joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180024750
Capabilities:
Get socket status

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x468
lea r14, [rcx + 0x3b0]
xor eax, eax
mov r12, rcx
mov rsi, qword [r14]
mov dword [rsp + 0x4b0], eax
jmp 0x180024954
lea rbx, [rsi - 0x20]
mov rsi, qword [rsi]
cmp byte [rbx + 0x248], 2
jne 0x180024954
mov rbp, qword [rbx + 0xa0]
xor eax, eax
xor edi, edi
xor r13d, r13d
test rbp, rbp
mov dword [rsp + 0x4c8], eax
je 0x1800248d5
lea rcx, [rsp + 0x258]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
mov r15, qword [rbp]
and dword [rsp + 0x30], edi
xor eax, eax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x250]
mov dword [rsp + 0x34], eax
lea eax, [rdi + 1]
lea ecx, [rdi + 2]
mov dword [rsp + 0x250], eax
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x258], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x1800248be
lea rdx, [rsp + 0x40]
mov rcx, r15
lea r13d, [rdi + 1]
call sub.WS2_32.dll___WSAFDIsSet
mov rcx, r15
test eax, eax
je 0x18002488c
and dword [rsp + 0x4b8], edi
lea rax, [rsp + 0x4c0]
lea r9, [rsp + 0x4b8]
mov edx, 0xffff
mov r8d, 0x1007
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x4c0], 4
call qword [sym.imp.WS2_32.dll_getsockopt]
mov edi, 0x274d
test eax, eax
cmove edi, dword [rsp + 0x4b8]
jmp 0x1800248ce
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1800248b1
mov rdx, rbp
mov rcx, r12
mov dword [rbp + 0xac], r13d
call fcn.1800356e8
jmp 0x1800248ce
and dword [rbp + 0xac], edi
mov edi, 0x2749
jmp 0x1800248ce
jns 0x1800248ce
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, 1
mov edi, eax
mov eax, dword [rsp + 0x4c8]
cmp r13d, 1
jne 0x180024913
test edi, edi
jne 0x1800248f8
and dword [rbx + 0x230], edi
mov rcx, rbx
mov byte [rbx + 0x248], r13b
call fcn.180033860
mov edi, eax
jmp 0x180024911
lock add dword [rbx + 0x60], 0xffffffff
jne 0x180024911
mov rcx, qword [0x180052eb0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
test edi, edi
je 0x18002494d
test eax, eax
je 0x180024971
lea rcx, str.EDK_CheckAsyncConnections
mov r9, rbx
mov r8, r12
mov edx, 0x7c9
call fcn.180023820
test eax, eax
je 0x18002494d
lea rcx, str.EDK_CheckAsyncConnections
mov r9, rbx
mov r8, r12
mov edx, 0x7ca
call fcn.180022b2c
mov eax, dword [rsp + 0x4b0]
cmp rsi, r14
jne 0x18002477f
add rsp, 0x468
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
mov dword [rsp + 0x4b0], eax
jmp 0x180024954
Function at 0x180028de8
Capabilities:
Create thread

Disassembly:
mov word [rsp + 0x20], r9w
push rbx
sub rsp, 0x30
cmp dword [rcx], 2
mov rbx, rcx
jne 0x180028e01
movzx eax, word [rcx + 4]
jmp 0x180028e03
xor eax, eax
cmp dword [rcx], 2
mov word [rcx + 0x10], ax
mov word [rcx + 4], r8w
jne 0x180028e17
movzx eax, word [rcx + 6]
jmp 0x180028e19
xor eax, eax
cmp dword [rcx], 2
mov word [rcx + 0x12], ax
mov word [rcx + 6], dx
jne 0x180028e2c
movzx eax, word [rcx + 8]
jmp 0x180028e2e
xor eax, eax
and word [rcx + 8], 0
and dword [rcx + 0xc], 0
mov word [rcx + 0x14], ax
mov dword [rcx], 1
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x180028e67
call fcn.180037a80
mov r8, qword [rbx + 0x30]
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx + 0x30], 0
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180028e84
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx + 0x38], 0
cmp dword [rbx + 0x50], 0
jne 0x180028eb1
lea rax, [rsp + 0x58]
lea r8, [0x180028bb4]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
add rsp, 0x30
pop rbx
ret

Function at 0x180028eb8
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x50], 0
mov rbx, rcx
jne 0x180028f57
cmp dword [rcx + 0x18], 0
je 0x180028f57
mov rcx, qword [rcx + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180028eec
cmp eax, 0x80
jne 0x180028f57
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r11, qword [rbx + 0x30]
test r11, r11
je 0x180028f57
cmp qword [rbx + 0x38], 0
je 0x180028f57
cmp qword [r11], 0
je 0x180028f57
cmp word [rbx + 6], 0
je 0x180028f57
mov rcx, qword [rbx + 0x48]
mov dword [rbx + 0xc], 1
test rcx, rcx
je 0x180028f29
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
lea r8, [0x180028bb4]
mov r9, rbx
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
mov eax, 1
jmp 0x180028f59
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x180028f60
Capabilities:
Terminate thread

Disassembly:
test rcx, rcx
je 0x180029009
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x50], 1
mov rcx, qword [rcx + 0x40]
mov edx, 0x1b58
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180028fa9
cmp eax, 0x80
je 0x180028fa9
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x180028fbc
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x48]
jmp 0x180028fb6
mov rcx, qword [rbx + 0x48]
and dword [rbx + 0x50], 0
test rcx, rcx
je 0x180028fbc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x30]
and qword [rbx + 0x48], 0
test rcx, rcx
je 0x180028fe7
call fcn.180037a80
mov r8, qword [rbx + 0x30]
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx + 0x30], 0
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180029004
mov rcx, qword [0x180052eb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbx + 0x38], 0
add rsp, 0x20
pop rbx
ret
Function at 0x18002b74c
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
lea esi, [r8 + 7]
xor ebp, ebp
mov rdi, rcx
and esi, 0xfffffff8
cmp dword [rcx + 0xdc8], ebp
jle 0x18002b82c
lea eax, [r8 - 8]
lea r15, [rdx + 8]
mov r13, rbp
cdqe
mov qword [rsp + 0x170], rax
mov rax, qword [rdi + 0xdc0]
lea rcx, [rdi + 0xddc]
mov edx, 8
mov rbx, qword [r13 + rax]
call fcn.180041384
mov r9d, 1
lea r8, [rdi + 0xddc]
lea rcx, [rsp + 0x30]
lea edx, [r9 + 7]
call fcn.180033458
mov rdx, qword [rsp + 0x170]
lea r9, [rdi + 0xde4]
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.1800333b0
lea rax, [rdi + 0xd80]
lea rdx, [rdi + 0xddc]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
add ebp, 1
add r13, 0x90
cmp ebp, dword [rdi + 0xdc8]
jl 0x18002b798
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18002dcb0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x240
mov rbp, rcx
mov edi, r8d
mov r12, rdx
xor ebx, ebx
lea rcx, [rsp + 0x38]
xor edx, edx
and dword [rsp + 0x30], ebx
mov r8d, 0x200
call sub.ntdll.dll_memset
mov r8d, edi
movsxd rdx, ebx
xor r9d, r9d
sub r8d, ebx
add rdx, r12
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov esi, eax
jne 0x18002dd43
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x18002dd49
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
lea ecx, [rsi + 2]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x18002dd49
add ebx, esi
cmp ebx, edi
jl 0x18002dced
lea r11, [rsp + 0x240]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x18002dd6c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x250
xor ebx, ebx
mov edi, r9d
mov esi, r8d
xor ebp, ebp
mov r12, rdx
mov r14, rcx
and dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x48]
xor edx, edx
mov r8d, 0x200
call sub.ntdll.dll_memset
and dword [rsp + 0x30], ebx
xor eax, eax
xor ecx, ecx
mov dword [rsp + 0x34], eax
call fcn.18001a9f8
and dword [rsp + 0x34], ebx
mov ecx, 1
mov r13, rax
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x30], edi
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x18002de55
je 0x18002de4e
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
movsxd r11, eax
je 0x18002de47
cmp r11d, 0xffffffff
je 0x18002de3f
xor ecx, ecx
sub esi, r11d
add r12, r11
add ebp, r11d
call fcn.18001a9f8
sub r13d, eax
add edi, r13d
test esi, esi
je 0x18002de5d
test edi, edi
js 0x18002de5d
jmp 0x18002dd9c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18002de5b
mov ebx, 0x4d4
jmp 0x18002de5d
mov ebx, 0x5b4
jmp 0x18002de5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsp + 0x290]
test rax, rax
je 0x18002de6c
mov dword [rax], ebp
lea r11, [rsp + 0x250]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x18002f0dc
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movzx eax, word [rcx + 0x2c]
lea rbx, [rcx + 0xc48]
xor esi, esi
mov rbp, rcx
mov dword [rcx + 0xc58], 0x598
lea r12, [rbx + 0x88]
lea edi, [rsi + 1]
xor edx, edx
mov rcx, r12
mov r8d, edi
mov word [r11 + 8], ax
mov r15d, esi
mov r14d, esi
call fcn.18003fe24
cmp eax, esi
je 0x18002f13f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x18002f284
lea rax, [rsp + 0x98]
lea r8, [0x18002edd8]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov r15d, edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rsi
mov qword [rbx + 0x18], rax
je 0x18002f132
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rbp
lea rax, [0x18002ee80]
mov edx, 2
lea r9, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov r8d, edx
mov rcx, rbp
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call fcn.1800357d0
cmp qword [rbx], rsi
mov edi, eax
jne 0x18002f1bb
cmp qword [rbx + 8], rsi
je 0x18002f27d
movzx eax, word [rsp + 0x90]
lea rcx, [rbx + 0x20]
xor edx, edx
mov word [rbp + 0x2c], ax
mov r13d, dword [rbx + 0x10]
mov r8d, r15d
add r13d, 0x90
mov dword [rbx + 0x78], 0x2800
mov dword [rbx + 0x7c], pe_nt_image_headers64
mov dword [rbx + 0x74], r13d
call fcn.18003fe24
test eax, eax
mov edi, eax
jne 0x18002f254
xor r12d, r12d
add r13d, 8
mov rcx, qword [0x180052eb0]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [rbx + 0x20]
test rax, rax
je 0x18002f243
mov rdx, rax
call fcn.18003fef0
add dword [rbx + 0x80], r15d
add r12d, r15d
cmp r12d, 0x100
jl 0x18002f1ff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x84], eax
jmp 0x18002f24d
mov edi, 8
call fcn.18003ff50
lea r12, [rbx + 0x88]
cmp edi, esi
jne 0x18002f132
mov rdx, qword [rbx]
mov r14d, r15d
cmp rdx, rsi
je 0x18002f27d
mov rcx, rbp
call fcn.1800356e8
cmp eax, esi
mov edi, eax
je 0x18002f27d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rbx + 0xdc], r15d
cmp edi, esi
je 0x18002f2ea
cmp r15d, esi
je 0x18002f2ea
mov rcx, qword [rbx]
mov dword [rbx + 0xe0], 1
cmp rcx, rsi
je 0x18002f2a7
call fcn.180035a9c
mov qword [rbx], rsi
mov rcx, qword [rbx + 0xc4]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x18]
cmp rcx, rsi
je 0x18002f2d4
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], rsi
mov rcx, r12
call fcn.18003ff50
cmp r14d, esi
je 0x18002f2ea
lea rcx, [rbx + 0x20]
call fcn.18003ff50
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002f304
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
xor ebx, ebx
mov r15d, r9d
mov r14, r8
cmp rdx, rbx
mov rdi, rdx
mov rsi, rcx
je 0x18002f36b
mov rbx, qword [rdx + 0x4c0]
movzx r8d, word [rsp + 0x1e8]
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rbx + 4]
call sub.ntdll.dll_memcpy
movzx r8d, word [rsp + 0x1e8]
lea rdx, [rbx + 4]
mov rcx, rdi
call fcn.1800335d8
mov ebx, eax
jmp 0x18002f561
cmp word [r8], 2
jne 0x18002f37b
mov rax, qword [rcx + 0xc48]
jmp 0x18002f38d
cmp word [r8], 0x17
jne 0x18002f55c
mov rax, qword [rcx + 0xc50]
cmp rax, rbx
je 0x18002f55c
mov r13, qword [rax]
mov eax, dword [rcx + 0xc0]
mov edi, ebx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x1b8], 0x395f2ec1
mov dword [rsp + 0x1b0], eax
mov rax, qword [rcx + 0xd38]
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x1e8]
add eax, 0xc
test al, 7
setne dil
shr eax, 3
add edi, eax
shl edi, 3
mov dword [rsp + 0x40], edi
call fcn.18001a9d0
mov ecx, 0x593
sub cx, di
cdq
movzx r8d, cx
idiv r8d
cmp dword [rsp + 0x1b0], ebx
mov eax, 1
mov dword [rsp + 0x30], edx
je 0x18002f414
mov edi, eax
mov ebp, ebx
jmp 0x18002f446
mov rcx, qword [rsp + 0x1d8]
cmp rcx, rbx
je 0x18002f442
cmp qword [rcx], rbx
jne 0x18002f42c
cmp qword [rcx + 8], rbx
je 0x18002f442
mov eax, dword [rcx + 0xc]
mov ebp, ebx
xor eax, dword [rcx + 8]
xor eax, dword [rcx + 4]
xor eax, dword [rcx]
mov dword [rsp + 0x1b0], eax
jmp 0x18002f444
mov ebp, eax
mov edi, ebx
mov r12d, 4
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x38]
mov r8, r12
call sub.ntdll.dll_memcpy
lea rcx, [rsp + 0x3c]
mov edx, r12d
call fcn.180041384
lea r9d, [r12 - 3]
lea r8, [rsp + 0x38]
lea edx, [r12 + 4]
lea rcx, [rsp + 0x60]
call fcn.180033458
call fcn.18001a9d0
and al, 0xfc
cmp ebp, ebx
je 0x18002f496
or al, 2
jmp 0x18002f4a2
and al, 0xfd
cmp edi, ebx
je 0x18002f4a0
or al, 1
jmp 0x18002f4a2
and al, 0xfe
mov rdi, qword [rsp + 0x50]
lea rdx, [rsp + 0x3c]
mov r8, r12
lea rcx, [rdi + 1]
mov byte [rdi], al
call sub.ntdll.dll_memcpy
lea r9, [rdi + 5]
lea r8, [rsp + 0x1b8]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.1800333b0
lea r9, [rdi + 9]
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.1800333b0
lea r9, [rdi + 0xd]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov rdx, r12
call fcn.1800333b0
mov r8, qword [rsp + 0x1e0]
lea r9, [rdi + 0x11]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.1800333b0
mov eax, dword [rsp + 0x30]
add ax, di
add ax, 5
je 0x18002f561
mov rdx, qword [rsi + 0xd38]
movzx r8d, ax
xor r9d, r9d
mov rcx, r13
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, ebx
jg 0x18002f561
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18002f364
mov ebx, 0x57
mov eax, ebx
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003008c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov rdi, qword [rcx + 0x2a0]
mov rbx, qword [rcx + 0xd30]
mov rdx, qword [rsp + 0x80]
test rdi, rdi
mov byte [rbx], 0xc5
mov byte [rbx + 1], 0x94
mov word [rbx + 2], 0x70
mov rax, qword [rdx]
mov rsi, rcx
mov rcx, qword [rsp + 0x90]
mov qword [rbx + 4], rax
mov rax, qword [rdx + 8]
mov rdx, qword [rsp + 0x88]
mov qword [rbx + 0xc], rax
mov ebp, r9d
mov rax, qword [rdx]
mov r12, r8
mov qword [rbx + 0x14], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 0x1c], rax
mov rax, qword [rcx]
mov qword [rbx + 0x24], rax
mov rax, qword [rcx + 8]
lea rcx, [rbx + 0x5d]
mov qword [rbx + 0x2c], rax
mov rax, qword [rsp + 0x98]
mov qword [rbx + 0x34], rax
mov al, byte [rsp + 0xa0]
mov byte [rbx + 0x3c], al
mov rax, qword [rsi + 8]
mov qword [rbx + 0x3d], rax
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x45], rax
je 0x18003016b
mov rax, qword [rdi + 0x78]
lea rdx, [rdi + 0x130]
mov qword [rbx + 0x4d], rax
mov rax, qword [rdi + 0x80]
mov qword [rbx + 0x55], rax
call fcn.180025890
movzx r11d, word [rdi + 0xa8]
mov word [rbx + 0x6e], r11w
jmp 0x180030185
and qword [rbx + 0x55], 0
and qword [rbx + 0x4d], 0
xor edx, edx
lea r8d, [rdx + 0x11]
call sub.ntdll.dll_memset
and word [rbx + 0x6e], 0
mov rax, qword [rsp + 0x78]
mov word [rsp + 0x38], 0x70
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9d, ebp
mov r8, r12
xor edx, edx
mov rcx, rsi
call fcn.18002f304
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x180033b64
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rsi, qword [rcx + 0x70]
mov rdi, qword [rcx + 0x4c0]
xor ebx, ebx
mov r15b, dl
mov r12, rcx
lea r13d, [rbx + 1]
mov edx, r13d
mov rcx, rsi
movzx ebp, bx
call fcn.180025098
cmp dword [rsi + 0xc28], ebx
mov r14d, eax
je 0x180033bd0
mov rcx, rsi
call fcn.18001f64c
cmp eax, ebx
je 0x180033bd0
call fcn.18001f21c
cmp eax, ebx
je 0x180033bd0
cmp dword [rsi + 0x270], ebx
je 0x180033bd3
mov r13d, ebx
xor edx, edx
lea rcx, [rsp + 0x22]
mov word [rsp + 0x20], bx
lea r8d, [rdx + 0x7e]
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rdi + 4]
lea r8d, [rdx + 0x57]
call sub.ntdll.dll_memset
mov byte [rdi + 4], 0xc5
mov byte [rdi + 5], r15b
mov word [rdi + 6], 0x57
mov rax, qword [rsi + 8]
mov rcx, rsi
mov qword [rdi + 8], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
movzx eax, word [rsi + 0x2e]
mov byte [rdi + 0x1a], 1
mov word [rdi + 0x18], ax
call fcn.18001f64c
cmp eax, ebx
je 0x180033c55
mov bp, word [rsi + 0x214]
cmp bp, bx
je 0x180033c51
cmp dword [rsi + 0x210], ebx
je 0x180033c51
cmp dword [rsi + 0x228], ebx
jne 0x180033c55
cmp dword [rsi + 0x270], ebx
jne 0x180033c55
mov bp, word [rsi + 0x2c]
mov word [rdi + 0x1b], bp
mov word [rdi + 0x1d], bx
mov dword [rdi + 0x32], ebx
cmp dword [rsi + 0xc28], ebx
je 0x180033cb6
cmp r13d, ebx
je 0x180033c8d
cmp r14d, ebx
jne 0x180033c88
cmp dword [rsi + 0x228], ebx
jne 0x180033c82
cmp dword [rsi + 0x270], ebx
je 0x180033c88
mov word [rdi + 0x1d], 1
or word [rdi + 0x1d], 2
cmp r14d, ebx
je 0x180033c97
or word [rdi + 0x1d], 4
cmp dword [r12 + 0x98], ebx
je 0x180033ca6
or word [rdi + 0x1d], 8
cmp dword [r12 + 0x8c], 0xa
jne 0x180033cb6
or word [rdi + 0x1d], 0x10
cmp dword [r12 + 0x98], ebx
jne 0x180033d22
mov rcx, qword [r12 + 0xa0]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx]
mov dword [rsp + 0xd8], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, ebx
je 0x180033cf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rdi + 0x1f]
lea rdx, [rsp + 0x20]
call fcn.180025890
movzx eax, word [rsp + 0x20]
movzx ecx, bx
cmp eax, 2
je 0x180033d13
cmp eax, 0x17
jne 0x180033d18
mov cx, word [rsp + 0x22]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rdi + 0x30], ax
mov rsi, qword [rsi + 0x2a0]
cmp rsi, rbx
je 0x180033d8d
cmp byte [rsi + 0x248], 1
jne 0x180033d8d
cmp r13d, ebx
je 0x180033d8d
mov dword [rdi + 0x32], 1
movdqu xmm0, xmmword [rsi + 0x78]
lea rcx, [rdi + 0x46]
lea rdx, [rsi + 0xb0]
movdqu xmmword [rdi + 0x36], xmm0
call fcn.180025890
movzx eax, word [rsi + 0xb0]
cmp eax, 2
je 0x180033d6e
cmp eax, 0x17
jne 0x180033d75
mov bx, word [rsi + 0xb2]
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rdi + 0x57], ax
movzx eax, word [rsi + 0xa8]
mov word [rdi + 0x59], ax
lea rdx, [rdi + 4]
mov r8d, 0x57
mov rcx, r12
call fcn.1800335d8
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18003566c
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor eax, eax
xor esi, esi
mov ebx, r8d
mov rdi, rcx
lea rcx, [rsp + 0x58]
lea r8d, [rsi + 4]
mov byte [rsp + 0x58], sil
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
call sub.ntdll.dll_memcpy
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htonl]
lea r9, [rsp + 0x58]
lea r8d, [rsi + 0xc]
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x5c], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
cmp eax, esi
sete sil
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800356e8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rdx + 0xb0]
xor ebx, ebx
mov rdi, rdx
test rbp, rbp
je 0x1800357b7
cmp dword [rdx + 0xa8], ebx
je 0x180035783
lea rsi, [rcx + 0xc8]
mov rcx, qword [0x180052eb0]
lea r8d, [rbx + 0x18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x18003573d
lea ebx, [rax + 8]
jmp 0x180035779
lea rcx, [rsi + 0x54]
mov rdx, rax
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rdi
call fcn.18003fef0
lea rcx, [rsi + 0x2c]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rsi], rsi
jne 0x18003576f
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call fcn.18003fc10
lea rcx, [rsi + 0x2c]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and qword [rdi + 0x98], 0
jmp 0x1800357b7
lea rax, [rdx + 0xa0]
mov r9, rdx
mov r8, rbp
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rdi + 0x98], rax
jne 0x1800357b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret