joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402b0c00
Capabilities:
Parse credit card information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov eax, dword [rcx + 0xe0]
cmp eax, 7
je 0x1402b0d35
mov rsi, rcx
mov cl, byte [rcx + 0x166]
test cl, cl
je 0x1402b0c2f
mov edx, dword [rsi + 0x160]
test edx, edx
jne 0x1402b0c3a
jmp 0x1402b0c5a
movsx edx, byte [rsi + 0x167]
test edx, edx
je 0x1402b0c5a
cmp eax, 3
je 0x1402b0c5a
add rsi, 0x158
test cl, cl
je 0x1402b0c52
mov rcx, rsi
call fcn.14030abf0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1402b0cbf
cmp eax, 1
jne 0x1402b0c9f
cmp byte [rsi + 0x16c], 0
jne 0x1402b0c9f
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov r8b, 1
call fcn.1402afaa0
nop dword [rax + rax]
mov rcx, rsi
call fcn.1402b0500
test al, al
jne 0x1402b0cae
cmp dword [rsi + 0xe0], 7
je 0x1402b0cc8
mov rcx, rsi
call fcn.1402b0c00
jmp 0x1402b0c80
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.1402ae400
cmp byte [rsp + 0x2e], 0
je 0x1402b0cbf
lea rcx, [rsp + 0x20]
call fcn.14030abf0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x10
call fcn.140361800
mov rsi, rax
lea rdx, str.Unexpected_end_of_file_expected_when_skipping_tag_
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x20]
call fcn.1400e3860
lea r8, [0x1403d6c41]
lea rdi, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1402e9f00
cmp byte [rsp + 0x4e], 0
je 0x1402b0d10
mov rdi, qword [rsp + 0x40]
mov bl, 1
mov rcx, rsi
mov rdx, rdi
call fcn.1400ef760
xor ebx, ebx
lea rdx, [0x1403a98e8]
lea r8, [fcn.140001760]
mov rcx, rsi
call fcn.140361950
mov ecx, 0x10
call fcn.140361800
mov rsi, rax
lea rdx, str.Unexpected_end_of_file
mov rcx, rax
call fcn.1400ef760
lea rdx, [0x1403a98e8]
lea r8, [fcn.140001760]
mov rcx, rsi
call fcn.140361950
mov rcx, rax
call fcn.140001880
mov rdi, rax
mov rcx, rsi
call fcn.1403618d0
mov rcx, rdi
call fcn.140363f60
mov rdi, rax
lea rcx, [rsp + 0x40]
call fcn.140001760
lea rcx, [rsp + 0x30]
call fcn.140001760
test bl, bl
jne 0x1402b0db1
jmp 0x1402b0dbe
mov rcx, rsi
call fcn.1403618d0
jmp 0x1402b0dbe
lea rcx, [rsp + 0x20]
call fcn.140001760
mov rcx, rdi
call fcn.140363f60
int3
Function at 0x1402bb880
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x8588]
test rax, rax
je 0x1402bb952
nop
mov rcx, qword [rax + 8]
lea rdx, [rcx + rcx*4]
rol rdx, 7
mov rsi, qword [rax]
lea r8, [rdx + rdx*8]
mov rdi, rcx
shl rdi, 0x11
mov rbx, qword [rax + 0x10]
xor rbx, rsi
mov rdx, rbx
xor rdx, rcx
xor rcx, qword [rax + 0x18]
mov qword [rax + 8], rdx
xor rsi, rcx
mov qword [rax], rsi
xor rbx, rdi
mov qword [rax + 0x10], rbx
rol rcx, 0x2d
mov qword [rax + 0x18], rcx
mov qword [r14], r8
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lea rbx, [rdx + rdx*4]
rol rbx, 7
lea r8, [rbx + rbx*8]
mov rdi, rdx
mov rsi, qword [rax + 0x10]
xor rsi, rcx
mov rbx, rsi
xor rbx, rdx
xor rdx, qword [rax + 0x18]
shl rdi, 0x11
mov qword [rax + 8], rbx
xor rcx, rdx
mov qword [rax], rcx
xor rsi, rdi
mov qword [rax + 0x10], rsi
rol rdx, 0x2d
mov qword [rax + 0x18], rdx
mov qword [r14 + 8], r8
or r8, qword [r14]
je 0x1402bb8b0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
xor eax, eax
jmp 0x1402bb9f8
mov rcx, qword [rax + 8]
lea rdx, [rcx + rcx*4]
rol rdx, 7
mov rbx, qword [rax]
lea r8, [rdx + rdx*8]
mov rdi, rcx
shl rdi, 0x11
mov rsi, qword [rax + 0x10]
xor rsi, rbx
mov rdx, rsi
xor rdx, rcx
xor rcx, qword [rax + 0x18]
mov qword [rax + 8], rdx
xor rbx, rcx
mov qword [rax], rbx
xor rsi, rdi
mov qword [rax + 0x10], rsi
rol rcx, 0x2d
mov qword [rax + 0x18], rcx
mov qword [r14], r8
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lea rbx, [rdx + rdx*4]
rol rbx, 7
lea r8, [rbx + rbx*8]
mov rdi, rdx
mov rsi, qword [rax + 0x10]
xor rsi, rcx
mov rbx, rsi
xor rbx, rdx
xor rdx, qword [rax + 0x18]
shl rdi, 0x11
mov qword [rax + 8], rbx
xor rcx, rdx
mov qword [rax], rcx
xor rsi, rdi
mov qword [rax + 0x10], rsi
rol rdx, 0x2d
mov qword [rax + 0x18], rdx
mov qword [r14 + 8], r8
or r8, qword [r14]
jne 0x1402bb948
test rax, rax
jne 0x1402bb960
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rsi, qword [rcx + rax*8]
lea rcx, [rsi + 0x8590]
mov qword [rsi + 0x8588], rcx
call fcn.14027f540
mov rax, qword [rsi + 0x8588]
jmp 0x1402bb960
Function at 0x1402bed60
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0x68
lea rcx, [0x1405fd7d0]
call fcn.1400f4fe0
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov dword [rsp + 0x28], 0x40
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
test eax, eax
je 0x1402bedc2
movsd xmm1, qword [rsp + 0x38]
unpcklps xmm1, xmmword [0x1403d44f0]
subpd xmm1, xmmword [0x1403d4500]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov ecx, dword [0x1405fd878]
test ecx, ecx
jne 0x1402bede3
jmp 0x1402bedd4
movsd xmm0, qword [0x1403d4510]
mov ecx, dword [0x1405fd878]
test ecx, ecx
jne 0x1402bede3
mov dword [0x1405fd878], 0x7fffffff
mov ecx, 0x7fffffff
mulsd xmm0, qword [0x14048a830]
cvttsd2si rax, xmm0
cmp rax, 0x7d000000
mov edx, 0x7d000000
cmovl edx, eax
mov eax, dword [0x14048a82c]
cmp eax, edx
cmovge edx, eax
cmp edx, ecx
cmovge edx, ecx
mov dword [0x14048a828], edx
call fcn.1402bee50
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1402c5510
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
mov r15, rcx
cmp rdx, r8
je 0x1402c565d
mov rdi, rdx
mov rax, r8
sub rax, rdx
lea ecx, [rax + 2]
movsxd rcx, ecx
imul rdx, rcx, 0x55555556
mov rcx, rdx
shr rcx, 0x3f
shr rdx, 0x20
add edx, ecx
shl edx, 2
movsxd r12, eax
imul rax, r12, 0x55555556
mov rcx, rax
shr rcx, 0x3f
shr rax, 0x20
add eax, ecx
lea eax, [rax + rax*2]
sub r12d, eax
mov eax, r12d
neg eax
movsxd rsi, eax
add rsi, r8
lea r14, [rsp + 0x38]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea rax, [rsp + 0x137]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
call fcn.14030f680
mov rax, qword [rsp + 0x28]
mov byte [rax], 0
mov rcx, qword [rsp + 0x20]
cmp rsi, rdi
jbe 0x1402c561d
lea rax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
movzx edx, byte [rdi]
shr rdx, 2
movzx edx, byte [rdx + rax]
mov byte [rcx], dl
movzx edx, byte [rdi]
shl edx, 4
and edx, 0x30
movzx ebx, byte [rdi + 1]
shr rbx, 4
or rbx, rdx
movzx edx, byte [rax + rbx]
mov byte [rcx + 1], dl
movzx edx, byte [rdi + 1]
and edx, 0xf
movzx ebx, byte [rdi + 2]
shr rbx, 6
lea rdx, [rbx + rdx*4]
movzx edx, byte [rax + rdx]
mov byte [rcx + 2], dl
movzx edx, byte [rdi + 2]
and edx, 0x3f
movzx edx, byte [rdx + rax]
mov byte [rcx + 3], dl
add rdi, 3
add rcx, 4
cmp rdi, rsi
jb 0x1402c55c0
cmp r12d, 2
je 0x1402c5666
cmp r12d, 1
jne 0x1402c56ae
movzx eax, byte [rdi]
shr rax, 2
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rax + rdx]
mov byte [rcx], al
movzx eax, byte [rdi]
shl eax, 4
and eax, 0x30
mov al, byte [rax + rdx]
mov byte [rcx + 1], al
mov eax, 2
mov dl, 0x3d
mov ebx, 3
jmp 0x1402c56a7
xorps xmm0, xmm0
movups xmmword [r15], xmm0
jmp 0x1402c56cc
movzx eax, byte [rdi]
shr rax, 2
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rax + rdx]
mov byte [rcx], al
movzx eax, byte [rdi]
shl eax, 4
and eax, 0x30
movzx ebx, byte [rdi + 1]
shr rbx, 4
or rbx, rax
mov al, byte [rdx + rbx]
mov byte [rcx + 1], al
movzx eax, byte [rdi + 1]
and eax, 0xf
mov dl, byte [rdx + rax*4]
mov eax, 3
mov ebx, 2
mov byte [rcx + rbx], dl
mov byte [rcx + rax], 0x3d
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.14030f1c0
cmp qword [rsp + 0x20], r14
je 0x1402c56cc
lea rcx, [rsp + 0x20]
call fcn.14030b790
mov rax, r15
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1402cbf50
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov ebx, r9d
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
lea rcx, [0x1405ff500]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x1402cbfb1
mov edx, dword [rax + 0x14]
cmp edx, 3
jne 0x1402cbf9c
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1402cc0d5
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rax, qword [rsi + 0x28]
mov edx, dword [rax + 0x14]
xor ecx, ecx
cmp edx, 1
sete cl
add ecx, ecx
mov dword [rax + 0x14], ecx
mov qword [rsi + 0x28], 0
lea rcx, [0x1405ff500]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea rax, [rsi + 0x30]
mov qword [rsi + 0x28], rax
cmp byte [rdi + 0xe], 0
je 0x1402cbfcf
mov rdi, qword [rdi]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
xor eax, eax
cmp ebp, 0x80000000
je 0x1402cbff1
test ebp, ebp
js 0x1402cc00e
lea rdx, [rsp + 0x20]
mov ecx, ebp
call fcn.140296620
mov byte [rsp + 0x2f], al
mov al, byte [rsp + 0x2e]
test al, al
je 0x1402cc030
mov rdx, qword [rsp + 0x20]
xor ecx, ecx
test rdi, rdi
jne 0x1402cc03c
jmp 0x1402cc09d
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x20], 0x2d
neg ebp
mov ecx, ebp
call fcn.140296620
add eax, 1
mov byte [rsp + 0x2f], al
mov al, byte [rsp + 0x2e]
test al, al
jne 0x1402cbffd
lea rdx, [rsp + 0x20]
xor ecx, ecx
test rdi, rdi
je 0x1402cc09d
cmp byte [rdi], 0
je 0x1402cc09d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea eax, [rbx - 1]
cmp eax, 2
cmovb ecx, ebx
lea rax, [0x1403d83c0]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x44], eax
movabs rax, 0x600000001
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1402cc097
mov rcx, qword [rsp + 0x38]
jmp 0x1402cc099
xor ecx, ecx
mov al, byte [rsp + 0x2e]
mov rbp, qword [rsi + 0x28]
mov qword [rbp + 0x18], rcx
test al, al
je 0x1402cc0bb
lea rcx, [rsp + 0x20]
call fcn.14030abf0
mov rbp, qword [rsi + 0x28]
mov rcx, qword [rbp + 0x18]
xor edx, edx
test rcx, rcx
sete dl
setne al
add edx, 3
mov dword [rbp + 0x14], edx
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
ret
xor ecx, ecx
jmp 0x1402cbfa6
Function at 0x1402ccd10
Capabilities:
Initialize winsock library

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1b8
mov al, byte [0x1405ff7f8]
test al, 1
jne 0x1402ccded
lea r14, [0x1405ff830]
lea rdi, [0x1405ff800]
mov r15, qword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
lea r12, [0x1402cce40]
mov r13, qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea rsi, [rsp + 0x20]
mov rbx, qword [sym.imp.WS2_32.dll_WSAStartup]
mov rbp, qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1402ccd7a
mov al, byte [0x1405ff7f8]
test al, 1
jne 0x1402ccded
mov al, byte [0x1405ff830]
test al, al
jne 0x1402ccdb5
mov rcx, r14
call fcn.14035f9c4
test eax, eax
je 0x1402ccdb5
mov rcx, rdi
call r15
mov rcx, r12
call fcn.140001440
mov rcx, r14
call fcn.14035fa9b
jmp 0x1402ccdb5
mov rcx, rdi
call rbp
mov al, byte [0x1405ff7f8]
test al, 1
jne 0x1402ccd70
mov rcx, rdi
call r13
mov al, byte [0x1405ff7f8]
test al, 1
jne 0x1402ccdb0
nop
mov cx, 0x202
mov rdx, rsi
call rbx
mov byte [0x1405ff7f8], 1
movzx eax, byte [0x1405ff7f8]
test al, 1
je 0x1402ccdd0
jmp 0x1402ccdb0
add rsp, 0x1b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1402cd1b0
Capabilities:
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r14d, r9d
mov ebx, r8d
mov ebp, edx
mov rsi, rcx
call fcn.1402ccd10
mov rcx, rsi
call fcn.1402cd2b0
mov byte [rsi + 0x221], 0
mov dword [rsi + 0x244], 0
lea rdi, [rsi + 0x248]
cmp byte [rsi + 0x256], 0
je 0x1402cd1fb
mov rcx, rdi
call fcn.14030abf0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov ecx, ebp
mov edx, ebx
mov r8d, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1402cd272
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [rsi + 0x23c], eax
mov dword [rsp + 0x2c], 1
mov rcx, qword [rsi]
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete dil
je 0x1402cd29e
mov rbp, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbp
mov ecx, eax
call fcn.1402cc530
mov rbx, rax
call rbp
lea rdx, str.ioctlsocket_FIO_N_BIO_
mov rcx, rsi
mov r8d, eax
mov r9, rbx
call fcn.1402cdec0
jmp 0x1402cd29e
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
mov ecx, eax
call fcn.1402cc530
mov rdi, rax
call rbx
lea rdx, str.open
mov rcx, rsi
mov r8d, eax
mov r9, rdi
call fcn.1402cdec0
xor edi, edi
mov eax, edi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1402ce520
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx]
xor ebx, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
js 0x1402ce543
jne 0x1402ce59e
jmp 0x1402ce574
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1402ce5a0
cmp eax, 0x2749
jne 0x1402ce574
mov ebp, dword [rsi + 0x23c]
cmp ebp, 0x80000000
je 0x1402ce574
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebp
cmp eax, 0x4e20
jl 0x1402ce5a0
mov rbp, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbp
mov ecx, eax
call fcn.1402cc530
mov rbx, rax
call rbp
lea rdx, [0x1403d894a]
mov rcx, rsi
mov r8d, eax
mov r9, rbx
call fcn.1402cdec0
mov ebx, edi
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1402ce610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x258]
test rcx, rcx
je 0x1402ce6ab
mov eax, dword [rsi + 8]
add eax, 0xffffffff
cmp eax, 1
ja 0x1402ce6ab
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
je 0x1402ce6ab
mov edi, eax
mov ebx, dword [rsi + 0x240]
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebx
cmp eax, 0x4e21
jl 0x1402ce66f
lea rdx, str.ssl_handshake
lea r9, str.Timeout
mov rcx, rsi
mov r8d, 0xfff0bdc1
jmp 0x1402ce6a6
cmp dword [rsi + 0x234], 0x80000000
je 0x1402ce6b5
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [rsi + 0x238]
cmp eax, dword [rsi + 0x234]
jle 0x1402ce6b5
lea rdx, str.wait
lea r9, str.Timeout
mov rcx, rsi
mov r8d, 0xfff0bdc0
call fcn.1402cdec0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov edx, edi
call fcn.1402ceb20
mov rcx, qword [rsi + 0x258]
mov rax, qword [rcx]
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [rax + 0x28]
Function at 0x1402ce880
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x658
mov ebx, r8d
mov ebp, edx
mov rsi, rcx
mov byte [rcx + 0x222], 0
test bpl, 1
je 0x1402ce8bf
mov rax, qword [rsi + 0x210]
mov dil, 1
cmp rax, qword [rsi + 0x218]
jne 0x1402ceaa1
cmp qword [rsi], 0xffffffffffffffff
je 0x1402cea9f
mov al, byte [rsi + 0x221]
xor edi, edi
or al, byte [rsi + 0x223]
jne 0x1402ceaa1
mov r13, qword [sym.imp.KERNEL32.DLL_GetTickCount]
lea r12, [rsp + 0x450]
mov r14, qword [sym.imp.WS2_32.dll_select]
nop word cs:[rax + rax]
nop dword [rax]
call r13
cmp qword [rsi + 0x2a0], 0
je 0x1402ce920
mov r15d, dword [rsi + 0x22c]
jmp 0x1402ce950
mov r15d, ebx
sub r15d, eax
cmp ebx, 0x7fffffff
jne 0x1402ce950
xor eax, eax
mov dword [rsp + 0x240], 0
test bpl, 1
je 0x1402ce9a7
jmp 0x1402ce991
test r15d, r15d
cmovs r15d, edi
imul rax, r15, 0x10624dd3
shr rax, 0x26
mov dword [rsp + 0x28], eax
imul eax, eax, 0x3e8
mov ecx, r15d
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x28]
mov dword [rsp + 0x240], 0
test bpl, 1
je 0x1402ce9a7
mov rcx, qword [rsi]
mov qword [rsp + 0x248], rcx
mov dword [rsp + 0x240], 1
mov dword [rsp + 0x30], 0
mov rcx, qword [rsi]
test bpl, 2
je 0x1402ce9c5
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x458], rcx
mov dword [rsp + 0x450], 1
add ecx, 1
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x240]
lea r8, [rsp + 0x30]
mov r9, r12
call r14
test eax, eax
js 0x1402cea00
je 0x1402cea11
jmp 0x1402cea6d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x1402ceab7
cmp dword [rsi + 0x234], 0x80000000
je 0x1402cea2e
call r13
sub eax, dword [rsi + 0x238]
cmp eax, dword [rsi + 0x234]
jg 0x1402cea7c
mov eax, dword [rsi + 0x228]
test r15d, r15d
jg 0x1402cea3d
test eax, eax
jne 0x1402cea98
mov rcx, qword [rsi + 0x2a0]
test rcx, rcx
je 0x1402cea54
mov rax, qword [rcx]
call qword [rax]
mov eax, dword [rsi + 0x228]
test eax, eax
je 0x1402cea98
movzx eax, byte [rsi + 0x221]
or al, byte [rsi + 0x223]
je 0x1402ce900
jmp 0x1402cea9f
mov dword [rsi + 0x23c], 0x80000000
mov dil, 1
jmp 0x1402ceaa1
lea rdx, str.wait
lea r9, str.Timeout
mov rcx, rsi
mov r8d, 0xfff0bdc0
call fcn.1402cdec0
mov byte [rsi + 0x222], 1
xor edi, edi
mov eax, edi
add rsp, 0x658
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
mov ecx, eax
call fcn.1402cc530
mov rdi, rax
call rbx
lea rdx, str.wait
mov rcx, rsi
mov r8d, eax
mov r9, rdi
call fcn.1402cdec0
jmp 0x1402cea9f
Function at 0x1402ceb20
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov eax, dword [rcx + 0x234]
mov ebp, dword [rcx + 0x238]
add ebp, eax
cmp eax, 0x80000000
mov ebx, 0x7fffffff
cmove ebp, ebx
cmp dword [rcx + 0x228], 0x80000000
je 0x1402ceb62
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, eax
add ebx, dword [rdi + 0x228]
cmp ebp, ebx
cmovl ebx, ebp
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2749
jne 0x1402ceb9c
mov ebp, dword [rdi + 0x23c]
cmp ebp, 0x80000000
je 0x1402ceb9c
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebp
cmp eax, 0x4e1f
jg 0x1402ceb9c
mov ebx, 0x4e20
add ebx, dword [rdi + 0x23c]
mov rcx, qword [rdi + 0x258]
test rcx, rcx
je 0x1402cebbf
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov edx, esi
mov r8d, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp rax
mov rcx, rdi
mov edx, esi
mov r8d, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.1402ce880

Function at 0x1402cebe0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1402cec07
test ebx, ebx
jns 0x1402cec07
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rbx, rax
xor ebp, ebp
test rdi, rdi
je 0x1402ced8f
test ebx, ebx
jle 0x1402ced8f
mov al, byte [rsi + 0x221]
or al, byte [rsi + 0x223]
jne 0x1402ced8f
mov dword [rsi + 0x230], 0
mov eax, dword [rsi + 0x234]
mov ebp, dword [rsi + 0x238]
add ebp, eax
cmp eax, 0x80000000
mov r14d, 0x7fffffff
cmove ebp, r14d
cmp dword [rsi + 0x228], 0x80000000
je 0x1402cec6f
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov r14d, eax
add r14d, dword [rsi + 0x228]
cmp ebp, r14d
cmovl r14d, ebp
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2749
jne 0x1402cecad
mov ebp, dword [rsi + 0x23c]
cmp ebp, 0x80000000
je 0x1402cecad
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, ebp
cmp eax, 0x4e1f
jg 0x1402cecad
mov r14d, 0x4e20
add r14d, dword [rsi + 0x23c]
mov ebp, dword [rsi + 0x230]
cmp ebp, ebx
jl 0x1402cecde
jmp 0x1402ced8f
mov rcx, rsi
mov edx, 2
mov r8d, r14d
call fcn.1402ce880
test al, al
je 0x1402ced89
mov ebp, dword [rsi + 0x230]
mov rcx, rsi
call fcn.1402ce610
test eax, eax
je 0x1402ced30
cmp byte [rsi + 0x221], 0
jne 0x1402ced89
mov ebp, dword [rsi + 0x230]
cmp ebp, ebx
jge 0x1402ced8f
mov rcx, qword [rsi + 0x258]
test rcx, rcx
je 0x1402cecc0
mov rax, qword [rcx]
mov edx, 2
mov r8d, r14d
call qword [rax + 8]
test al, al
jne 0x1402cecd8
jmp 0x1402ced89
movsxd rax, ebp
lea rdx, [rdi + rax]
mov r8d, ebx
sub r8d, eax
mov rcx, qword [rsi + 0x258]
test rcx, rcx
je 0x1402ced5c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ebp, eax
cmp byte [rsi + 0x221], 0
je 0x1402ced6f
jmp 0x1402ced89
mov rcx, rsi
call fcn.1402ce520
mov ebp, eax
cmp byte [rsi + 0x221], 0
jne 0x1402ced89
test ebp, ebp
jle 0x1402cecf7
add ebp, dword [rsi + 0x230]
mov dword [rsi + 0x230], ebp
cmp ebp, ebx
jl 0x1402cecd8
jmp 0x1402ced8f
mov ebp, dword [rsi + 0x230]
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1402e3540
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbp, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test rax, rax
je 0x1402e359e
mov rsi, rax
mov qword [rsp + 0x28], rax
cmp byte [rax], 0x4d
jne 0x1402e3595
cmp byte [rsi + 1], 0x5a
jne 0x1402e3595
movsxd rdi, dword [rsi + 0x3c]
add rdi, rsi
mov edx, 0x108
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x1402e3595
cmp dword [rdi], 0x4550
je 0x1402e35b4
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor esi, esi
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x30], rdi
lea rax, [rdi + 0x108]
mov qword [rsp + 0x38], rax
mov eax, dword [rdi + 0x88]
mov rcx, rsi
add rcx, rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rbx]
test rax, rax
je 0x1402e35a0
add rbx, 8
xor r15d, r15d
lea r14, [rsp + 0x28]
jmp 0x1402e360b
lea eax, [rcx + 1]
mov dword [rbp + 8], eax
mov qword [r13 + rcx*8], r12
mov rax, qword [rbx]
add rbx, 8
test rax, rax
je 0x1402e36c8
movzx r13d, byte [rax]
xor edx, edx
cmp r13b, 0x3f
sete dl
add rdx, rax
mov rcx, r14
mov r8b, 1
call fcn.1402e32f0
test rax, rax
je 0x1402e3641
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x1402e3650
jmp 0x1402e3644
xor r12d, r12d
xor eax, eax
cmp r13b, 0x3f
setne al
add r15d, eax
movsxd rcx, dword [rbp + 8]
mov eax, dword [rbp + 0xc]
mov r13, qword [rbp]
cmp ecx, eax
jl 0x1402e35f0
cmp eax, 0x7fffffff
jne 0x1402e3675
lea rcx, [0x1403d9988]
call fcn.140255450
mov eax, dword [rbp + 0xc]
mov edx, eax
sar edx, 1
add edx, eax
cmp eax, 0x55555554
mov ecx, 0x7fffffff
cmovge edx, ecx
add eax, 1
cmp eax, edx
cmovg edx, eax
mov rcx, rbp
call fcn.1400f7f80
mov rcx, qword [rbp]
movsxd rdx, dword [rbp + 8]
lea edi, [rdx + 1]
mov dword [rbp + 8], edi
mov qword [rcx + rdx*8], r12
test al, al
je 0x1402e35fb
test r13, r13
je 0x1402e35fb
mov rcx, r13
call fcn.140309590
jmp 0x1402e35fb
test r15d, r15d
jne 0x1402e3595
jmp 0x1402e35a0