joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800103a0
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [rcx + 0xe]
movzx r8d, word [rcx + 0x12]
mov r9, rcx
add r8d, eax
movzx eax, word [rcx + 0xa]
add r8d, eax
movzx eax, word [rcx + 8]
add r8d, eax
movzx eax, word [rcx + 6]
add r8d, eax
movzx eax, word [rcx + 4]
add r8d, eax
movzx eax, word [rcx + 2]
add r8d, eax
movzx eax, word [rcx]
add r8d, eax
movzx eax, word [rcx + 0xc]
add edx, eax
mov eax, dword [rcx + 0xc]
shr eax, 4
add edx, r8d
and eax, 0xf
cmp eax, 5
jbe case.default.0x180010411
add eax, 0xfffffffa
cmp eax, 9
ja case.default.0x180010411
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x104f4]
add rcx, r8
jmp rcx
movzx eax, word [r9 + 0x14]
movzx ecx, word [r9 + 0x16]
add edx, eax
add edx, ecx
mov eax, edx
ret
movzx ecx, word [r9 + 0x1a]
jmp 0x1800104d7
movzx ecx, word [r9 + 0x1e]
jmp 0x1800104c9
movzx ecx, word [r9 + 0x22]
jmp 0x1800104bb
movzx ecx, word [r9 + 0x26]
jmp 0x1800104ad
movzx ecx, word [r9 + 0x2a]
jmp 0x18001049f
movzx ecx, word [r9 + 0x2e]
jmp 0x180010491
movzx ecx, word [r9 + 0x32]
jmp 0x180010483
movzx ecx, word [r9 + 0x36]
jmp 0x180010475
movzx eax, word [r9 + 0x38]
movzx ecx, word [r9 + 0x3a]
add ecx, eax
movzx eax, word [r9 + 0x36]
add ecx, eax
movzx eax, word [r9 + 0x34]
add ecx, eax
movzx eax, word [r9 + 0x32]
add ecx, eax
movzx eax, word [r9 + 0x30]
add ecx, eax
movzx eax, word [r9 + 0x2e]
add ecx, eax
movzx eax, word [r9 + 0x2c]
add ecx, eax
movzx eax, word [r9 + 0x2a]
add ecx, eax
movzx eax, word [r9 + 0x28]
add ecx, eax
movzx eax, word [r9 + 0x26]
add ecx, eax
movzx eax, word [r9 + 0x24]
add ecx, eax
movzx eax, word [r9 + 0x22]
add ecx, eax
movzx eax, word [r9 + 0x20]
add ecx, eax
movzx eax, word [r9 + 0x1e]
add ecx, eax
movzx eax, word [r9 + 0x1c]
add ecx, eax
movzx eax, word [r9 + 0x1a]
add ecx, eax
movzx eax, word [r9 + 0x18]
add ecx, eax
movzx eax, word [r9 + 0x16]
add ecx, eax
movzx eax, word [r9 + 0x14]
add edx, eax
add edx, ecx
mov eax, edx
ret

Function at 0x18001eac0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [rcx], 0x82564557
lea r9, [rcx + 0x88]
movzx r8d, word [r9]
jne 0x18001eb19
cmp dword [rcx + 0x84], 0x82564557
jne 0x18001eb19
cmp word [rcx + 0x8a], 8
jne 0x18001eb19
xor eax, eax
lea rdx, [rcx + 0x114]
mov word [r9], ax
cmp rcx, rdx
jae 0x18001eb0c
nop dword [rax + rax]
xor ax, word [rcx]
add rcx, 2
cmp rcx, rdx
jb 0x18001eb00
cmp r8w, ax
jne 0x18001eb19
mov word [r9], r8w
mov al, 1
ret
xor al, al
ret
Function at 0x1800234f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
xor r9d, r9d
mov esi, r8d
mov ebp, edx
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x50]
mov rbx, rcx
call qword [rbx + reloc.WS2_32.dll_htonl]
test eax, eax
js 0x180023602
mov eax, dword [rsp + 0x50]
mov ecx, 0x5a4d
mov dword [rsp + 0x30], 0
cmp ax, cx
jne 0x1800235ad
mov r9d, 0x3c
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [rbx + reloc.WS2_32.dll_htonl]
test eax, eax
js 0x180023602
mov eax, dword [rsp + 0x30]
cmp eax, 0x40
ja 0x18002356c
mov eax, 0xfffffda8
jmp 0x180023602
lea rdx, [rsp + 0x50]
mov r9, rax
mov r8d, 4
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_htonl]
test eax, eax
js 0x180023602
mov eax, dword [rsp + 0x50]
cmp eax, 0x4550
je 0x1800235b4
mov ecx, 0x584c
cmp ax, cx
je 0x1800235ad
mov ecx, 0x454c
cmp ax, cx
je 0x1800235ad
mov ecx, 0x454e
cmp ax, cx
jne 0x180023562
cmp eax, 0x4550
jne 0x1800235cd
mov r9d, dword [rsp + 0x30]
mov r8d, esi
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.180025970
jmp 0x1800235e4
cmp eax, 0x464c457f
jne 0x1800235f2
mov r9, rdi
mov r8d, esi
mov edx, ebp
mov rcx, rbx
call fcn.180023440
cmp eax, 0xfffffda8
jg 0x180023602
cmp eax, 0xfffffda0
jle 0x180023602
mov r9, rdi
mov r8d, esi
mov edx, ebp
mov rcx, rbx
call fcn.180076c70
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1800267f0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0xc000]
mov rbx, rcx
test eax, eax
je 0x180026911
test dword [rcx + 0xc00c], 0x40000000
je 0x18002681a
mov edx, eax
call sym.VBoxRT.dll_RTLogWriteUser
test byte [rbx + 0xc00c], 8
je 0x180026831
mov edx, dword [rbx + 0xc000]
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteDebugger
test byte [rbx + 0xc00c], 1
je 0x180026890
mov rax, qword [rbx + 0xc010]
mov rcx, qword [rax + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x180026879
mov r8d, dword [rbx + 0xc000]
xor r9d, r9d
mov rdx, rbx
call sym.VBoxRT.dll_RTFileWrite
test dword [rbx + 0xc008], 0x200
je 0x180026879
mov rcx, qword [rbx + 0xc010]
mov rcx, qword [rcx + 0x50]
call sym.VBoxRT.dll_RTFileFlush
mov rcx, qword [rbx + 0xc010]
cmp dword [rcx + 0x70], 0
je 0x180026890
mov eax, dword [rbx + 0xc000]
add qword [rcx + 0x60], rax
test byte [rbx + 0xc00c], 2
je 0x1800268a7
mov edx, dword [rbx + 0xc000]
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteStdOut
test byte [rbx + 0xc00c], 4
je 0x1800268be
mov edx, dword [rbx + 0xc000]
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteStdErr
mov rax, qword [rbx + 0xc010]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x1800268d3
mov rcx, rbx
call rdx
test byte [rbx + 0xc00c], 1
mov dword [rbx + 0xc000], 0
je 0x180026911
mov rax, qword [rbx + 0xc010]
cmp dword [rax + 0x70], 0
je 0x180026911
call sym.VBoxRT.dll_RTTimeProgramSecTS
mov rcx, qword [rbx + 0xc010]
xor edx, edx
div dword [rcx + 0x68]
xor r8d, r8d
mov rcx, rbx
mov edx, eax
call fcn.1800264d0
add rsp, 0x20
pop rbx
ret
Function at 0x180026920
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
je 0x180026ac9
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
xor r13d, r13d
mov r12d, r13d
nop
mov eax, dword [rbx + 0xc000]
mov ecx, dword [rbx + 0xc000]
mov edi, 0xbfff
sub rdi, rax
mov rdx, rsi
cmp rdi, rbp
cmova rdi, rbp
add rcx, rbx
mov r8, rdi
call sub.MSVCR100.dll_memcpy
add dword [rbx + 0xc000], edi
mov eax, dword [rbx + 0xc000]
add r12, rdi
sub rbp, rdi
je 0x180026aaf
add rsi, rdi
test eax, eax
je 0x180026950
test dword [rbx + 0xc00c], 0x40000000
je 0x1800269ae
mov edx, eax
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteUser
test byte [rbx + 0xc00c], 8
je 0x1800269c5
mov edx, dword [rbx + 0xc000]
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteDebugger
test byte [rbx + 0xc00c], 1
je 0x180026a24
mov rax, qword [rbx + 0xc010]
mov rcx, qword [rax + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x180026a0d
mov r8d, dword [rbx + 0xc000]
xor r9d, r9d
mov rdx, rbx
call sym.VBoxRT.dll_RTFileWrite
test dword [rbx + 0xc008], 0x200
je 0x180026a0d
mov rcx, qword [rbx + 0xc010]
mov rcx, qword [rcx + 0x50]
call sym.VBoxRT.dll_RTFileFlush
mov rcx, qword [rbx + 0xc010]
cmp dword [rcx + 0x70], r13d
je 0x180026a24
mov eax, dword [rbx + 0xc000]
add qword [rcx + 0x60], rax
test byte [rbx + 0xc00c], 2
je 0x180026a3b
mov edx, dword [rbx + 0xc000]
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteStdOut
test byte [rbx + 0xc00c], 4
je 0x180026a52
mov edx, dword [rbx + 0xc000]
mov rcx, rbx
call sym.VBoxRT.dll_RTLogWriteStdErr
mov rax, qword [rbx + 0xc010]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x180026a67
mov rcx, rbx
call rdx
test byte [rbx + 0xc00c], 1
mov dword [rbx + 0xc000], r13d
je 0x180026950
mov rax, qword [rbx + 0xc010]
cmp dword [rax + 0x70], r13d
je 0x180026950
call sym.VBoxRT.dll_RTTimeProgramSecTS
mov rcx, qword [rbx + 0xc010]
xor edx, edx
div dword [rcx + 0x68]
xor r8d, r8d
mov rcx, rbx
mov edx, eax
call fcn.1800264d0
jmp 0x180026950
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov rax, r12
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [rcx + 0xc000]
mov byte [rax + rcx], 0
xor eax, eax
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
Function at 0x180040a90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rsi, r8
mov r11, rdx
mov rdi, rcx
lea rbx, [r9 - 0x40]
mov r10, r8
lea rbp, [0x180262c80]
cmp rdx, 3
jb 0x180040b6a
cmp r9, 5
jb 0x180040bca
movzx edx, byte [rdi]
sub r9, 4
add r10, 4
mov eax, edx
sub r11, 3
add rdi, 3
shr rax, 2
movzx eax, byte [rax + rbp]
mov byte [r10 - 4], al
movzx r8d, byte [rdi - 2]
mov eax, edx
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, r8d
and r8d, 0xf
shr eax, 4
shl r8d, 2
or rcx, rax
movzx eax, byte [rcx + rbp]
movsxd rcx, r8d
mov byte [r10 - 3], al
movzx edx, byte [rdi - 1]
mov eax, edx
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + rbp]
mov byte [r10 - 2], al
mov eax, edx
and eax, 0x3f
movzx eax, byte [rax + rbp]
mov byte [r10 - 1], al
cmp r9, rbx
jne 0x180040b60
test r11, r11
je 0x180040b60
cmp r9, 3
jb 0x180040bca
sub r9, 2
mov word [r10], 0xa0d
add r10, 2
lea rbx, [r9 - 0x40]
cmp r11, 3
jae 0x180040ac5
test r11, r11
je 0x180040bfe
cmp r9, 5
jb 0x180040bca
dec r11
je 0x180040bd1
dec r11
jne 0x180040bfa
movzx ecx, byte [rdi]
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + rbp]
mov byte [r10], al
movzx edx, byte [rdi + 1]
mov eax, ecx
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, edx
and edx, 0xf
shr eax, 4
or rcx, rax
shl edx, 2
movzx eax, byte [rcx + rbp]
mov byte [r10 + 1], al
movsxd rax, edx
movzx eax, byte [rax + rbp]
mov byte [r10 + 3], 0x3d
mov byte [r10 + 2], al
jmp 0x180040bfa
mov eax, 0xffffffd7
jmp 0x180040c14
movzx ecx, byte [rdi]
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + rbp]
mov byte [r10], al
mov eax, ecx
and eax, 3
shl eax, 4
cdqe
movzx eax, byte [rax + rbp]
mov word [r10 + 2], 0x3d3d
mov byte [r10 + 1], al
add r10, 4
mov rax, qword [rsp + 0x28]
mov byte [r10], 0
test rax, rax
je 0x180040c12
sub r10, rsi
mov qword [rax], r10
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x180067b20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.MSVCR100.dll___iob_func]
lea r9, [rax + 0x60]
mov r8, rbx
mov edx, 1
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.MSVCR100.dll_fwrite]

Function at 0x180067b60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.MSVCR100.dll___iob_func]
lea r9, [rax + 0x30]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fwrite]
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rcx, [rax + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.MSVCR100.dll_fflush]
Function at 0x18006e520
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
cmp byte [rcx + 0x11], dl
je 0x18006e593
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rsi
xor esi, esi
test dl, dl
mov eax, esi
lea r8, [rsp + 0x38]
sete al
mov edx, 0x8004667e
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x18006e57e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov esi, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x11], bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18006ea30
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push rbp
push rdi
push r13
sub rsp, 0x1e0
mov rdi, r8
mov r13d, edx
mov rbp, rcx
test edx, edx
jne 0x18006ea58
lea eax, [rdx - 2]
add rsp, 0x1e0
pop r13
pop rdi
pop rbp
ret
lea rax, [rcx + 0x1000]
cmp rax, 0x2000
jb 0x18006ea76
movabs rax, 0xffff800000000000
test rax, rcx
je 0x18006ea8c
test rcx, rcx
je 0x18006ea8c
mov eax, 0xfffffffa
add rsp, 0x1e0
pop r13
pop rdi
pop rbp
ret
mov qword [rsp + 0x200], rbx
mov ebx, 0x101
lea rdx, [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp word [rsp + 0x30], bx
je 0x18006eab7
mov eax, 0xffffffdb
jmp 0x18006ebe5
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x1d8], r12
mov qword [rsp + 0x1d0], r14
test rbp, rbp
je 0x18006ebaf
cmp byte [rbp], 0
je 0x18006ebaf
xor r12d, r12d
mov rcx, rbp
lea r14d, [r12 + 0x2e]
mov qword [rsp + 0x20], rcx
mov esi, r12d
mov ebx, r12d
nop dword [rax + rax]
lea r9, [rsp + 0x208]
lea rdx, [rsp + 0x20]
xor r8d, r8d
call sym.VBoxRT.dll_RTStrToUInt8Ex
test eax, eax
je 0x18006eb1e
cmp eax, 0x4c
jne 0x18006eb5d
mov rcx, qword [rsp + 0x20]
cmp esi, 3
mov eax, r12d
cmovl eax, r14d
cmp byte [rcx], al
jne 0x18006eb5d
movzx eax, byte [rsp + 0x208]
inc rcx
inc rbx
mov byte [rsp + rbx + 0x217], al
inc esi
mov qword [rsp + 0x20], rcx
cmp rbx, 4
jl 0x18006eb00
mov r12d, dword [rsp + 0x218]
jmp 0x18006ebb2
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x18006eb7a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
jmp 0x18006ebcd
cmp word [rax + 0x10], 2
jne 0x18006eba8
xor ecx, ecx
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov dword [rdi + 0x10], 1
mov dword [rdi + 0x14], r13d
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rdi], eax
xor eax, eax
jmp 0x18006ebcd
mov eax, 0xfffffe41
jmp 0x18006ebcd
xor r12d, r12d
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov dword [rdi + 0x10], 1
mov dword [rdi + 0x14], r13d
mov dword [rdi], r12d
mov r12, qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x210]
mov r14, qword [rsp + 0x1d0]
mov rbx, qword [rsp + 0x200]
add rsp, 0x1e0
pop r13
pop rdi
pop rbp
ret
Function at 0x18006ec70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push r12
push r13
push r14
sub rsp, 0x28
lea rax, [rcx + 0x1000]
mov r12, r9
mov r13, r8
mov r14, rdx
mov rsi, rcx
cmp rax, 0x2000
jb 0x18006ecae
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18006ecae
cmp dword [rcx], 0x19210912
je 0x18006ecbf
mov eax, 0xfffffffc
add rsp, 0x28
pop r14
pop r13
pop r12
pop rsi
ret
test r8, r8
jne 0x18006ecd4
lea eax, [r8 - 2]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0x50], rbx
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 4], ebx
je 0x18006ecfb
lea eax, [rbx - 0x5d]
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rsi
ret
movzx edx, bl
mov qword [rsp + 0x58], rbp
call fcn.18006e520
mov ebp, eax
test eax, eax
js 0x18006edd2
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
xor ecx, ecx
mov edi, r15d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, qword [rsi + 8]
mov eax, 0x3fffffff
cmp r13, rax
mov r8d, r13d
mov rdx, r14
cmovae r8d, eax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x18006ed96
test r12, r12
jne 0x18006edb5
add rdi, rcx
cmp rdi, r13
je 0x18006edb9
mov rbx, r13
xor ecx, ecx
sub rbx, rdi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, qword [rsi + 8]
mov eax, 0x3fffffff
lea rdx, [rdi + r14]
cmp rbx, rax
cmovae ebx, eax
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jg 0x18006ed50
lea ebx, [r12 + 1]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebp, eax
test eax, eax
js 0x18006edbe
test r12, r12
jne 0x18006ede8
mov ebp, 0xfffffe36
jmp 0x18006edbe
mov qword [r12], rcx
mov ebx, 1
mov eax, ebx
lock cmpxchg dword [rsi + 4], r15d
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x60]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [r12], r15
mov ebp, r15d
jmp 0x18006edbe
Function at 0x18006ee00
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
lea rax, [rcx + 0x1000]
mov rsi, r9
mov rbp, r8
mov r12, rdx
mov rdi, rcx
cmp rax, 0x2000
jb 0x18006ee3f
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18006ee3f
cmp dword [rcx], 0x19210912
je 0x18006ee52
mov eax, 0xfffffffc
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
test r8, r8
jne 0x18006ee69
lea eax, [r8 - 2]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x70], r13
xor eax, eax
mov r13d, 1
lock cmpxchg dword [rcx + 4], r13d
je 0x18006ee87
lea eax, [r13 - 0x5d]
jmp 0x18006ef61
movzx edx, r13b
mov qword [rsp + 0x68], rbx
call fcn.18006e520
mov ebx, eax
test eax, eax
js 0x18006ef5c
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, qword [rdi + 8]
mov eax, 0x3fffffff
cmp rbp, rax
mov rdx, r12
mov dword [rsp + 0x60], reloc.WS2_32.dll_recv
cmovae ebp, eax
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
xor ebp, ebp
movsxd rdx, eax
test eax, eax
jg 0x18006ef04
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
test eax, eax
js 0x18006ef52
mov qword [rsi], rbp
mov ebx, ebp
jmp 0x18006ef52
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x18006ef4f
cmp dword [rsp + 0x60], 0x10
jne 0x18006ef4a
cmp word [rsp + 0x30], 2
jne 0x18006ef4a
xor eax, eax
mov ebx, ebp
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
movzx eax, word [rsp + 0x32]
mov dword [rcx + 0x10], r13d
ror ax, 8
movzx eax, ax
mov dword [rcx + 0x14], eax
mov eax, dword [rsp + 0x34]
mov dword [rcx], eax
jmp 0x18006ef4f
mov ebx, 0xfffffe41
mov qword [rsi], rdx
mov eax, r13d
lock cmpxchg dword [rdi + 4], ebp
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x18006ef80
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x30
lea rax, [rcx + 0x1000]
mov rdi, r8
mov r12, rdx
mov rsi, rcx
cmp rax, 0x2000
jb 0x18006efb8
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18006efb8
cmp dword [rcx], 0x19210912
je 0x18006efc6
mov eax, 0xfffffffc
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], r14
xor eax, eax
mov r14d, 1
lock cmpxchg dword [rcx + 4], r14d
je 0x18006efed
lea eax, [r14 - 0x5d]
mov r14, qword [rsp + 0x28]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
movzx edx, r14b
mov qword [rsp + 0x50], rbx
call fcn.18006e520
mov ebx, eax
test eax, eax
js 0x18006f0d7
mov rcx, qword [rsi + 8]
mov r8d, edi
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x20], r15
mov r15d, 0x3fffffff
mov rdx, r12
cmp rdi, r15
cmovae r8d, r15d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
xor r13d, r13d
movsxd rcx, eax
cmp rcx, rdi
jne 0x18006f046
test eax, eax
js 0x18006f04a
mov ebx, r13d
jmp 0x18006f0c2
test eax, eax
jns 0x18006f05b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
jmp 0x18006f0c2
sub rdi, rcx
mov qword [rsp + 0x58], rbp
mov rbp, r13
je 0x18006f0bd
nop dword [rax + rax]
add r12, rcx
add rbp, rcx
mov rcx, qword [rsi + 8]
mov r8d, edi
cmp rdi, r15
mov rdx, r12
cmovae r8d, r15d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
test eax, eax
jns 0x18006f0b8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ebx, eax
cmp eax, 0xffffff1f
jne 0x18006f0bd
test rbp, rbp
je 0x18006f0bd
mov rcx, r13
mov ebx, r13d
sub rdi, rcx
jne 0x18006f070
mov rbp, qword [rsp + 0x58]
mov eax, r14d
lock cmpxchg dword [rsi + 4], r13d
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x28]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x18006f0f0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rax, [rcx + 0x1000]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp rax, 0x2000
jb 0x18006f12e
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x18006f12e
cmp dword [rcx], 0x19210912
je 0x18006f140
mov eax, 0xfffffffc
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], r12
xor r12d, r12d
cmp byte [rcx + 0x11], 1
je 0x18006f185
mov rcx, qword [rcx + 8]
lea r8, [rsp + 0x60]
mov edx, 0x8004667e
mov dword [rsp + 0x60], r12d
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x18006f181
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
test eax, eax
jns 0x18006f185
jmp 0x18006f22e
mov byte [rbx + 0x11], 1
mov rax, r12
mov ecx, r12d
test rdi, rdi
je 0x18006f1c7
cmp dword [rdi + 0x10], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
jne 0x18006f200
mov eax, 2
mov ecx, reloc.WS2_32.dll_recv
mov word [rsp + 0x30], ax
movzx eax, word [rdi + 0x14]
ror ax, 8
mov word [rsp + 0x32], ax
mov eax, dword [rdi]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
mov edx, 0x3fffffff
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 8]
cmp rsi, rdx
mov r8d, esi
mov qword [rsp + 0x20], rax
cmovae r8d, edx
xor r9d, r9d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_sendto]
movsxd rcx, eax
cmp rcx, rsi
jne 0x18006f207
test eax, eax
js 0x18006f20b
mov ecx, r12d
jmp 0x18006f221
mov eax, 0xfffffe41
jmp 0x18006f22e
test eax, eax
jns 0x18006f21c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov ecx, eax
jmp 0x18006f221
mov ecx, 0xffffffd6
mov eax, 1
lock cmpxchg dword [rbx + 4], r12d
mov eax, ecx
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006f240
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rax, [rcx + 0x1000]
mov rbx, rdx
mov rdi, rcx
cmp rax, 0x2000
jb 0x18006f273
movabs rcx, 0xffff800000000000
test rcx, rdi
jne 0x18006f273
cmp dword [rdi], 0x19210912
je 0x18006f27f
mov eax, 0xfffffffc
add rsp, 0x48
pop rdi
pop rbx
ret
lea rax, [rdx + 0x1000]
cmp rax, 0x2000
jb 0x18006f3b0
test rcx, rdx
jne 0x18006f3b0
cmp dword [rdx + 8], 0
jbe 0x18006f3b0
mov qword [rsp + 0x40], r13
xor eax, eax
mov r13d, 1
lock cmpxchg dword [rdi + 4], r13d
je 0x18006f2ca
lea eax, [r13 - 0x5d]
mov r13, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret
movzx edx, r13b
mov rcx, rdi
call fcn.18006e520
test eax, eax
js 0x18006f2be
mov ecx, dword [rbx + 8]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
lea rdx, str.D:_tinderboxwin_4.2_srcVBoxRuntime_r3_socket.cpp
shl rcx, 4
mov qword [rsp + 0x78], r12
mov esi, 0xffffffec
call sym.VBoxRT.dll_RTMemTmpAllocZTag
xor r12d, r12d
mov rbp, rax
test rax, rax
je 0x18006f38a
mov r8d, r12d
cmp dword [rbx + 8], r12d
jbe 0x18006f345
mov edx, r12d
nop dword [rax + rax]
mov rcx, qword [rbx]
inc r8d
add rdx, 0x10
mov rax, qword [rdx + rcx - 0x10]
mov qword [rdx + rbp - 8], rax
mov rax, qword [rbx]
mov ecx, dword [rdx + rax - 8]
mov dword [rdx + rbp - 0x10], ecx
cmp r8d, dword [rbx + 8]
jb 0x18006f320
mov r8d, dword [rbx + 8]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x60]
mov rdx, rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call qword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x18006f373
mov esi, r12d
jmp 0x18006f382
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call sym.VBoxRT.dll_RTErrConvertFromWin32
mov esi, eax
mov rcx, rbp
call sym.VBoxRT.dll_RTMemTmpFree
mov eax, r13d
lock cmpxchg dword [rdi + 4], r12d
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x48
pop rdi
pop rbx
ret
mov eax, 0xfffffffe
add rsp, 0x48
pop rdi
pop rbx
ret