joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400475d8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140047608
xor eax, eax
jmp 0x1400476cb
mov rbp, rbx
cmp word [rax], si
je 0x14004762d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140047614
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140047610
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140047458
movsxd r14, eax
test eax, eax
jne 0x14004766b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140047601
mov rcx, r14
call fcn.14003fdd0
mov rdi, rax
test rax, rax
jne 0x140047684
xor ecx, ecx
call fcn.14003d684
jmp 0x140047660
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140047458
test eax, eax
jne 0x1400476b5
mov rcx, rdi
call fcn.14003d684
jmp 0x1400476bf
xor ecx, ecx
call fcn.14003d684
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400476e8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14004776f
mov rsi, rbx
cmp word [rax], bp
je 0x14004772e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140047718
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140047714
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003fdd0
mov rdi, rax
test rax, rax
je 0x14004775c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000e000
mov rbp, rdi
xor ecx, ecx
call fcn.14003d684
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140052d64
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140052d7a
mov al, 1
jmp 0x140052dda
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140052d8b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140052dd8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140048b6c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140052dd8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140052dd8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140052dd8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140052dda
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140004850
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009930
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1400052e0
nop
lea rax, [0x140003c80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000a9a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400048fd
lea rcx, [rsp + 0x40]
call fcn.14000be20
jmp 0x140004914
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140007790
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x58
ret

Function at 0x140004930
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009950
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140005360
nop
lea rax, [0x140003d20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000a9b0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400049f4
lea rcx, [rsp + 0x40]
call fcn.14000be50
jmp 0x140004a0b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.1400077e0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x58
ret
Function at 0x140004a30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140009970
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140005400
nop
lea rax, [0x140003df0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.14000a9c0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140004add
lea rcx, [rsp + 0x40]
call fcn.14000be80
jmp 0x140004af4
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140007830
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x58
ret

Function at 0x14000afd0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000cf50
movzx eax, al
test eax, eax
je 0x14000b04b
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14000b078
xor r8d, r8d
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 8]
lea rcx, [0x140009a80]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov edx, 0xffffffff
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x48
ret

Function at 0x14000c090
Capabilities:
Initialize winsock library

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x1e8
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1f0]
mov ecx, 1
lock xadd dword [rax], ecx
inc ecx
mov eax, ecx
cmp eax, 1
jne 0x14000c11d
movzx eax, byte [rsp + 0x1f8]
and rax, 0xff
movzx eax, al
movzx ecx, byte [rsp + 0x200]
and rcx, 0xff
movzx ecx, cl
shl ecx, 8
or eax, ecx
lea rdx, [rsp + 0x30]
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x1f0]
add rax, 4
mov ecx, dword [rsp + 0x20]
xchg dword [rax], ecx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x1e8
ret
Function at 0x140032db0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140092d10
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14004a6a0
nop
lea rax, [0x14002d470]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400aae00
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x140032e74
lea rcx, [rsp + 0x40]
call fcn.1400c8b40
jmp 0x140032e8b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.14006b490
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x58
ret

Function at 0x14003bca0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_connect]
add rsp, 0x28
ret

Function at 0x14003bd50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_getsockname]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x38
ret

Function at 0x14003be40
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x14009cbb0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x44], 0
cmp qword [rsp + 0xb0], 0xffffffffffffffff
je 0x14009cd75
movzx eax, byte [rsp + 0xc0]
test eax, eax
je 0x14009cc6e
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and eax, 8
test eax, eax
je 0x14009cc6e
xor eax, eax
mov word [rsp + 0x78], ax
xor eax, eax
mov word [rsp + 0x7a], ax
lea rcx, [rsp + 0x80]
call fcn.140006b00
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_129
mov r8d, 0xffff
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.1400d1530
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14009cc8e
mov byte [rsp + 0x40], 1
jmp 0x14009cc93
mov byte [rsp + 0x40], 0
movzx edx, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
call fcn.1400abf10
cmp dword [rsp + 0x44], 0
je 0x14009cd75
xor r8d, r8d
mov edx, 0x2733
lea rcx, [rsp + 0x48]
call fcn.1400164c0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.14006fcf0
movzx eax, al
test eax, eax
jne 0x14009cd06
xor r8d, r8d
mov edx, 0x4d5
lea rcx, [rsp + 0x60]
call fcn.1400164c0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
call fcn.14006fcf0
movzx eax, al
test eax, eax
je 0x14009cd75
mov dword [rsp + 0x7c], 0
lea r8, [rsp + 0x7c]
mov edx, 0x8004667e
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0xb8]
mov byte [rcx], al
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14009cd5e
mov byte [rsp + 0x41], 1
jmp 0x14009cd63
mov byte [rsp + 0x41], 0
movzx edx, byte [rsp + 0x41]
mov rcx, qword [rsp + 0xc8]
call fcn.1400abf10
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0xa8
ret
Function at 0x1400ae510
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
cmp qword [rsp + 0x78], 0
je 0x1400ae54a
mov rax, qword [rsp + 0x78]
movsx eax, byte [rax]
test eax, eax
je 0x1400ae54a
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
jmp 0x1400ae553
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x80], 0
je 0x1400ae586
mov rax, qword [rsp + 0x80]
movsx eax, byte [rax]
test eax, eax
je 0x1400ae586
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
jmp 0x1400ae58f
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
call fcn.14009bb80
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400d5940
mov rdi, qword [rsp + 0x98]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1400b8bb0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x1400b8be6
mov edx, 0x2719
mov rcx, qword [rsp + 0x60]
call fcn.140017130
mov eax, 0xffffffff
jmp 0x1400b8c65
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jge 0x1400b8c0c
mov byte [rsp + 0x20], 1
jmp 0x1400b8c11
mov byte [rsp + 0x20], 0
movzx edx, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call fcn.1400abf10
cmp dword [rsp + 0x24], 0
jl 0x1400b8c61
cmp dword [rsp + 0x50], 0x8004667e
jne 0x1400b8c61
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0
je 0x1400b8c4f
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
or eax, 1
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
jmp 0x1400b8c61
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
and eax, 0xfffffffc
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x1400bbef0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x10325476
ret
Function at 0x1400beeb0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4c8
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov dword [rsp + 0x2a0], 0
mov dword [rsp + 0x40], 0
jmp 0x1400beef4
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x2a0]
cmp dword [rsp + 0x40], eax
jae 0x1400bef1b
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x4e0]
cmp qword [rsp + rax*8 + 0x2a8], rcx
jne 0x1400bef19
jmp 0x1400bef1b
jmp 0x1400beeea
mov eax, dword [rsp + 0x2a0]
cmp dword [rsp + 0x40], eax
jne 0x1400bef56
cmp dword [rsp + 0x2a0], 0x40
jae 0x1400bef56
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x4e0]
mov qword [rsp + rax*8 + 0x2a8], rcx
mov eax, dword [rsp + 0x2a0]
inc eax
mov dword [rsp + 0x2a0], eax
xor eax, eax
test eax, eax
jne 0x1400beee0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x44], 0
jmp 0x1400bef7b
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x44], eax
jae 0x1400befa2
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4e0]
cmp qword [rsp + rax*8 + 0x98], rcx
jne 0x1400befa0
jmp 0x1400befa2
jmp 0x1400bef71
mov eax, dword [rsp + 0x90]
cmp dword [rsp + 0x44], eax
jne 0x1400befdd
cmp dword [rsp + 0x90], 0x40
jae 0x1400befdd
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4e0]
mov qword [rsp + rax*8 + 0x98], rcx
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
xor eax, eax
test eax, eax
jne 0x1400bef67
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov rax, qword [rsp + 0x4e0]
inc rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x2a0]
xor edx, edx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x1400bf034
xor al, al
jmp 0x1400bf0da
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x80], 4
mov rax, qword [rsp + 0x4e8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x1007
mov r8d, 0xffff
xor edx, edx
mov rcx, qword [rsp + 0x4e0]
call fcn.1400ae7d0
test eax, eax
jne 0x1400bf0d8
cmp dword [rsp + 0x70], 0
je 0x1400bf0cb
call fcn.14000aa30
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x4c], eax
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x4c]
lea rcx, [rsp + 0x58]
call fcn.140006a90
mov rdi, qword [rsp + 0x4e8]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
jmp 0x1400bf0d8
mov rcx, qword [rsp + 0x4e8]
call fcn.14009b9f0
mov al, 1
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x4c8
pop rdi
pop rsi
ret
Function at 0x1400c84f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1402ddc80]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x40], eax
mov dl, 1
mov rcx, qword [rsp + 0x90]
call fcn.1400abf10
mov rcx, qword [rsp + 0x90]
call fcn.14000d430
cmp eax, 0x40
jne 0x1400c85a4
mov edx, 0x2746
mov rcx, qword [rsp + 0x90]
call fcn.140017130
jmp 0x1400c85fc
mov rcx, qword [rsp + 0x90]
call fcn.14000d430
cmp eax, 0x4d2
jne 0x1400c85cc
mov edx, 0x274d
mov rcx, qword [rsp + 0x90]
call fcn.140017130
jmp 0x1400c85fc
mov rcx, qword [rsp + 0x90]
call fcn.14000d430
cmp eax, 0x2738
je 0x1400c85f4
mov rcx, qword [rsp + 0x90]
call fcn.14000d430
cmp eax, 0xea
jne 0x1400c85fc
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x40], 0
je 0x1400c860a
mov eax, 0xffffffff
jmp 0x1400c861b
mov rcx, qword [rsp + 0x90]
call fcn.14009b9f0
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f4e50
add rsp, 0x68
ret

Function at 0x1400ce040
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
cmp qword [rsp + 0x58], 0
jne 0x1400ce0cc
cmp qword [rsp + 0x60], 0
jne 0x1400ce0cc
cmp qword [rsp + 0x68], 0
jne 0x1400ce0cc
cmp qword [rsp + 0x70], 0
je 0x1400ce0cc
mov rax, qword [rsp + 0x70]
imul eax, dword [rax], 0x3e8
mov dword [rsp + 0x3c], eax
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + 4]
cdq
mov ecx, 0x3e8
idiv ecx
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1400ce0b1
mov dword [rsp + 0x34], 1
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x78]
call fcn.14009b9f0
xor eax, eax
jmp 0x1400ce150
cmp qword [rsp + 0x70], 0
je 0x1400ce103
mov rax, qword [rsp + 0x70]
cmp dword [rax], 0
jne 0x1400ce103
mov rax, qword [rsp + 0x70]
cmp dword [rax + 4], 0
jle 0x1400ce103
mov rax, qword [rsp + 0x70]
cmp dword [rax + 4], 0x3e8
jge 0x1400ce103
mov rax, qword [rsp + 0x70]
mov dword [rax + 4], 0x3e8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x1400ce138
mov byte [rsp + 0x30], 1
jmp 0x1400ce13d
mov byte [rsp + 0x30], 0
movzx edx, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call fcn.1400abf10
mov eax, dword [rsp + 0x38]
add rsp, 0x48
ret