joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c02c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
movaps xmm6, xmm2
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x1400c02f8
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x1400c0306
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x1400c031b
jmp 0x1400c0466
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x1400c0466
mov eax, dword [rbx]
test al, 2
je 0x1400c0466
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
xorps xmm0, xmm0
ucomiss xmm6, xmm0
jae 0x1400c034b
movss xmm6, dword [0x14025ab88]
jmp 0x1400c0350
divss xmm6, dword [rcx + 0x14]
movsd xmm0, qword [r9]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm7, xmm0
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.1400b70b0
mov r8d, dword [rbx + 0x24]
mov r10d, dword [rbx + 0x20]
mov r11d, dword [rbx + 0x1c]
mov r9d, dword [rbx + 0x18]
shufps xmm6, xmm6, 0
movsd xmm1, qword [rbx + 8]
movsd xmm0, qword [rbx + 0x10]
mulps xmm1, xmm6
addps xmm1, xmm7
mov ebx, dword [rsi + 0x34]
mov rcx, qword [rsi + 0x50]
lea edx, [rbx + 1]
lea eax, [rbx + 2]
mov word [rcx], bx
mov rcx, qword [rsi + 0x50]
mov word [rcx + 2], dx
mov rcx, qword [rsi + 0x50]
mov word [rcx + 4], ax
mov rcx, qword [rsi + 0x50]
mov word [rcx + 6], bx
mov ecx, ebx
add ecx, 3
movaps xmm2, xmm1
shufps xmm2, xmm1, 0x55
mulps xmm0, xmm6
addps xmm0, xmm7
mov rdx, qword [rsi + 0x50]
mov word [rdx + 8], ax
mov rax, qword [rsi + 0x50]
mov word [rax + 0xa], cx
mov rax, qword [rsi + 0x48]
movlps qword [rax], xmm1
mov rax, qword [rsi + 0x48]
mov dword [rax + 8], r9d
mov dword [rax + 0xc], r11d
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x10], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x14], xmm0
movss dword [rax + 0x18], xmm2
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x1c], r10d
mov dword [rax + 0x20], r11d
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x24], edi
mov rax, qword [rsi + 0x48]
movlps qword [rax + 0x28], xmm0
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x30], r10d
mov dword [rax + 0x34], r8d
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x38], edi
mov rax, qword [rsi + 0x48]
movss dword [rax + 0x3c], xmm1
shufps xmm0, xmm0, 0x55
movss dword [rax + 0x40], xmm0
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x44], r9d
mov dword [rax + 0x48], r8d
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400eb050
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x140330bf8], 0
je 0x1400eb184
mov esi, edx
mov edi, ecx
lea rbx, [0x140330c08]
inc dword [0x140330c10]
mov dword [0x140330c14], 0xaede7345
call fcn.14023cc88
mov dword [0x140330c0c], eax
movsx eax, di
mov dword [0x14033143c], eax
movsx eax, si
mov dword [0x140331440], eax
movups xmm0, xmmword [0x140331448]
movups xmmword [0x140330c28], xmm0
movups xmm0, xmmword [0x140331458]
movups xmmword [0x140330c38], xmm0
mov rax, qword [0x140331468]
mov qword [0x140330c48], rax
movups xmm0, xmmword [0x140331438]
movups xmmword [0x140330c18], xmm0
mov rcx, qword [0x140330bf8]
lea rax, [0x140331428]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov rdx, rbx
mov r8d, 0x48
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
mov qword [0x14033143c], 0
mov dword [rsp + 0x34], reloc.WS2_32.dll_recv
mov rcx, qword [0x140330bf8]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x140331018]
mov r8d, 0x400
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
js 0x1400eb18b
mov eax, dword [0x140331024]
mov esi, 0xffffdcdc
cmp eax, dword [0x140330c14]
jne 0x1400eb190
mov eax, dword [0x140331020]
xor ecx, ecx
cmp eax, dword [0x140330c10]
mov esi, 0xffffdcdd
cmove esi, ecx
jmp 0x1400eb190
mov esi, 0xffffdcd8
jmp 0x1400eb190
mov esi, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140141380
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400eb1b0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [0x140330bf8], 0
je 0x1400eb2dc
mov edi, ecx
lea rsi, [0x140330c08]
inc dword [0x140330c10]
mov dword [0x140330c14], 0x9823ae8d
call fcn.14023cc88
mov dword [0x140330c0c], eax
xor eax, eax
test edi, edi
setne al
mov ecx, dword [0x140331438]
and ecx, 0xfffffffe
or eax, ecx
mov dword [0x140331438], eax
movups xmm0, xmmword [0x140331448]
movups xmmword [0x140330c28], xmm0
movups xmm0, xmmword [0x140331458]
movups xmmword [0x140330c38], xmm0
mov rax, qword [0x140331468]
mov qword [0x140330c48], rax
movups xmm0, xmmword [0x140331438]
movups xmmword [0x140330c18], xmm0
mov rcx, qword [0x140330bf8]
lea rax, [0x140331428]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov rdx, rsi
mov r8d, 0x48
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
mov dword [rsp + 0x3c], reloc.WS2_32.dll_recv
mov rcx, qword [0x140330bf8]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [0x140331018]
mov r8d, 0x400
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
js 0x1400eb2e3
mov eax, dword [0x140331024]
mov esi, 0xffffdcdc
cmp eax, dword [0x140330c14]
jne 0x1400eb2e8
mov eax, dword [0x140331020]
xor ecx, ecx
cmp eax, dword [0x140330c10]
mov esi, 0xffffdcdd
cmove esi, ecx
jmp 0x1400eb2e8
mov esi, 0xffffdcd8
jmp 0x1400eb2e8
mov esi, 0xffffdcdb
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140141380
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400eb9a0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x50
mov eax, ecx
mov rcx, qword [0x1403295b8]
xor rcx, rsp
mov qword [rsp + 0x48], rcx
mov rcx, qword [0x140330bf8]
test rcx, rcx
je 0x1400eba87
lea rdx, [0x140330c08]
inc dword [0x140330c10]
mov dword [0x140330c14], 0x23234343
xor esi, esi
test eax, eax
setne sil
mov eax, dword [0x1403314a0]
and eax, 0xfffffffe
or esi, eax
mov dword [0x1403314a0], esi
mov dword [0x140330c0c], esi
lea rax, [0x140331428]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov r8d, reloc.WS2_32.dll_recv
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
mov dword [rsp + 0x34], reloc.WS2_32.dll_recv
mov rcx, qword [0x140330bf8]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [0x140331018]
mov r8d, 0x400
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
js 0x1400eba8e
mov eax, dword [0x140331024]
mov esi, 0xffffdcdc
cmp eax, dword [0x140330c14]
jne 0x1400eba93
mov eax, dword [0x140331020]
xor ecx, ecx
cmp eax, dword [0x140330c10]
mov esi, 0xffffdcdd
cmove esi, ecx
jmp 0x1400eba93
mov esi, 0xffffdcd8
jmp 0x1400eba93
mov esi, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140141380
mov eax, esi
add rsp, 0x50
pop rsi
ret
Function at 0x1400f4680
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
mov rdi, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
je 0x1400f46fd
mov ecx, 8
call fcn.140140ff0
mov r14, rax
mov rax, qword [rbx]
mov qword [r14], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
lea r8, [0x1400f4aa0]
xor ecx, ecx
xor edx, edx
mov r9, r14
call fcn.14022d310
mov qword [rdi], rax
test rax, rax
je 0x1400f4715
mov rax, qword [rsi + 8]
lea rcx, [rax + 0x10]
mov qword [rsi + 8], rcx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.1400f4760
mov qword [rbp - 0x10], r14
mov dword [rbx], 0
mov ecx, 6
call fcn.1401435a8
int3
Function at 0x1400f4760
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov r12, qword [rcx]
mov r13, qword [rcx + 8]
sub r13, r12
sar r13, 4
inc r13
mov rax, qword [rcx + 0x10]
sub rax, r12
sar rax, 4
mov rsi, rax
shr rsi, 1
movabs rdi, 0xfffffffffffffff
mov rbx, rdi
sub rbx, rsi
add rsi, rax
cmp rsi, r13
cmovbe rsi, r13
cmp rax, rbx
cmova rsi, rdi
mov rax, rsi
shr rax, 0x3c
jne 0x1400f49e1
mov r14, r8
mov rdi, rdx
mov rdx, rsi
shl rdx, 4
cmp rsi, 0x100
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x28], rsi
mov qword [rbp - 8], rdx
jb 0x1400f4819
movabs rax, 0xffffffffffffffe
cmp rsi, rax
jae 0x1400f49e1
lea rcx, [rdx + 0x27]
call fcn.140140ff0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400f482d
test rsi, rsi
je 0x1400f482b
mov rcx, rdx
call fcn.140140ff0
mov rcx, rax
jmp 0x1400f482d
xor ecx, ecx
mov r15, rdi
sub r15, r12
sar r15, 4
shl r15, 4
mov qword [rbp - 0x20], rcx
lea rax, [rcx + r15]
add rax, 0x10
mov qword [rbp - 0x10], rax
mov ecx, 8
call fcn.140140ff0
mov rbx, rax
mov rsi, qword [rbp - 0x20]
add r15, rsi
mov rax, qword [r14]
mov qword [rbx], rax
lea r14, [r15 + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
lea r8, [0x1400f4aa0]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call fcn.14022d310
mov qword [r15], rax
test rax, rax
je 0x1400f49e6
mov r14, qword [rbp - 0x18]
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
cmp rcx, rdi
mov rbx, qword [rbp - 0x10]
je 0x1400f491b
cmp rax, rdi
je 0x1400f48dd
xor ecx, ecx
movups xmm0, xmmword [rax + rcx]
movups xmmword [rsi + rcx], xmm0
mov qword [rax + rcx], 0
mov dword [rax + rcx + 8], 0
lea rdx, [rax + rcx]
add rdx, 0x10
add rcx, 0x10
cmp rdx, rdi
jne 0x1400f48b0
mov rcx, qword [r14 + 8]
cmp rcx, rdi
je 0x1400f4959
xor eax, eax
nop word cs:[rax + rax]
movups xmm0, xmmword [rdi + rax]
movups xmmword [rbx + rax], xmm0
mov qword [rdi + rax], 0
mov dword [rdi + rax + 8], 0
lea rdx, [rdi + rax]
add rdx, 0x10
add rax, 0x10
cmp rdx, rcx
jne 0x1400f48f0
jmp 0x1400f4959
cmp rax, rdi
je 0x1400f495c
xor ecx, ecx
nop word cs:[rax + rax]
movups xmm0, xmmword [rax + rcx]
movups xmmword [rsi + rcx], xmm0
mov qword [rax + rcx], 0
mov dword [rax + rcx + 8], 0
lea rdx, [rax + rcx]
add rdx, 0x10
add rcx, 0x10
cmp rdx, rdi
jne 0x1400f4930
mov rdi, qword [r14]
test rdi, rdi
je 0x1400f49af
mov rax, qword [r14 + 8]
cmp rdi, rax
je 0x1400f497f
mov rcx, rdi
nop dword [rax]
cmp dword [rcx + 8], 0
jne 0x1400f49dc
add rcx, 0x10
cmp rcx, rax
jne 0x1400f4970
mov rdx, qword [r14 + 0x10]
sub rdx, rdi
cmp rdx, 0x1000
jb 0x1400f49a7
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x1400f49fb
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
call fcn.140141034
mov qword [r14], rsi
shl r13, 4
add r13, rsi
mov qword [r14 + 8], r13
mov rax, qword [rbp - 8]
add rax, rsi
mov qword [r14 + 0x10], rax
mov rax, r15
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14023fbf4
call fcn.1400022f0
mov qword [rbp - 8], rbx
mov dword [r14], 0
mov ecx, 6
call fcn.1401435a8
call fcn.140231990
int3
Function at 0x1400f54c0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x250], rax
call fcn.140145674
mov rdi, rax
call fcn.140145658
cmp rdi, 0x989680
jne 0x1400f5507
imul rdi, rax, 0x64
jmp 0x1400f554b
mov rcx, rax
or rcx, rdi
shr rcx, 0x20
je 0x1400f551a
cqo
idiv rdi
jmp 0x1400f551e
xor edx, edx
div edi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rdi
or rdx, rax
shr rdx, 0x20
je 0x1400f5542
cqo
idiv rdi
mov rdi, rax
jmp 0x1400f5548
xor edx, edx
div edi
mov edi, eax
add rdi, rcx
lea ebx, [rbp + 1]
imul r14, rsi, 0x3e8
movabs rax, 0x271000000000
lea r13, [rsp + 0x40]
lea rsi, [rsp + 0x48]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x48], 1
mov r15, rax
mov qword [rsp + 0x40], rax
nop word [rax + rax]
mov qword [rsp + 0x20], r13
mov ecx, ebx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call r12
test eax, eax
jns 0x1400f55c0
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5590
jmp 0x1400f5675
mov ebp, eax
jne 0x1400f569d
mov qword [rsp + 0x30], rdi
call fcn.140145674
mov rdi, rax
call fcn.140145658
cmp rdi, 0x989680
jne 0x1400f55f0
imul rax, rax, 0x64
jmp 0x1400f562f
mov rcx, rax
or rcx, rdi
shr rcx, 0x20
je 0x1400f5603
cqo
idiv rdi
jmp 0x1400f5607
xor edx, edx
div edi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rdi
or rdx, rax
shr rdx, 0x20
je 0x1400f5628
cqo
idiv rdi
jmp 0x1400f562c
xor edx, edx
div edi
add rax, rcx
mov rdi, qword [rsp + 0x30]
sub rax, rdi
movabs rcx, 0x431bde82d7b634db
imul rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x12
add rdx, rax
cmp rdx, r14
jg 0x1400f569d
mov qword [rsp + 0x48], 1
mov rcx, rsi
call fcn.1400f5840
mov rbp, qword [rsp + 0x38]
mov rax, r15
jmp 0x1400f5575
xor esi, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140141380
mov eax, esi
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test ebp, ebp
setne sil
jmp 0x1400f5677

Function at 0x1400f5ad0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x238], rax
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
movdqu xmm0, xmmword [rcx + 0x10]
pshufd xmm0, xmm0, 0xe8
movq qword [rsp + 0x28], xmm0
inc esi
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov rdi, qword [sym.imp.WS2_32.dll_select]
nop word cs:[rax + rax]
mov qword [rsp + 0x20], r14
mov ecx, esi
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call rdi
mov ebx, eax
test eax, eax
jns 0x1400f5b52
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5b30
test ebx, ebx
setg bl
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140141380
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400f5b80
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x240
mov r14, rcx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x238], rax
mov rdi, qword [rcx + 8]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
movdqu xmm0, xmmword [rcx + 0x20]
pshufd xmm0, xmm0, 0xe8
movq qword [rsp + 0x28], xmm0
inc edi
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
mov rsi, qword [sym.imp.WS2_32.dll_select]
nop word [rax + rax]
mov qword [rsp + 0x20], r15
mov ecx, edi
xor edx, edx
mov r8, rbx
xor r9d, r9d
call rsi
test eax, eax
jns 0x1400f5c01
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5be0
jmp 0x1400f5c5a
je 0x1400f5c5a
mov r14, qword [r14 + 8]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
lea edi, [r14 + 1]
lea rbx, [rsp + 0x30]
nop word cs:[rax + rax]
mov qword [rsp + 0x20], r15
mov ecx, edi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call rsi
test eax, eax
jns 0x1400f5c7d
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5c30
call fcn.14022ff0c
cmp dword [rax], 9
jne 0x1400f5c7f
xor esi, esi
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140141380
mov eax, esi
add rsp, 0x240
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
je 0x1400f5cbc
lea rdi, [rsp + 0x30]
mov rsi, qword [sym.imp.WS2_32.dll_recv]
nop dword [rax + rax]
mov rcx, r14
mov rdx, rdi
mov r8d, 1
mov r9d, 2
call rsi
mov ebx, eax
test eax, eax
jns 0x1400f5cb4
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5c90
test ebx, ebx
setg sil
jmp 0x1400f5c5c
mov sil, 1
jmp 0x1400f5c5c
Function at 0x1400f5cd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rdx
cmp r8, 0x7fffffff
mov esi, 0x7fffffff
cmovb rsi, r8
mov rbx, rcx
mov rdx, qword [rcx + 0x48]
mov rdi, qword [rcx + 0x50]
sub rdi, rdx
jbe 0x1400f5d20
add rdx, qword [rbx + 0x30]
cmp rsi, rdi
cmovb rdi, rsi
mov rcx, r14
mov r8, rdi
call fcn.14021e3b0
add qword [rbx + 0x48], rdi
jmp 0x1400f5dc1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, 0xffffffffffffffff
test al, al
je 0x1400f5dc1
lea rax, [rbx + 0x48]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
cmp rsi, 0xfff
ja 0x1400f5d87
mov r15, qword [rbx + 8]
mov rdi, qword [rbx + 0x30]
mov r12, qword [sym.imp.WS2_32.dll_recv]
nop word [rax + rax]
mov rcx, r15
mov rdx, rdi
mov r8d, 0x1000
xor r9d, r9d
call r12
mov ebp, eax
test eax, eax
jns 0x1400f5dd3
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5d60
movsxd rdi, ebp
jmp 0x1400f5dc1
mov rdi, qword [rbx + 8]
mov rbp, qword [sym.imp.WS2_32.dll_recv]
nop word cs:[rax + rax]
mov rcx, rdi
mov rdx, r14
mov r8d, esi
xor r9d, r9d
call rbp
mov ebx, eax
test eax, eax
jns 0x1400f5dbe
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5da0
movsxd rdi, ebx
mov rax, rdi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, ebp
je 0x1400f5dc1
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rsi, rdi
jae 0x1400f5df8
mov r8, rsi
call fcn.14021e3b0
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rdi
mov rdi, rsi
jmp 0x1400f5dc1
mov r8, rdi
call fcn.14021e3b0
jmp 0x1400f5dc1

Function at 0x1400f5e10
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, eax
mov rax, 0xffffffffffffffff
test cl, cl
je 0x1400f5e72
mov rbx, qword [rbx + 8]
mov r14, qword [sym.imp.WS2_32.dll_send]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call r14
mov ebp, eax
test eax, eax
jns 0x1400f5e6f
call fcn.14022ff0c
cmp dword [rax], 4
je 0x1400f5e50
movsxd rax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400f5e80
Capabilities:
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1400f5eb0
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1400f5fb9
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x1400f5f09
cmp eax, 2
jne 0x1400f5fb9
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc0]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call fcn.14021ea60
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400f5fb9
lea rcx, [rsp + 0xc0]
call fcn.14023e390
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x1400f5f92
lea r9, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
call fcn.140007bd0
jmp 0x1400f5fb9
mov rbx, rsi
cmp rax, 0x10
jb 0x1400f5f9e
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc0]
mov rcx, rbx
mov r8, rdi
call fcn.14021e3b0
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.140141380
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400f5e90
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1400f5fe0
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400f60e9
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x1400f6039
cmp eax, 2
jne 0x1400f60e9
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc0]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call fcn.14021ea60
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400f60e9
lea rcx, [rsp + 0xc0]
call fcn.14023e390
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x1400f60c2
lea r9, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
call fcn.140007bd0
jmp 0x1400f60e9
mov rbx, rsi
cmp rax, 0x10
jb 0x1400f60ce
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc0]
mov rcx, rbx
mov r8, rdi
call fcn.14021e3b0
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.140141380
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400f5eb0
Capabilities:
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1400f5eb0
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1400f5fb9
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x1400f5f09
cmp eax, 2
jne 0x1400f5fb9
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc0]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call fcn.14021ea60
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400f5fb9
lea rcx, [rsp + 0xc0]
call fcn.14023e390
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x1400f5f92
lea r9, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
call fcn.140007bd0
jmp 0x1400f5fb9
mov rbx, rsi
cmp rax, 0x10
jb 0x1400f5f9e
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc0]
mov rcx, rbx
mov r8, rdi
call fcn.14021e3b0
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.140141380
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400f5fe0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x1400f5fe0
push rsi
push rdi
push rbx
sub rsp, 0x4d0
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x4c8], rax
mov dword [rsp + 0x3c], 0x80
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3c]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400f60e9
mov ebx, dword [rsp + 0x3c]
movzx eax, word [rsp + 0x40]
cmp eax, 0x17
je 0x1400f6039
cmp eax, 2
jne 0x1400f60e9
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
lea rdi, [rsp + 0xc0]
mov r8d, 0x401
mov rcx, rdi
xor edx, edx
call fcn.14021ea60
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
mov edx, ebx
mov r8, rdi
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400f60e9
lea rcx, [rsp + 0xc0]
call fcn.14023e390
mov rdi, rax
mov rax, qword [rsi + 0x18]
cmp rax, rdi
jae 0x1400f60c2
lea r9, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rdi
call fcn.140007bd0
jmp 0x1400f60e9
mov rbx, rsi
cmp rax, 0x10
jb 0x1400f60ce
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
lea rdx, [rsp + 0xc0]
mov rcx, rbx
mov r8, rdi
call fcn.14021e3b0
mov byte [rbx + rdi], 0
mov rcx, qword [rsp + 0x4c8]
xor rcx, rsp
call fcn.140141380
nop
add rsp, 0x4d0
pop rbx
pop rdi
pop rsi
ret