joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003e5b0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
sub rsp, 0x38
mov rdx, rcx
mov qword [rax - 0x18], 0
lea rcx, [rax - 0x18]
lea r8, [rax + 0x10]
call fcn.1400262f0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14003e616
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0
call fcn.140026dd0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x28]
call fcn.140026da0
mov ecx, 2
call fcn.1401750c8
mov rcx, qword [rsp + 0x20]
mov rdx, rax
call fcn.14017fb6c
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14003e63c
call fcn.140174cec
add rsp, 0x38
ret

Function at 0x140040950
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140171bd0
mov rax, qword gs:[0x58]
mov esi, 0x1bb4
mov rbx, qword [rax]
mov eax, dword [rsi + rbx]
inc eax
and eax, 0x80000007
jge 0x14004099f
dec eax
or eax, 0xfffffff8
inc eax
movsxd rcx, eax
lea r9, [rsp + 0x20]
shl rcx, 8
mov r8, rdi
mov ebp, 0x1bd0
mov edx, 0x100
add rcx, rbp
mov dword [rsi + rbx], eax
add rcx, rbx
call fcn.14016e6e0
movsxd rax, dword [rsi + rbx]
mov rsi, qword [rsp + 0x78]
shl rax, 8
add rax, rbp
mov rbp, qword [rsp + 0x70]
add rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400416f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [0x140270f18], 0
mov r14d, r9d
mov rdi, r8
movsxd rsi, ecx
mov r15, rdx
je 0x140041786
mov rax, qword gs:[0x58]
mov ecx, 0x23d4
mov r10, qword [rax]
cmp dword [rcx + r10], 0
jne 0x140041786
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbp, rsi
mov rbx, qword [rax + rsi*8]
call fcn.14002e7d0
test dword [rbx + 0x68], 0x10000000
jne 0x140041789
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov ecx, esi
call fcn.1400418d0
jmp 0x14004189a
mov rbp, rsi
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rax + rbp*8]
call fcn.14002e7d0
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x1400418b3
cmp qword [rbx + 0x40], 0
je 0x1400417ed
cmp dword [rbx + 0xc], 2
jne 0x1400417ed
cmp word [rbx + 0x6c], 0
je 0x1400417ed
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140049300
jmp 0x14004189a
test eax, 0x80000004
je 0x140041810
xor eax, eax
mov r9d, r14d
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, r15
mov rcx, rbx
call fcn.1400490e0
jmp 0x14004189a
test al, 1
je 0x140041876
movsxd rcx, dword [rbx + 0x70]
mov r9d, r14d
mov r8d, edi
mov rdx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140170a40
mov rbx, rax
test eax, eax
jns 0x140041871
mov rcx, qword gs:[0x58]
mov eax, 0x2fe0
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140041855
call fcn.140174cc4
cmp dword [rax], 0x2738
jne 0x140041871
mov r8, rdi
lea rdx, str.buf_to_small___d__for_packet_recv
mov ecx, 0x580003
call fcn.140028e10
movsxd rax, ebx
jmp 0x14004189a
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x75c
lea rdx, str.vsock_recv
mov ecx, 0x580202
call fcn.140029040
cdqe
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rdx, str.recv_from_non_packet_socket
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x140044aa0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov r14, r8
lea rcx, [rsp + 0x2d8]
mov rbx, rdx
lea r8, [0x140047c80]
sub rcx, 8
lea rdx, [rsp + 0x30]
mov rdi, r9
call fcn.140025270
xor edx, edx
mov qword [rsp + 0x30], rax
lea rcx, str.read
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x68], rcx
lea rcx, str.write
mov qword [rsp + 0x70], rcx
lea rcx, str.except
mov qword [rsp + 0x78], rcx
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x140044cd0
mov qword [rsp + 0x2e0], rbp
mov rax, rbx
mov qword [rsp + 0x2b8], rsi
mov ebp, edx
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
cmp dword [rax], 0
mov esi, edx
jbe 0x140044c91
mov r15, qword [rsp + rbp + 0x48]
lea r12, [rsp + 0x90]
cmp rax, rdi
lea r13, [rsp + 0x90]
lea rcx, [rsp + 0x90]
cmovne r12, rdx
cmp rax, r14
lea r14, [rax + 8]
cmovne r13, rdx
cmp rax, rbx
cmovne rcx, rdx
mov qword [rsp + 0x40], rcx
nop word [rax + rax]
movsxd rdi, dword [r14]
lea rax, [rsp + 0x38]
mov rdx, rcx
mov qword [rsp + 0x98], rdi
mov ecx, 1
mov qword [rsp + 0x20], rax
mov r9, r12
mov dword [rsp + 0x90], 1
mov r8, r13
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
call fcn.140170a40
test eax, eax
jns 0x140044c63
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov edx, dword [0x140270f70]
xor eax, eax
mov r8, qword [0x140270fc0]
xor ebx, ebx
test edx, edx
jle 0x140044c28
mov rcx, qword [r8 + rax*8]
test rcx, rcx
je 0x140044c28
cmp dword [rcx + 0x70], edi
je 0x140044c28
inc ebx
inc rax
cmp ebx, edx
jl 0x140044c11
cmp ebx, edx
je 0x140044c33
cmp qword [r8 + rax*8], 0
jne 0x140044c36
or ebx, 0xffffffff
lea rcx, [0x140270f40]
call fcn.14002e7d0
mov r8, qword [rsp + rbp + 0x68]
lea rdx, str._s__d__osfd_d_vfd_d_
mov rcx, qword [rsp + 0x30]
mov r9d, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140025f10
mov rcx, qword [rsp + 0x40]
inc esi
add r14, 8
cmp esi, dword [r15]
jb 0x140044bb0
mov rbx, qword [rsp + 0x2e8]
xor edx, edx
mov rdi, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2f0]
mov rax, qword [rsp + rbp + 0x50]
add rbp, 8
test rax, rax
jne 0x140044b64
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2e0]
lea rdx, [0x140198930]
mov rcx, rax
call fcn.1400269a0
mov r8, qword [rsp + 0x30]
lea rdx, str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
mov ecx, 0x580000
mov r8, qword [r8]
call fcn.1400292e0
int3
Function at 0x140044e00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword gs:[0x58]
mov rbx, rcx
mov esi, 0x2fe0
add rsi, qword [rax]
mov rax, qword [rsi]
test rax, rax
jne 0x140044e2c
call fcn.140174cc4
mov r14d, dword [rax]
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, qword [rbx + 0x80]
or dword [rbx + 0x68], 0x400
call fcn.14004df30
mov rcx, qword [rbx + 0x80]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
call fcn.14004de60
mov rcx, rbx
call fcn.14004a2f0
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140042da0]
mov r9, qword [rbx + 0x138]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rcx, eax
call fcn.140170a40
xor edi, edi
mov rbp, rax
test eax, eax
jne 0x140044fb7
mov rax, qword [rsi]
test rax, rax
jne 0x140044ed8
call fcn.140174cc4
mov ecx, dword [rax]
mov edx, 4
mov dword [rsp + 0x28], reloc.WS2_32.dll_setsockopt
mov r9d, 0xe8
mov dword [rsp + 0x20], 6
lea r8d, [rdx - 3]
call fcn.140040f40
test eax, eax
je 0x140044fda
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x140270f88]
mov rcx, qword [rbx + 0xf0]
jne 0x140044f2b
mov qword [0x140270f88], rcx
jmp 0x140044f40
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x140270f88]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x140044f5c
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x140044f6f
test rcx, rcx
je 0x140044f6f
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
lea rcx, [0x140270f40]
mov qword [rbx + 0xf0], rdi
mov qword [rbx + 0xf8], rdi
call fcn.14002e7d0
or dword [rbx + 0x68], 0x4100000
mov rcx, rbx
call fcn.14004a390
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140044fb7
mov rcx, rbx
call fcn.140042450
mov rax, qword [rsi]
test rax, rax
jne 0x140044fc4
call fcn.140174cc4
test ebp, ebp
mov dword [rax], r14d
sete dil
mov eax, edi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x140044ff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
or dword [rbx + 0x68], 0x400
mov rcx, rbx
call fcn.14004a2f0
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140042da0]
mov r9, qword [rbx + 0x138]
lea rdx, [rbx + 0x164]
mov r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rdi, eax
mov rcx, rdi
call fcn.140170a40
test rax, rax
jne 0x1400450b3
mov rcx, qword gs:[0x58]
mov eax, 0x2fe0
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14004508f
call fcn.140174cc4
mov ecx, dword [rax]
mov edx, 3
mov dword [rsp + 0x20], 6
lea r9d, [rdx + 0x6a]
lea r8d, [r9 + 0x7b]
call fcn.140040f40
test eax, eax
je 0x140045179
test edi, edi
jne 0x14004516e
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x140270f88]
mov rcx, qword [rbx + 0xf0]
jne 0x1400450e0
mov qword [0x140270f88], rcx
jmp 0x1400450f5
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x140270f88]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x140045111
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x140045124
test rcx, rcx
je 0x140045124
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
xor eax, eax
lea rcx, [0x140270f40]
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xf8], rax
call fcn.14002e7d0
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x14004515f
mov rcx, rbx
call fcn.140042450
or dword [rbx + 0x68], 0x100000
mov rcx, rbx
call fcn.14004a390
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x140045980
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
test dword [rcx + 0x68], 0x2000
mov rbx, rcx
je 0x14004599d
call sub.ntdll.dll_NtTestAlert
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 0x88]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
call fcn.14004e2d0
cmp dword [rsp + 0x50], 0
je 0x140045b5e
mov rax, qword [rbx + 0x140]
or dword [rbx + 0x68], 0x2000
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x140]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, rbx
call fcn.14004a4b0
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140042ed0]
mov r9, qword [rbx + 0x140]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
movsxd rcx, eax
call fcn.140170a40
mov ebp, 0x2fe0
mov rsi, rax
test eax, eax
jne 0x140045b30
mov rcx, qword gs:[0x58]
mov edi, ebp
add rdi, qword [rcx]
mov rax, qword [rdi]
test rax, rax
jne 0x140045a60
call fcn.140174cc4
cmp dword [rax], 0xe8
jne 0x140045b81
mov rax, qword [rdi]
test rax, rax
jne 0x140045a79
call fcn.140174cc4
cmp dword [rax], 0xe8
jne 0x140045b30
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x140270f90]
mov rcx, qword [rbx + 0xe0]
jne 0x140045aaa
mov qword [0x140270f90], rcx
jmp 0x140045abf
mov rax, qword [rbx + 0xe8]
mov qword [rax + 0xe0], rcx
mov rcx, qword [0x140270f90]
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
je 0x140045adb
mov rax, qword [rbx + 0xe8]
mov qword [rdx + 0xe8], rax
jmp 0x140045aee
test rcx, rcx
je 0x140045aee
mov rax, qword [rbx + 0xe8]
mov qword [rcx + 0xe8], rax
xor eax, eax
lea rcx, [0x140270f40]
mov qword [rbx + 0xe0], rax
mov qword [rbx + 0xe8], rax
call fcn.14002e7d0
mov eax, dword [rbx + 0x68]
btr eax, 0xd
bts eax, 0x1a
mov dword [rbx + 0x68], eax
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140045b30
mov rcx, rbx
call fcn.140042450
cmp dword [rsp + 0x50], 0
je 0x140045b5e
test esi, esi
jne 0x140045b6c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rbp + rcx]
test rax, rax
jne 0x140045b56
call fcn.140174cc4
cmp dword [rax], 0xe8
jne 0x140045b6c
mov eax, dword [rbx + 0x68]
test al, 0x10
jne 0x140045b6c
btr eax, 0xd
mov dword [rbx + 0x68], eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
lea rdx, str.WriteFileEx_failed:__m
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x140046ad0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov word [rsp + 0x48], dx
mov eax, 0x10624dd3
imul r8d
movsxd rbx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [0x140270f68]
mov word [rsp + 0x4a], dx
test rax, rax
je 0x140046b24
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov ecx, ebx
call rax
mov ebx, eax
jmp 0x140046c69
cmp qword [0x140270f18], 0
mov qword [rsp + 0x40], rdi
je 0x140046b80
mov rax, qword gs:[0x58]
mov edx, 0x23d4
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x140046b80
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rdi, rbx
mov rbx, qword [rax + rbx*8]
call fcn.14002e7d0
test dword [rbx + 0x68], 0x10000000
jne 0x140046b83
mov ebx, 1
jmp 0x140046b85
mov rdi, rbx
xor ebx, ebx
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
test ebx, ebx
mov rbx, qword [rax + rdi*8]
jne 0x140046bf2
call fcn.14002e7d0
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x140046bc4
cmp dword [rbx + 0xc], 2
jne 0x140046bc4
cmp word [rbx + 0x6c], 0
jne 0x140046c0f
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140170a40
mov rbx, rax
jmp 0x140046c64
call fcn.14002e7d0
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x140046c39
cmp dword [rbx + 0xc], 2
jne 0x140046c39
cmp word [rbx + 0x6c], 0
je 0x140046c39
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140046c2e
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_shutdown
or ebx, 0xffffffff
jmp 0x140046c64
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140170a40
mov ebx, eax
mov rdi, qword [rsp + 0x40]
test ebx, ebx
je 0x140046c85
lea r8, str.SO_LINGER
mov ecx, 0x580003
lea rdx, str.failed_setsockopt__s_:__m
call fcn.140028e10
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140046c90
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x10], edx
push rsi
sub rsp, 0x30
movsxd rbp, ecx
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rsi, [rbp*8]
lea rcx, [0x140270f40]
mov rbx, qword [rsi + rax]
call fcn.14002e7d0
test byte [rbx + 0x68], 1
jne 0x140046ce9
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [0x140270f68]
mov qword [rsp + 0x40], rdi
or edi, 0xffffffff
test rax, rax
je 0x140046d1a
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea edx, [rdi + 7]
mov ecx, ebp
lea r8d, [rdi + 2]
call rax
jmp 0x140046dfb
cmp qword [0x140270f18], 0
je 0x140046d6e
mov rax, qword gs:[0x58]
mov edx, 0x23d4
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x140046d6e
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rsi + rax]
call fcn.14002e7d0
test dword [rbx + 0x68], 0x10000000
jne 0x140046d6e
mov ebx, 1
jmp 0x140046d70
xor ebx, ebx
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
test ebx, ebx
mov rbx, qword [rsi + rax]
call fcn.14002e7d0
cmp qword [rbx + 0x40], 0
je 0x140046dd2
cmp dword [rbx + 0xc], 2
jne 0x140046dd2
cmp word [rbx + 0x6c], 0
je 0x140046dd2
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140046dc8
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_shutdown
mov eax, edi
jmp 0x140046dfb
movsxd rcx, dword [rbx + 0x70]
lea r9, [rsp + 0x48]
mov r8d, 1
mov dword [rsp + 0x20], 4
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140170a40
test eax, eax
je 0x140046e3d
mov rax, qword [0x140270f18]
mov ecx, 3
test rax, rax
mov edx, 7
cmovne ecx, edx
jne 0x140046e39
cmp ecx, 5
jbe 0x140046e25
cmp dword [0x140271460], ecx
jl 0x140046e39
or ecx, 0x580000
lea rdx, str.failed_setsockopt_TCP_NODELAY_:__m
call fcn.140028e10
mov edi, eax
mov eax, edi
jmp 0x140046e3f
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140046e60
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x140270f40]
mov dword [rsp + 0x30], edx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rbx, [rbx*8]
lea rcx, [0x140270f40]
mov rdi, qword [rbx + rax]
call fcn.14002e7d0
mov eax, dword [rdi + 0x68]
test al, 1
je 0x140046f57
test esi, esi
jne 0x140046ef3
test al, al
jns 0x140046ef3
movsxd rcx, dword [rdi + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
je 0x140046ef3
lea rdx, str.WSAEventSelect:__m
mov ecx, 0x580003
call fcn.140028e10
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rbx + rax]
call fcn.14002e7d0
movsxd rcx, dword [rbx + 0x70]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd rcx, eax
call fcn.140170a40
test eax, eax
je 0x140046f57
lea rdx, str.failed_ioctl_FIOBIO_:__m
mov ecx, 0x580003
call fcn.140028e10
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
and dword [rdi + 0x68], 0xffffff7f
mov rbx, qword [rsp + 0x38]
neg esi
mov rsi, qword [rsp + 0x40]
sbb eax, eax
and eax, 0x80
or dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140048610
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x140270f40]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rax + rbx*8]
call fcn.14002e7d0
cmp dword [rbx + 0xc], 2
jne 0x140048780
cmp esi, 0x10
jae 0x140048692
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048679
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x1400486ac
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x140048780
cmp word [rbx + 0x6c], 0
je 0x140048780
mov rcx, rbx
call fcn.14004a200
test eax, eax
jne 0x14004867f
mov eax, dword [rdi + 4]
test eax, eax
je 0x14004871e
cmp eax, dword [rbx + 0x9c]
je 0x14004871e
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048705
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x140048763
movzx eax, word [rdi + 2]
test ax, ax
je 0x140048763
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140048800
cmp dword [0x14027103c], 0
je 0x14004879e
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.14002ecc0
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140170a40
cmp dword [0x14027103c], 0
mov rdi, rax
je 0x1400487c7
call fcn.14002f160
test edi, edi
jne 0x1400487ed
cmp dword [rbx + 0xc], 2
jne 0x1400487ed
cmp word [rbx + 0x94], di
jne 0x1400487ed
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140048800
test eax, eax
jne 0x14004867f
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
je 0x14004883a
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret