joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000daa8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edx, ecx
mov esi, 0x104
mov ecx, esi
call fcn.1400126d0
mov ecx, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebp, ebp
movsxd rbx, eax
test eax, eax
je 0x14000daf1
lea ecx, [rbp + 0x5c]
cmp word [rdi + rbx*2 - 2], cx
je 0x14000daf1
mov word [rdi + rbx*2], cx
inc ebx
sub esi, ebx
mov ecx, esi
call fcn.140012900
mov rsi, qword [rsp + 0x40]
movsxd rax, ebx
mov rbx, qword [rsp + 0x30]
mov word [rdi + rax*2], bp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000dc88
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x14000dc9b
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cdqe
jmp 0x14000dc9d
xor eax, eax
add rsp, 0x28
ret

Function at 0x14000dca4
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x10]
mov rdi, rdx
mov edx, ecx
xor esi, esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r11 - 0x18], rax
mov ebx, esi
call qword [sym.imp.SHELL32.DLL_SHGetFolderLocation]
test eax, eax
jne 0x14000dd15
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.SHELL32.DLL_SHGetPathFromIDListW]
test eax, eax
je 0x14000dd0a
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov rbx, rax
test eax, eax
je 0x14000dd0a
lea ecx, [rsi + 0x5c]
cdqe
cmp word [rdi + rax*2 - 2], cx
je 0x14000dd0a
mov word [rdi + rax*2], cx
inc ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLE32.DLL_CoTaskMemFree]
movsxd rax, ebx
mov word [rdi + rax*2], si
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ddc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x14000de04
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx + 8]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140034878
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140039940]
test rax, rax
je 0x1400348c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400348c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400348c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400348c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400348c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400348c4
xor al, al
add rsp, 0x28
ret

Function at 0x1404bade5
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.140514104
push rsi
push r9
movabs rsi, 0x1e3c5e6b1e872de9
movabs r9, 0x2c864f304a743c14
pushfq
xor si, 0x5a9
not rsi
mov rsi, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x42be17fe
call fcn.1404bb998
invalid

Function at 0x140a85fee
Capabilities:
Encode data using xor

Disassembly:
or r13d, r13d
jno 0x140c41dbb
push r15
mov qword [rsp + 0x10], 0xffffffff9b0128e3
movabs r15, 0x31d12f3377cf34a7
push rdi
call fcn.140be8fdb
sets r13b
mov r13, qword [rsp + 0x18]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x28]
call fcn.140d1bd79
add byte [rax], al
add byte [rdi], bh
jbe 0x140c41e3f
outsb dx, byte [rsi]
je 0x140c41e1d
push rcx
imul r13, qword [rsi + 0x65], 0x74696445
push rbp
pop r15
push rax
push r14
push rcx
jbe 0x140c41e5b
outsb dx, byte [rsi]
je 0x140c41e39
pop rdx
add byte [rdx - 0x35], bl
push 0x56
jrcxz 0x140c41e25
invalid
pop rdx
xor dh, byte [rbx]
push 0xffffffffc02c3140
and dword [rbp + 0x32], 0x2b
invalid
rol byte [rbx + 0x72b3265], 0x5e
pop rbp
xor ah, byte [rsi + riz*8]
invalid
or ah, byte [rsi + 0x2b403158]
pop rax
xor dword [rax + 0x2b], eax
mov ch, 0x5a
xor ecx, ebx
loopne 0x140c41e3b
invalid
fsub qword [rbx - 6]
movabs byte [0xffff4f09fbf1e5cc], al
jmp qword [rdx]

Function at 0x140a86012
Capabilities:
Encode data using xor

Disassembly:
call fcn.140c2929a
add byte [rcx + 0x70], ah
imul ebp, dword [0x1b7d5d391], 0x632d6e69
jb 0x140a8609a
sub eax, 0x746e7572
imul ebp, dword [rbp + 0x65], 0x2d316c2d
invalid
mov bh, byte [rdi]
jb 0x140a86056
invalid

Function at 0x140a9b325
Capabilities:
Encode data using xor

Disassembly:
jl 0x140adb24c
add qword [rsp + 0x28], 0xffffffffbf400671
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x68]
call fcn.140c9232e
adc al, 0x25
popfq
push rsi
mov ah, 0x76
adc ah, byte [rdi]
xor ch, byte [rdi]
mov cl, 0x44
cld
int 0x83
add ch, byte [rsi]
xor dword ss:[rax + 0x33], ebx
xor dword ss:[rax + 0x33], ebx
cmp eax, 0x78413134
jle 0x140a9b353
invalid
mov edi, 0x36ef0841
call fcn.140bff98a
pop rsp
invalid
Function at 0x140001a18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a64
xor al, al
add rsp, 0x28
ret

Function at 0x140005c14
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005a04
Function at 0x140008c80
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008cb0
xor eax, eax
jmp 0x140008d73
mov rbp, rbx
cmp word [rax], si
je 0x140008cd5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008cbc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008cb8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008bd0
movsxd r14, eax
test eax, eax
jne 0x140008d13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008ca9
mov rcx, r14
call fcn.140009b34
mov rdi, rax
test rax, rax
jne 0x140008d2c
xor ecx, ecx
call fcn.140007260
jmp 0x140008d08
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008bd0
test eax, eax
jne 0x140008d5d
mov rcx, rdi
call fcn.140007260
jmp 0x140008d67
xor ecx, ecx
call fcn.140007260
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c23c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140007cd4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c2c6
cmp byte [rbp - 0x21], r15b
je 0x14000c2c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c2fc
call fcn.14000a354
test eax, eax
jne 0x14000c2e8
cmp byte [rbp - 0x21], r15b
je 0x14000c2e0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c2fc
cmp byte [rbp - 0x21], r15b
je 0x14000c2f9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400072b0
test eax, eax
jne 0x14000c39c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140007cd4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c33b
cmp byte [rbp - 0x21], r15b
je 0x14000c370
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c370
call fcn.14000a354
test eax, eax
jne 0x14000c35c
cmp byte [rbp - 0x21], r15b
je 0x14000c355
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c370
cmp byte [rbp - 0x21], r15b
je 0x14000c36d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400072b0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c39c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c39f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c3ad
mov rcx, rdi
call fcn.140007260
cmp byte [rbp + 0x3f], r15b
je 0x14000c3bc
mov rcx, qword [rbp + 0x27]
call fcn.140007260
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000f210
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000f238
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000f238
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14002c758
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.14002d354
add rsp, 0x28
jmp 0x14002c758
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x1400c5c18], rbx
je 0x14002c7a2
cmp rax, rbx
jne 0x14002c7b7
mov edi, 1
mov eax, dword [0x1400c5c20]
cmp eax, 1
jne 0x14002c7c4
lea ecx, [rax + 0x1e]
call fcn.140161000
jmp 0x14002c831
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14002c78b
mov eax, dword [0x1400c5c20]
test eax, eax
jne 0x14002c827
mov dword [0x1400c5c20], 1
lea r14, [0x140092a00]
lea rbx, [0x1400929e8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x24], eax
cmp rbx, r14
jae 0x14002c819
test eax, eax
jne 0x14002c81d
cmp qword [rbx], 0
je 0x14002c80e
mov rax, qword [rbx]
mov rcx, qword [case.0x140002c98.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x14002c7ef
test eax, eax
je 0x14002c831
mov eax, 0xff
jmp 0x14002c986
mov dword [0x1400c5320], 1
mov eax, dword [0x1400c5c20]
cmp eax, 1
jne 0x14002c859
lea rdx, [0x1400929e0]
lea rcx, [0x140092800]
call sub.msvcrt.dll__initterm
mov dword [0x1400c5c20], 2
test edi, edi
jne 0x14002c866
xor eax, eax
xchg qword [0x1400c5c18], rax
cmp qword [0x1400c5c38], 0
je 0x14002c89a
lea rcx, [0x1400c5c38]
call fcn.14002d2c0
test eax, eax
je 0x14002c89a
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400c5c38]
mov r9, qword [case.0x140002c98.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
mov cl, byte [rbx]
cmp cl, 0x20
ja 0x14002c925
test cl, cl
je 0x14002c8bc
test edi, edi
jne 0x14002c925
dec cl
cmp cl, 0x1f
ja 0x14002c8cf
inc rbx
mov qword [rsp + 0x28], rbx
mov cl, byte [rbx]
jmp 0x14002c8bc
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140005480
mov dword [0x1400c531c], eax
cmp dword [0x1400c5340], 0
jne 0x14002c90e
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400c5320], 0
jne 0x14002c923
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400c531c]
jmp 0x14002c986
cmp cl, 0x22
jne 0x14002c937
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x14002c94c
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x14002c8ad
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret
Function at 0x140002f48
Capabilities:
Get socket status

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x588]
sub rsp, 0x680
mov rax, qword [0x14005f088]
xor rax, rsp
mov qword [rbp + 0x570], rax
mov r9d, 4
mov qword [rsp + 0x48], rcx
mov rsi, rcx
mov dword [rsp + 0x40], 1
mov r10, rdx
lea rcx, [rbp + 0x150]
lea rax, [rsp + 0x40]
lea r11d, [r9 + 0x7c]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r11
movups xmmword [rcx + 0x60], xmm0
add rcx, r11
movups xmmword [rcx - 0x10], xmm1
sub r9, 1
jne 0x140002fa0
mov rax, qword [rax]
lea edx, [r9 + 4]
mov qword [rcx], rax
lea rcx, [rbp + 0x360]
lea rax, [rsp + 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r11
movups xmmword [rcx + 0x60], xmm0
add rcx, r11
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140003000
mov rax, qword [rax]
xor ebx, ebx
mov qword [rcx], rax
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x3c], r8d
lea rax, [rsp + 0x38]
lea ecx, [rsi + 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x360]
lea r8, [rbp + 0x150]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rdi, eax
test eax, eax
jns 0x140003093
call fcn.14002a490
cmp dword [rax], 4
je 0x14000305c
test rdi, rdi
jne 0x14000309d
lea eax, [rdi + 0xd]
jmp 0x14000310c
jle 0x140003107
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x1400030c5
lea rdx, [rbp + 0x150]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x140003107
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x34], 4
mov r8d, 0x1007
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x1400030fe
cmp dword [rsp + 0x30], ebx
je 0x140003103
mov ebx, 2
mov eax, ebx
jmp 0x14000310c
mov eax, 2
mov rcx, qword [rbp + 0x570]
xor rcx, rsp
call fcn.14001ee40
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003134
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x260
mov rax, qword [0x14005f088]
xor rax, rsp
mov qword [rsp + 0x250], rax
and dword [rsp + 0x38], 0
mov rdi, rcx
and dword [rsp + 0x3c], 0
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x38]
xor r9d, r9d
lea ecx, [rdi + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x1400031a1
call fcn.14002a490
cmp dword [rax], 4
je 0x140003172
test rbx, rbx
jne 0x1400031aa
mov al, 1
jmp 0x1400031ec
jns 0x1400031ba
call fcn.14002a490
cmp dword [rax], 9
jne 0x1400031ba
xor al, al
jmp 0x1400031ec
lea rbp, [rsp + 0x30]
mov r9d, 2
mov rdx, rbp
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x1400031e6
call fcn.14002a490
cmp dword [rax], 4
je 0x1400031bf
test rbx, rbx
setg al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001ee40
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14000335c
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x14005f088]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x140003399
cmp word [rcx], 0x17
jne 0x140003408
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
mov dword [rsi], eax
lea rcx, [rsp + 0x40]
mov esi, 0x401
mov r8d, esi
call fcn.140021780
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x140003408
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x1400033ee
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000fa04
mov al, 1
jmp 0x14000340a
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001ee40
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140004404
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14005f088]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdx, qword [rcx + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rcx + 8]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x40], 1
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rbx + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
movsxd rdi, eax
test eax, eax
jns 0x140004473
call fcn.14002a490
cmp dword [rax], 4
je 0x140004444
test rdi, rdi
setg al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001ee40
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x14000449c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14005f088]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdx, qword [rcx + 0x28]
mov ebx, 1
mov rax, qword [rcx + 0x20]
mov rdi, rcx
mov rbp, qword [rcx + 8]
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], edx
lea rax, [rsp + 0x30]
xor r9d, r9d
lea ecx, [rbp + 1]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_select]
movsxd rsi, eax
test eax, eax
jns 0x140004518
call fcn.14002a490
cmp dword [rax], 4
je 0x1400044ea
test rsi, rsi
jle 0x14000452a
mov rcx, qword [rdi + 8]
call fcn.140003134
test al, al
jne 0x14000452c
xor bl, bl
mov al, bl
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001ee40
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004558
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
cmova rdi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rsi
jae 0x1400045c5
mov rcx, qword [rcx + 0x30]
sub rsi, rax
lea rdx, [rax + rcx]
mov rcx, rbp
cmp rdi, rsi
ja 0x1400045b1
mov r8, rdi
call fcn.140021010
add qword [rbx + 0x48], rdi
mov rax, rdi
jmp 0x14000466f
mov r8, rsi
call fcn.140021010
add qword [rbx + 0x48], rsi
mov rax, rsi
jmp 0x14000466f
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
test al, al
jne 0x1400045d8
or rax, 0xffffffffffffffff
jmp 0x14000466f
and qword [rbx + 0x48], 0
and qword [rbx + 0x50], 0
mov r14, qword [rbx + 8]
cmp rdi, 0x1000
jae 0x140004649
mov r15, qword [rbx + 0x30]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jns 0x140004619
call fcn.14002a490
cmp dword [rax], 4
je 0x1400045f3
test rsi, rsi
jle 0x1400045bd
mov rdx, qword [rbx + 0x30]
mov rcx, rbp
cmp rsi, rdi
jg 0x140004634
mov r8, rsi
call fcn.140021010
jmp 0x1400045bd
mov r8, rdi
call fcn.140021010
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rsi
jmp 0x1400045a9
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x14000466c
call fcn.14002a490
cmp dword [rax], 4
je 0x140004649
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140004680
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x1400046ad
or rax, 0xffffffffffffffff
jmp 0x1400046d7
mov rdi, qword [rbx + 8]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x1400046d4
call fcn.14002a490
cmp dword [rax], 4
je 0x1400046b1
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140004768
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14005f088]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400047c1
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.14000335c
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14001ee40
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret