joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025ec0
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x10026850
Capabilities:
Get mac address on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov dword [rcx], 0
mov rbp, rcx
mov qword [rsp + 0x78], rdi
mov ecx, 0x2c0
mov qword [rsp + 0x50], r12
xor r12b, r12b
mov esi, edx
call qword [sym.imp.msvcrt.dll_malloc]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x2c0
mov rcx, rax
mov rdi, rax
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x100268bd
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x10026a21
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x60], rbx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x10026a0b
test rdi, rdi
mov rbx, rdi
je 0x10026a19
cmp dword [rbx + 0x194], 6
jne 0x100269ff
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_ntoa]
test rax, rax
mov r11, rax
je 0x100269ff
lea r9, [rbx + 0x1b8]
test r9, r9
je 0x100269ff
nop
nop
nop
lea r8, [r9 + 8]
mov rax, r11
sub r8, r11
nop
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x10026943
inc rax
test ecx, ecx
jne 0x10026930
test edx, edx
je 0x10026954
mov r9, qword [r9]
test r9, r9
jne 0x10026920
jmp 0x100269ff
movzx edx, byte [rbx + 0x19c]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x19b]
movzx r11d, byte [rbx + 0x19a]
movzx r9d, byte [rbx + 0x199]
movzx r8d, byte [rbx + 0x198]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r10d
lea rdx, [0x1004be88]
lea rcx, [rbp + 4]
mov r12b, 1
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
movzx r11d, byte [rbx + 0x198]
mov byte [rbp + 0x84], r11b
movzx eax, byte [rbx + 0x199]
mov byte [rbp + 0x85], al
movzx eax, byte [rbx + 0x19a]
mov byte [rbp + 0x86], al
movzx eax, byte [rbx + 0x19b]
mov byte [rbp + 0x87], al
movzx eax, byte [rbx + 0x19c]
mov byte [rbp + 0x88], al
movzx eax, byte [rbx + 0x19d]
mov dword [rbp], 1
mov byte [rbp + 0x89], al
mov rbx, qword [rbx]
test rbx, rbx
jne 0x100268e3
test rdi, rdi
je 0x10026a19
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x60]
mov al, r12b
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x58
ret
Function at 0x10027130
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor al, al
add rsp, 0x28
ret

Function at 0x10027150
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
cmp ecx, 1
jl 0x1002715e
cmp ecx, 3
jle 0x10027190
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
movzx r11d, ax
jne 0x10027178
mov eax, 2
add rsp, 0x28
ret
mov eax, 1
mov ecx, 3
cmp r11w, 0x404
cmove eax, ecx
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x10027260
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [0x1005d650]
mov qword [rsp + 0x100], rax
cmp byte [0x10064610], 0
jne 0x10027499
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
lea rcx, [rsp + 0x64]
xor ebx, ebx
xor edx, edx
mov r8d, 0x98
mov dword [rsp + 0x60], ebx
mov qword [r11 + 0x20], rdi
call sub.msvcrt.dll_memset
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x2c]
xor edx, edx
mov dword [rsp + 0x28], ebx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov dword [0x10064634], ebx
call fcn.100238d0
lea rdx, [0x1004c148]
test rdx, rdx
mov rsi, rbx
je 0x100272fb
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x100272fb
mov rcx, rdx
call sub.KERNEL32.dll_LoadLibraryA
mov rsi, rax
lea rdx, [0x1004c158]
mov rcx, rsi
call sub.KERNEL32.dll_GetProcAddress
mov rcx, rsi
mov rdi, rax
call fcn.100238d0
test rdi, rdi
mov rsi, qword [rsp + 0x130]
je 0x1002732b
lea rcx, [rsp + 0x28]
call rdi
jmp 0x10027336
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1002745c
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x68]
movzx eax, word [rsp + 0x6c]
cmp edx, 5
mov dword [0x10064624], edx
mov dword [0x10064628], ecx
mov dword [0x10064630], eax
jne 0x10027413
test ecx, ecx
jne 0x1002738c
mov dword [0x10064620], 1
jmp 0x10027489
cmp ecx, 1
jne 0x100273a0
mov dword [0x10064620], 2
jmp 0x10027489
cmp ecx, 2
jne 0x10027489
cmp byte [rsp + 0xfa], 1
jne 0x100273ca
cmp word [rsp + 0x28], 9
jne 0x100273ca
mov dword [0x10064620], 3
jmp 0x10027489
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10027407
cmp word [rsp + 0xf8], 0x8000
je 0x10027407
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x10027489
mov dword [0x10064620], 5
jmp 0x10027489
mov dword [0x10064620], 4
jmp 0x10027489
cmp edx, 6
jne 0x10027489
test ecx, ecx
jne 0x10027431
cmp byte [rsp + 0xfa], 1
setne bl
add ebx, edx
mov dword [0x10064620], ebx
jmp 0x10027489
cmp ecx, 1
jne 0x1002744b
cmp byte [rsp + 0xfa], cl
sete bl
add ebx, 8
mov dword [0x10064620], ebx
jmp 0x10027489
cmp ecx, 2
jne 0x10027489
mov dword [0x10064620], 0xa
jmp 0x10027489
xor ecx, ecx
call fcn.10021fa0
lea rdx, [0x1004c170]
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.100277d0
lea rdx, str._comm__detect_OS_type_failed:__s
mov rcx, rax
mov r8, rdi
call fcn.100278d0
mov rbx, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x138]
mov byte [0x10064610], 1
mov rcx, qword [rsp + 0x100]
call fcn.10044fa0
add rsp, 0x118
ret
Function at 0x100277f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
lea rsi, [0x100646c0]
xor edx, edx
mov r8d, 0x5000
mov rcx, rsi
mov qword [rsp + 0x40], rdi
call sub.msvcrt.dll_memset
xor eax, eax
lea rcx, [rsp + 0x30]
lea rdi, [rsp + 0x70]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x32], rax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
movzx r11d, word [rsp + 0x3c]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x1004c1e0]
mov rcx, rsi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_swprintf]
mov rdx, qword [rsp + 0x68]
mov r8, rdi
movsxd rbx, eax
lea rcx, [rsi + rbx*2]
call qword [sym.imp.msvcrt.dll_vswprintf]
lea rdx, [0x1004c208]
add eax, ebx
cdqe
lea rcx, [rsi + rax*2]
call qword [sym.imp.msvcrt.dll_swprintf]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret

Function at 0x100278d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2801
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], rdi
call fcn.10001ff0
xor eax, eax
lea rcx, [rsp + 0x30]
lea rsi, [rsp + 0x90]
mov word [rsp + 0x30], 0
mov dword [rsp + 0x3a], eax
mov qword [rsp + 0x32], rax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rax, qword [rbx]
movzx r11d, word [rsp + 0x3c]
mov rdi, qword [rsp + 0x50]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.__02u:_02u:_02u__s
mov rcx, rdi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_sprintf]
mov rdx, qword [rsp + 0x88]
mov r8, rsi
movsxd rbx, eax
lea rcx, [rdi + rbx]
call qword [sym.imp.msvcrt.dll_vsprintf]
lea rdx, [0x1004c1dc]
add ebx, eax
movsxd rcx, ebx
add rcx, rdi
call qword [sym.imp.msvcrt.dll_sprintf]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test rdi, rdi
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
je 0x100279be
mov rcx, rdi
call fcn.100449c0
mov rdi, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x100298a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x108
mov rax, qword [0x1005d650]
mov qword [rsp + 0xe0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rbp, rcx
mov rbx, rdx
lea rcx, [rsp + 0x51]
mov r8d, 0x87
xor edx, edx
mov qword [r11 - 8], rsi
mov byte [rsp + 0x50], 0
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x50]
xor esi, esi
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x30], esi
call qword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x100299c9
mov qword [rsp + 0xf8], rdi
movsxd rdi, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [rsp + 0x30], eax
je 0x100299b8
lea rcx, [rsp + 0x38]
mov edx, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call fcn.10001ff0
mov rbx, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100299ab
lea edx, [rsi + 1]
lea rcx, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rsi
call fcn.10001ff0
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.10028ab0
mov rsi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x38]
mov rdx, rsi
mov rcx, rbp
call fcn.10028fe0
test rsi, rsi
je 0x100299ab
mov rcx, rsi
call fcn.100449c0
test rbx, rbx
je 0x100299b8
mov rcx, rbx
call fcn.100449c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xe0]
call fcn.10044fa0
add rsp, 0x108
ret

Function at 0x1002ad20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx]
mov rbx, rdx
mov rax, r8
lea rdx, [rsp + 0x68]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002ad66
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
add rsp, 0x40
pop rbx
ret
Function at 0x1002ad80
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2878
call fcn.10044fd0
sub rsp, rax
mov rax, qword [0x1005d650]
mov qword [rsp + 0x2840], rax
mov qword [rsp + 0x2870], rbx
mov qword [rsp + 0x2868], rbp
mov rbx, rcx
mov qword [rsp + 0x2860], rsi
mov rbp, rdx
mov rsi, r8
lea rcx, [rsp + 0x41]
mov r8d, 0x27ff
xor edx, edx
mov qword [rsp + 0x2858], rdi
mov dword [rsp + 0x30], 0x2800
mov byte [rsp + 0x40], 0
mov rdi, r9
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
lea r11, [rsp + 0x30]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rdi, qword [rsp + 0x2858]
test eax, eax
mov ebx, eax
jne 0x1002ae55
mov rax, qword [rsi]
mov edx, dword [rsp + 0x30]
test rax, rax
je 0x1002ae2e
cmp rax, rdx
jbe 0x1002ae31
mov qword [rsi], rdx
mov r8, qword [rsi]
test r8, r8
je 0x1002ae53
lea rdx, [rsp + 0x40]
dec r8
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_strncpy]
mov r11, qword [rsi]
mov byte [r11 + rbp - 1], 0
mov eax, ebx
mov rsi, qword [rsp + 0x2860]
mov rbp, qword [rsp + 0x2868]
mov rbx, qword [rsp + 0x2870]
mov rcx, qword [rsp + 0x2840]
call fcn.10044fa0
add rsp, 0x2878
ret

Function at 0x1002aee0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], r8d
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x1002af20
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
pop rdi
ret
Function at 0x1002d470
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x48], r13
mov ebp, r8d
mov rbx, rdx
mov r13, rcx
jne 0x1002d4d6
lea rdx, [0x1004c628]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:_Invalid_Socket.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
test rdx, rdx
jne 0x1002d51f
lea rdx, [0x1004c668]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:_NULL_buffer.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
test r8d, r8d
mov esi, r12d
je 0x1002d5b4
nop
nop
mov rcx, qword [r13]
movsxd rdx, r12d
xor r9d, r9d
add rdx, rbx
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov esi, eax
je 0x1002d56a
test eax, eax
je 0x1002d5b4
add r12d, eax
sub ebp, eax
jne 0x1002d540
jmp 0x1002d5b4
mov qword [rsp + 0x78], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10021fa0
lea rdx, [0x1004c6a0]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::send_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.100278d0
mov rdi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
test ebp, ebp
mov rbp, qword [rsp + 0x68]
cmove esi, r12d
mov r12, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x58
ret
Function at 0x1002d5e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r13
mov ebp, r9d
mov r13, rcx
mov rbx, r8
mov rdi, rdx
jne 0x1002d63f
lea rdx, [0x1004c6d0]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:_Invalid_Socket.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
jmp 0x1002d719
test rbx, rbx
jne 0x1002d677
lea rdx, [0x1004c710]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:_NULL_buffer.
mov rcx, rax
call fcn.100278d0
lea eax, [rbx - 1]
jmp 0x1002d719
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
xor r12d, r12d
test r9d, r9d
mov esi, r12d
je 0x1002d707
mov rcx, qword [r13]
movsxd rdx, r12d
xor r9d, r9d
mov r8d, ebp
add rdx, rbx
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
mov esi, eax
je 0x1002d6c7
test eax, eax
je 0x1002d707
add r12d, eax
sub ebp, eax
jne 0x1002d690
jmp 0x1002d707
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10021fa0
lea rdx, [0x1004c750]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
mov r9d, dword [r13 + 0x8c]
lea r8, [r13 + 9]
lea rdx, str._comm__Socket__s:_d_::sendto_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.100278d0
test ebp, ebp
cmove esi, r12d
mov r12, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1002d7f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rcx
mov rcx, qword [rcx]
mov ebx, r8d
cmp rcx, 0xffffffffffffffff
jne 0x1002d84c
lea rdx, [0x1004c780]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:_Invalid_Socket.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
test rdx, rdx
jne 0x1002d890
lea rdx, [0x1004c7c0]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:_NULL_buffer.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
cmp byte [rsi + 8], 0
mov qword [rsp + 0x58], rbp
je 0x1002d8b4
mov r8d, 1
test ebx, ebx
cmovg r8d, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
jmp 0x1002d8e2
lea rax, [rsp + 0x30]
mov r8d, 1
test ebx, ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
cmovg r8d, ebx
xor r9d, r9d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_recvfrom]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1002d933
mov qword [rsp + 0x68], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10021fa0
lea rdx, [0x1004c7f8]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.100278d0
mov rdi, qword [rsp + 0x68]
jmp 0x1002d966
test ebp, ebp
jne 0x1002d966
test ebx, ebx
jle 0x1002d966
lea rdx, [0x1004c828]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::recv_info:_The_connection_has_been_gracefully_closed.
mov rcx, rax
call fcn.100278d0
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x1002d990
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x58
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov rdi, r9
mov r13d, r8d
mov rbx, rdx
mov r12, rcx
jne 0x1002d9f1
lea rdx, [0x1004c880]
lea rcx, [rsp + 0x38]
call fcn.100277d0
mov r9d, dword [r12 + 0x8c]
lea r8, [r12 + 9]
lea rdx, str._comm__Socket__s:_d_::recv_all_error:_Invalid_Socket.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
jmp 0x1002db08
test rdx, rdx
jne 0x1002da2d
lea rdx, [0x1004c8c0]
lea rcx, [rsp + 0x38]
call fcn.100277d0
mov r9d, dword [r12 + 0x8c]
lea r8, [r12 + 9]
lea rdx, str._comm__Socket__s:_d_::recv_all_error:_NULL_buffer.
mov rcx, rax
call fcn.100278d0
mov eax, 0xffffffff
jmp 0x1002db08
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor esi, esi
test r8d, r8d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov ebp, esi
jle 0x1002daf6
nop
cmp byte [r12 + 8], 0
je 0x1002da75
mov rcx, qword [r12]
mov r8d, r13d
movsxd rdx, ebp
sub r8d, ebp
add rdx, rbx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
jmp 0x1002da9f
mov rcx, qword [r12]
lea rax, [rsp + 0x30]
mov r8d, r13d
mov qword [rsp + 0x28], rax
movsxd rdx, ebp
sub r8d, ebp
add rdx, rbx
xor r9d, r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
test esi, esi
je 0x1002daaf
cmp esi, 0xffffffff
je 0x1002dab4
add ebp, esi
cmp ebp, r13d
jl 0x1002da50
cmp esi, 0xffffffff
jne 0x1002daf6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10021fa0
lea rdx, [0x1004c900]
lea rcx, [rsp + 0x38]
mov rbx, rax
call fcn.100277d0
mov r9d, dword [r12 + 0x8c]
lea r8, [r12 + 9]
lea rdx, str._comm__Socket__s:_d_::recv_all_error:__s.
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.100278d0
cmp ebp, r13d
cmove esi, ebp
mov rbp, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x1002e040
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1005d650]
mov qword [rsp + 0x48], rax
cmp byte [rcx + 8], 0
mov qword [rsp + 0x70], rsi
mov rsi, rcx
je 0x1002e072
mov edx, 1
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
jmp 0x1002e083
mov edx, 2
mov ecx, edx
lea r8d, [rdx + 0xf]
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rsi], rax
jne 0x1002e0e0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rdi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10021fa0
lea rdx, [0x1004c568]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::create_failed:__s
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.100278d0
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1002e149
xor eax, eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov word [rsp + 0x38], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1002e132
movzx ecx, word [rsp + 0x3a]
call qword [sym.imp.WS2_32.dll_htons]
movzx r11d, ax
mov dword [rsi + 0x8c], r11d
mov rax, qword [rsi]
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.10044fa0
add rsp, 0x58
ret
mov rax, rcx
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call fcn.10044fa0
add rsp, 0x58
ret
Function at 0x1002e170
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1005d650]
mov qword [rsp + 0x58], rax
cmp qword [rcx], 0xffffffffffffffff
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x68], rsi
mov rbp, r8
mov dword [rcx + 0x8c], edx
mov rsi, rcx
jne 0x1002e1ba
call fcn.1002e040
cmp rax, 0xffffffffffffffff
jne 0x1002e1ba
mov dword [rsi + 0x8c], eax
jmp 0x1002e307
movzx ebx, word [rsi + 0x8c]
xor eax, eax
mov rcx, rbp
mov dword [rsp + 0x38], eax
mov word [rsp + 0x38], 2
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_inet_addr]
test bx, bx
mov dword [rsp + 0x3c], eax
jne 0x1002e1f3
mov word [rsp + 0x3a], bx
jmp 0x1002e201
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x38]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1002e28f
cmp byte [rsi + 8], 0
je 0x1002e233
mov rcx, qword [rsi]
mov edx, 5
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1002e28f
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1002e307
xor eax, eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov word [rsp + 0x48], 0
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1002e307
movzx ecx, word [rsp + 0x4a]
call qword [sym.imp.WS2_32.dll_htons]
movzx r11d, ax
mov dword [rsi + 0x8c], r11d
jmp 0x1002e307
mov qword [rsp + 0x60], rdi
mov dword [rsi + 0x8c], 0xffffffff
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.10021fa0
lea rdx, [0x1004c598]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s:_d_::listen_failed:__s
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.100278d0
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x60]
je 0x1002e300
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rsi], 0xffffffffffffffff
lea rdx, [0x1004c5c8]
lea rcx, [rsp + 0x30]
call fcn.100277d0
mov r9d, dword [rsi + 0x8c]
lea r8, [rsi + 9]
lea rdx, str._comm__Socket__s_::listen__d___s_
mov rcx, rax
mov qword [rsp + 0x20], rbp
call fcn.100278d0
mov eax, dword [rsi + 0x8c]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
call fcn.10044fa0
add rsp, 0x78
ret