
jne 0x1400485f7
mov rax, qword [rsp + 0x68]
mov r9d, edi
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
movsxd rcx, eax
call fcn.140171010
jmp 0x140048672
test eax, 0x80000004
jne 0x140048638
cmp qword [rbx + 0x40], 0
je 0x140048612
cmp dword [rbx + 0xc], 2
jne 0x140048612
cmp word [rbx + 0x6c], 0
jne 0x140048638
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x76d
lea rdx, str.vsock_recvfrom
mov ecx, 0x4b0202
call fcn.14002d420
cdqe
jmp 0x140048672
cmp dword [rbx + 0xc], 0
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x140048659
mov dword [rsp + 0x20], 0
call fcn.140047b10
jmp 0x140048672
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140047d30
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.recvfrom_from_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x1400486b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x14027dfa0]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
jne 0x14004871f
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x72e
lea rdx, str.vsock_send
mov ecx, 0x4b0202
call fcn.14002d420
mov eax, dword [rbx + 0x68]
mov rcx, qword [rbx + 0x40]
test eax, 0x80000004
jne 0x140048784
test rcx, rcx
je 0x14004873c
cmp dword [rbx + 0xc], 2
jne 0x14004873c
cmp word [rbx + 0x6c], 0
jne 0x140048784
test al, 1
je 0x140048760
movsxd rcx, dword [rbx + 0x70]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
call fcn.140171010
jmp 0x1400487e3
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x733
lea rdx, str.vsock_send
mov ecx, 0x4b0202
call fcn.14002d420
jmp 0x1400487e1
test rcx, rcx
je 0x1400487d0
cmp dword [rbx + 0xc], 2
jne 0x1400487d0
cmp word [rbx + 0x6c], 0
je 0x1400487d0
bt eax, 0x18
jae 0x1400487f8
cmp dword [rbx + 0x14], 0x11
lea rax, [rbx + 0xb0]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x1400487c9
call fcn.140048220
jmp 0x1400487e1
call fcn.140048130
jmp 0x1400487e1
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140047e30
cdqe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cannot_use_send_when_socket_not_connected
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x140048810
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
movsxd rbx, ecx
mov esi, r9d
lea rcx, [0x14027dfa0]
mov rbp, r8
mov r14, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140048971
test eax, 0x80000004
jne 0x1400488d3
cmp qword [rbx + 0x40], 0
je 0x14004887a
cmp dword [rbx + 0xc], 2
jne 0x14004887a
cmp word [rbx + 0x6c], 0
jne 0x1400488d3
test al, 1
je 0x1400488ad
mov eax, dword [rsp + 0x68]
mov r9d, esi
movsxd rcx, dword [rbx + 0x70]
mov r8d, ebp
mov dword [rsp + 0x28], eax
mov rdx, r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
movsxd rcx, eax
call fcn.140171010
jmp 0x1400488f7
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x783
lea rdx, str.vsock_sendto
mov ecx, 0x4b0202
call fcn.14002d420
cdqe
jmp 0x1400488f7
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x14004890d
mov ecx, dword [rbx]
mov r9d, esi
mov r8, rbp
mov rdx, r14
call fcn.1400486b0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
cmp dword [rbx + 0xc], 2
jne 0x140048983
cmp dword [rbx + 0x14], 0x11
jne 0x14004894b
mov rcx, rbx
call fcn.140048c30
test eax, eax
je 0x14004892b
or rax, 0xffffffffffffffff
jmp 0x1400488f2
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140048220
jmp 0x1400488f2
cmp dword [rbx + 0x10], 3
jne 0x140048983
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140048130
jmp 0x1400488f2
lea rdx, str.sendto_to_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
lea rdx, str.invalid_socket_address
mov ecx, 0x4b0000
call fcn.14002d6c0
int3
Function at 0x140048af0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rdi, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
lea rbx, [rdi + 0x150]
test dword [rdi + 0x68], 0x800000
jne 0x140048bf0
movsxd rcx, dword [rdi + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140048b6e
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x24]
lea r8, [rsp + 0x40]
mov dword [rbx + 4], eax
lea rdx, [rsp + 0x20]
movzx eax, word [rsp + 0x22]
mov dword [rbx + 8], eax
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
movsxd rcx, dword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x140048b5b
cmp dword [rdi + 0x54], eax
je 0x140048bab
movups xmm0, xmmword [rdi + 0x50]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
shr rax, 0x20
mov dword [rbx + 0xc], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x10
movzx ecx, ax
mov dword [rbx + 0x10], ecx
test esi, esi
je 0x140048bd3
mov eax, dword [rbx + 8]
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov dword [rbx], 5
call fcn.1400466e0
test eax, eax
jne 0x140048b5b
or dword [rdi + 0x68], 0x800000
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004bba0
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x58]
mov r14d, edx
mov dword [rsp + 0x38], r8d
xor r15d, r15d
mov dword [r11 - 0x28], edx
mov ebp, r8d
mov edx, dword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
mov dword [r11 - 0x30], r15d
mov ebx, 0x2390
add rbx, qword [rax]
mov edi, 0x2384
add rdi, qword [rax]
lea rax, [r11 + 8]
mov dword [r11 + 8], r15d
mov r8, qword [rbx]
mov qword [r11 - 0x38], rax
mov r9d, dword [rdi]
call fcn.14004e2b0
mov r9d, dword [rdi]
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jl 0x14004bc62
cmp r9d, eax
jg 0x14004bc2a
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call fcn.1400294d0
mov r9d, dword [rdi]
mov r8, qword [rbx]
lea rax, [rsp + 0x60]
mov edx, dword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], r15d
call fcn.14004e2b0
mov r9d, dword [rdi]
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jg 0x14004bc88
mov rcx, qword [rbx]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movsxd rdx, eax
mov byte [rdx + rcx], r15b
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov r8d, eax
lea rdx, str.set_str_length_mismatch__d__d
mov ecx, 0x45
call fcn.140028ae0
int3
Function at 0x140053740
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov esi, edx
mov ebx, r9d
mov rdx, rcx
mov edi, r8d
lea rcx, [rsp + 0x48]
sub rcx, 8
call fcn.140029470
mov rcx, qword [rsp + 0x88]
mov r9d, ebx
mov qword [rsp + 0x38], rcx
mov r8d, edi
mov ecx, dword [rsp + 0x80]
mov edx, esi
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, rax
call fcn.140171060
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
mov rsi, qword [rsp + 0x58]
cmp rax, 0xffffffffffffffff
cmove rax, rcx
add rsp, 0x40
pop rdi
ret

Function at 0x140053a40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbp, r8
xor edx, edx
mov ebx, r9d
mov rsi, rcx
lea r8d, [rdx + 0x78]
call fcn.140174ac0
xor r8d, r8d
mov dword [rsi + 0x38], ebx
mov rdx, rdi
mov qword [rsi], rdi
mov rcx, rsi
mov qword [rsi + 8], rbp
call fcn.140053f10
mov rcx, rsi
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x10], rax
call fcn.140053c90
test eax, eax
jne 0x140053b2c
mov rbx, qword [rsi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, rbx
lea edx, [rax + 0x32]
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140053b2c
mov edi, dword [rsp + 0x58]
test rbx, rbx
je 0x140053b2c
mov r9, qword [rsi + 0x10]
mov rdx, rbx
mov r8d, dword [rsi + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.140054080
movsd xmm0, qword [rbx]
mov r8d, edi
mov r9, qword [rsi + 8]
mov edx, 0x32
movsd qword [rsi + 0x3c], xmm0
mov rcx, rbx
mov eax, dword [rbx + 8]
mov dword [rsi + 0x44], eax
movzx eax, word [rbx + 0xc]
mov word [rsi + 0x48], ax
movsd xmm0, qword [r9]
movsd qword [rsi + 0x66], xmm0
mov eax, dword [r9 + 8]
mov dword [rsi + 0x6e], eax
movzx eax, word [r9 + 0xc]
lea r9, [rsp + 0x58]
mov word [rsi + 0x72], ax
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
jmp 0x140053b4e
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140053b4b
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsi + 0x20], 0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140053c90
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
sub rsp, 0xcc8
mov r9d, dword [rcx + 0x38]
lea rax, [rsp + 0xce0]
mov rdx, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], send
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x32]
call fcn.140007ed0
cmp eax, 3
je 0x140053f02
lea edx, [rbx + 0x2a]
mov qword [rsp + 0xce8], rbp
xor ecx, ecx
lea r9d, [rbx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x140053eed
mov qword [rsp + 0xcf0], rdi
mov qword [rsp + 0xcf8], r12
mov qword [rsp + 0xcc0], r13
mov qword [rsp + 0xcb8], r14
mov qword [rsp + 0xcb0], r15
cmp qword [rsi + 0x28], rbx
jne 0x140053d3a
mov qword [rsi + 0x28], rax
mov rdx, qword [rsi + 8]
mov r13d, 0x80000000
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, rcx
sub rdi, rdx
mov r14d, 5
cmp rcx, rdx
mov r8d, r14d
mov r12d, send
cmovbe rdi, rax
cmp rdi, r13
mov edi, dword [rsp + 0xce0]
cmovae r8d, r12d
xor edx, edx
test edi, edi
je 0x140053d9b
nop
cmp ebx, r8d
jge 0x140053d9b
mov eax, edx
inc edx
imul rcx, rax, 0xd0
add ebx, dword [rsp + rcx + 0x140]
cmp edx, edi
jb 0x140053d80
mov rdx, qword [rsi + 0x18]
mov rcx, rbp
movsxd r15, ebx
mov r8, r15
call fcn.140174c80
mov rdx, qword [rsi + 0x28]
mov rdi, qword [rsi + 0x10]
mov rcx, rdx
sub rcx, rdi
mov rax, rdi
sub rax, rdx
cmp rdx, rdi
lea r9, [r15 + rdx]
lea r8, [r15 + rdi]
mov edx, r14d
cmovbe rcx, rax
mov rax, r8
cmp rcx, r13
mov rcx, r9
cmovae edx, r12d
sub rax, r9
sub rcx, r8
cmp r9, r8
cmovbe rcx, rax
cmp rcx, r13
jae 0x140053e0c
sub r8d, r9d
mov eax, r14d
sub r8d, r14d
mov byte [rsp + 0x40], 0xe9
mov dword [rsp + 0x41], r8d
lea rdi, [rsp + 0x45]
jmp 0x140053e28
mov eax, r12d
lea rdi, [rsp + 0x4e]
mov word [rsp + 0x40], 0x25ff
mov dword [rsp + 0x42], 0
mov qword [rsp + 0x46], r8
mov r8d, edx
cmp eax, edx
jae 0x140053e3c
mov ecx, r8d
sub rcx, rax
mov eax, 0xcc
rep stosb byte [rdi], al
lea rcx, [r15 + rbp]
lea rdx, [rsp + 0x40]
call fcn.140174c80
mov r9, qword [rsi + 0x10]
lea rax, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbp
call fcn.140053fb0
mov r15, qword [rsp + 0xcb0]
test eax, eax
jne 0x140053ed7
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x28]
mov rcx, r8
sub rcx, rdx
mov qword [rsi + 0x20], rbp
mov rdi, rdx
mov dword [rsi + 0x30], ebx
sub rdi, r8
cmp rdx, r8
cmovbe rdi, rcx
cmp rdi, r13
cmovae r14d, r12d
add r14d, ebx
mov dword [rsi + 0x34], r14d
mov r13, qword [rsp + 0xcc0]
mov r12, qword [rsp + 0xcf8]
mov rdi, qword [rsp + 0xcf0]
mov r14, qword [rsp + 0xcb8]
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
jmp 0x140053ea5
or eax, 0xffffffff
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0xcc8
pop rsi
pop rbx
ret