joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093a40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
jle 0x140093a71
lea r10, [0x1401bb890]
nop dword [rax]
movzx r8d, byte [rcx]
dec edx
lea rcx, [rcx + 1]
movzx r9d, byte [r8 + r10]
lea r8d, [rax*8]
xor r9d, r8d
xor eax, r9d
test edx, edx
jg 0x140093a50
repz ret

Function at 0x140093af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, edx
mov edi, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova edi, ecx
cmp edi, dword [rbx]
jne 0x140093b24
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x140239688]
test rax, rax
je 0x140093b32
call rax
shl edi, 4
mov ecx, edi
call fcn.14008fc40
mov rcx, qword [0x140239690]
mov rdi, rax
test rcx, rcx
je 0x140093b4d
call rcx
test rdi, rdi
je 0x140093b17
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.14008ff80
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x140237018]
xor edx, edx
mov rcx, rdi
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rbx], esi
shl r8, 4
call fcn.140171ae0
mov rcx, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test rcx, rcx
je 0x140093c67
mov qword [rsp + 0x30], rbp
lea rbp, [0x1401bb890]
nop word [rax + rax]
mov r9d, dword [rcx + 0x20]
mov r10, qword [rcx + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x140093be2
movzx edx, byte [r10]
dec r9d
lea r10, [r10 + 1]
movzx r8d, byte [rdx + rbp]
lea edx, [rax*8]
xor r8d, edx
xor eax, r8d
test r9d, r9d
jg 0x140093bc0
mov r10, qword [rcx]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rdi
je 0x140093c3a
mov eax, dword [r9]
test eax, eax
je 0x140093c02
mov rdx, qword [r9 + 8]
jmp 0x140093c05
mov rdx, r11
inc eax
mov qword [r9 + 8], rcx
mov dword [r9], eax
test rdx, rdx
je 0x140093c3a
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x140093c30
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x140093c56
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x140093c56
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140093c4e
mov qword [rax + 8], rcx
mov qword [rcx + 8], r11
mov qword [rbx + 8], rcx
mov rcx, r10
test r10, r10
jne 0x140093bb0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140093de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r15d, r8d
mov r8d, dword [rcx]
mov rsi, r9
mov r14, rdx
mov rbx, rcx
test r8d, r8d
je 0x140093e49
xor eax, eax
mov r9d, r15d
mov r10, rdx
test r15d, r15d
jle 0x140093e40
lea r11, [0x1401bb890]
nop dword [rax + rax]
movzx ecx, byte [r10]
dec r9d
lea r10, [r10 + 1]
movzx edx, byte [rcx + r11]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140093e20
xor edx, edx
div r8d
mov ebp, edx
jmp 0x140093e4b
xor ebp, ebp
mov r9d, ebp
mov r8d, r15d
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.140093c80
mov rdx, rax
test rax, rax
je 0x140093ee8
mov rdi, qword [rax + 0x10]
test rsi, rsi
jne 0x140093ed8
mov rax, qword [rax + 8]
test rax, rax
je 0x140093e83
mov rcx, qword [rdx]
mov qword [rax], rcx
jmp 0x140093e8a
mov rax, qword [rdx]
mov qword [rbx + 8], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x140093e9a
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140093ebb
mov ecx, ebp
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], rdx
jne 0x140093eb9
mov rax, qword [rdx]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, rdx
call fcn.14008ff80
dec dword [rbx + 4]
jne 0x140093ee0
mov rcx, rbx
call fcn.140093950
mov rax, rdi
jmp 0x140093f87
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
mov rax, rdi
jmp 0x140093f87
test rsi, rsi
je 0x140093f85
mov ecx, 0x28
call fcn.14008fc40
mov rdi, rax
test rax, rax
jne 0x140093f08
mov rax, rsi
jmp 0x140093f87
mov qword [rax + 0x18], r14
mov dword [rax + 0x20], r15d
mov qword [rax + 0x10], rsi
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x140093f46
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x140093f46
add edx, edx
mov rcx, rbx
call fcn.140093af0
test eax, eax
je 0x140093f46
mov edx, r15d
mov rcx, r14
call fcn.140093a40
xor edx, edx
div dword [rbx]
mov ebp, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140093f65
mov edx, ebp
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.140093a80
jmp 0x140093f85
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140093f79
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1400adbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov r14d, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r12d, r9d
mov r8d, dword [r11 + 0x30]
mov r10, qword [rax + 8]
mov r13, qword [r11]
movsxd rax, dword [r10 + 0x30]
mov ecx, r8d
mov dword [rsp + 0x70], r8d
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
mov dword [rsp + 0x78], ecx
mov rcx, rax
imul r14, rax
cmp eax, r8d
je 0x1400adc38
cmp byte [r13 + 0x12], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r14
sub rdi, rcx
test ebx, ebx
jne 0x1400add59
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r14
jge 0x1400add3b
mov rax, rdi
movsxd rbp, r8d
mov qword [rsp + 0x20], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x140236e48]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1400add30
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, r10d
mov rcx, r13
call fcn.14009dd70
mov ebx, eax
test eax, eax
jne 0x1400add21
mov rcx, qword [rsp + 0x20]
call fcn.14009e540
mov ebx, eax
test eax, eax
jne 0x1400add21
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x78]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.1401669c0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x1400add21
test r12d, r12d
jne 0x1400add21
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x20]
call fcn.14009e0e0
mov r8d, dword [rsp + 0x70]
add rdi, rbp
test ebx, ebx
je 0x1400adc53
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x1400c7f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400c80bd
test rdx, rdx
je 0x1400c80bd
movzx ecx, word [rcx + 2]
mov edx, 0x800
test dx, cx
jne 0x1400c804b
movzx eax, word [rbx + 2]
test dx, ax
jne 0x1400c804b
xor al, cl
test al, 0x10
jne 0x1400c804b
movzx eax, byte [rdi]
cmp al, byte [rbx]
je 0x1400c7fed
cmp al, 0x5c
jne 0x1400c7fc7
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.1400c7f60
cmp eax, 2
jl 0x1400c7fdd
cmp byte [rbx], 0x5c
jne 0x1400c804b
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call fcn.1400c7f60
cmp eax, 2
jge 0x1400c804b
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.1400c7f60
test eax, eax
jne 0x1400c804b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1400c7f60
test eax, eax
jne 0x1400c804b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.1400c80e0
test eax, eax
jne 0x1400c804b
mov eax, dword [rbx + 0x2c]
cmp dword [rdi + 0x2c], eax
jne 0x1400c804b
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1400c804b
mov ecx, 0x400
test word [rdi + 2], cx
je 0x1400c805b
test word [rbx + 2], cx
je 0x1400c804b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x1400c80b0
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx r9d, byte [rdi]
lea eax, [r9 + 0x68]
test al, 0xfd
je 0x1400c80b0
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400c80b0
test word [rbx + 2], cx
jne 0x1400c804b
mov r8, qword [rbx + 8]
test r8, r8
je 0x1400c804b
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400c8095
inc rax
test ecx, ecx
jne 0x1400c8082
test edx, edx
je 0x1400c80b0
xor ecx, ecx
cmp r9b, 0x5c
setne cl
lea eax, [rcx + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1400ccc50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, rdx
test rdx, rdx
je 0x1400ccc91
cmp byte [rdx], r10b
je 0x1400ccc89
inc rbx
cmp byte [rbx], r10b
jne 0x1400ccc81
sub ebx, edx
and ebx, 0x3fffffff
mov r15d, dword [rcx + 0x28]
xor edi, edi
test r15d, r15d
jle 0x1400ccdbe
mov qword [rsp + 0x40], r12
lea r12, [0x1401bb890]
nop dword [rax]
mov r9d, edi
cmp edi, 2
jge 0x1400cccbc
xor r9d, 1
test r14, r14
je 0x1400ccd15
mov rcx, qword [rbp + 0x20]
movsxd rdx, r9d
mov rax, r14
shl rdx, 5
mov r8, qword [rdx + rcx]
movzx edx, byte [r14]
test dl, dl
je 0x1400ccd00
nop dword [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x1400ccd00
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x1400ccce0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x1400ccd92
mov rax, qword [rbp + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x1400ccd6b
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x1400ccd60
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
lea r9, [r9 + 1]
movzx ecx, byte [rax + r12]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1400ccd40
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x1400ccd6d
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.140093c80
test rax, rax
je 0x1400ccd8f
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x1400ccd9d
jmp 0x1400ccd92
xor r10d, r10d
inc edi
cmp edi, r15d
jl 0x1400cccb0
mov r12, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, r10
jmp 0x1400ccda5
Function at 0x1400ccf30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r9d, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x1400ccf68
cmp byte [rdx], r9b
je 0x1400ccf60
inc rbx
cmp byte [rbx], r9b
jne 0x1400ccf58
sub ebx, edx
and ebx, 0x3fffffff
mov ebp, dword [rcx + 0x28]
xor edi, edi
test ebp, ebp
jle 0x1400cd08c
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r15
mov r15, qword [rcx + 0x20]
lea r12, [0x1401bb890]
nop word [rax + rax]
mov eax, edi
cmp edi, 2
jge 0x1400ccf9a
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r15 + 0x18]
test r14, r14
je 0x1400ccff5
movzx edx, byte [r14]
mov r8, qword [r8 + r15]
mov rax, r14
test dl, dl
je 0x1400ccfe0
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x1400ccfe0
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x1400ccfc0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x1400cd062
cmp qword [r10 + 0x30], 0
je 0x1400cd03b
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x1400cd030
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
lea r9, [r9 + 1]
movzx ecx, byte [rax + r12]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1400cd010
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x1400cd03d
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.140093c80
test rax, rax
je 0x1400cd05f
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x1400cd06c
jmp 0x1400cd062
xor r9d, r9d
inc edi
cmp edi, ebp
jl 0x1400ccf90
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x1400cd079
Function at 0x1400d9ff0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x1400da00f
cmp byte [rdx], 0
je 0x1400da008
inc rax
cmp byte [rax], 0
jne 0x1400da000
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x68]
mov r8d, eax
add rcx, 0x50
jmp fcn.140093d50
Function at 0x14010e430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
mov dword [r9], 0
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rdi + 0x1c]
mov r8d, esi
sub r8d, edx
add rdx, rbp
call fcn.14017dbf8
test eax, eax
jle 0x14010e47f
add dword [rbx], eax
cmp dword [rbx], esi
jb 0x14010e460
test eax, eax
jns 0x14010e558
call fcn.14016a3d4
mov ecx, dword [rax]
call fcn.14016d990
mov rcx, qword [rdi + 0x70]
mov rbx, rax
test rcx, rcx
je 0x14010e4b0
cmp dword [rdi + 0x6c], 0xfffffffc
je 0x14010e4a8
call fcn.1401673d0
mov qword [rdi + 0x70], 0
mov dword [rdi], 0
mov dword [rdi + 0x6c], 0xffffffff
test rbx, rbx
je 0x14010e553
mov rsi, qword [rdi + 0x20]
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x14010e4d0
or rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14010e4e0
add rax, 3
add rcx, rax
call fcn.140167bc0
mov qword [rdi + 0x70], rax
test rax, rax
jne 0x14010e50a
mov dword [rdi + 0x6c], 0xfffffffc
or eax, 0xffffffff
jmp 0x14010e565
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rsi + rcx], 0
jne 0x14010e510
or rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14010e520
add rcx, 3
mov qword [rsp + 0x28], rbx
lea r8, [0x1401e4d48]
add rdx, rcx
lea rcx, [0x1401c63c0]
mov r9, rsi
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14016f274
or eax, 0xffffffff
jmp 0x14010e565
test eax, eax
jne 0x14010e563
mov dword [rdi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14011ab10
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14011ab6e
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14011ab68
shr ax, 8
cmp al, 2
jne 0x14011ab68
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140166980
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140166980
add rsp, 0x1d8
ret

Function at 0x14011d2c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
mov r8, qword [rcx + 0x330]
mov rdx, qword [rcx + 0x338]
mov eax, dword [rcx + 0x32c]
mov rbp, qword [rdx + 0x18]
mov r15, qword [r8]
xor edi, edi
add rbp, qword [r8 + 0x18]
mov rsi, rcx
test eax, eax
jne 0x14011d2fe
test rbp, rbp
jne 0x14011d43b
mov rcx, qword [rcx + 0x340]
mov qword [rsp + 0x60], r14
test eax, eax
mov rdx, qword [rcx]
mov r14d, 1
mov r8d, 5
cmovne r14d, r8d
cmp rbp, r14
jae 0x14011d436
movaps xmmword [rsp + 0x20], xmm6
movsd xmm6, qword [0x1401e9bc8]
mov qword [rsp + 0x58], rbx
nop word [rax + rax]
test rdx, rdx
je 0x14011d3ce
mov r8, qword [rsi + 0x330]
mov r9, qword [r8 + 8]
call fcn.14012b030
mov rbx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
inc rbp
inc edi
mul r8d
shr edx, 6
mov ecx, edx
imul ecx, ecx, 0x3e8
sub r8d, ecx
mov rcx, qword [rbx + 0x6b8]
sub edx, ecx
mov rax, rcx
imul r8d, r8d, 0x3e8
shr rax, 0x20
sub r8d, eax
movd xmm0, edx
movd xmm1, r8d
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
divsd xmm1, xmm6
addsd xmm1, xmm0
movsd qword [rbx + 0x698], xmm1
mov rcx, qword [rsi + 0x340]
mov rdx, qword [rcx]
cmp rbp, r14
jb 0x14011d340
movaps xmm6, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x58]
test edi, edi
je 0x14011d436
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [rsp + 0x50], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [rsp + 0x54], ecx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsi + 0x330]
mov qword [rsi + 0x174], rax
cmp r15, qword [rcx]
je 0x14011d436
mov dword [rsi + 0x328], 0
mov rcx, qword [rcx]
mov edx, 1
mov rcx, qword [rcx]
call fcn.14011d530
mov r14, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x140123f60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0x234], 0
mov rsi, qword [rcx]
mov rbx, rdx
mov rdi, rcx
jne 0x140124108
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x140123fe5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14013f050
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140125b60
jmp 0x140124110
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140124033
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14013f050
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140125b60
jmp 0x140124110
cmp word [rsp + 0x30], 2
jne 0x1401240ce
lea rdx, [rdi + 0xde]
lea rcx, [rsp + 0x34]
mov r8d, 0x2e
call fcn.14013eba0
test rax, rax
je 0x1401240ce
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp word [rsp + 0xb0], 2
lea r8, [rdi + 0x140]
movzx eax, ax
lea rdx, [rdi + 0x110]
mov dword [rdi + 0x10c], eax
je 0x140124094
mov byte [rdx], 0
mov dword [r8], 0
jmp 0x1401240a5
lea rcx, [rsp + 0xb0]
call fcn.140123ee0
test eax, eax
jne 0x140124108
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov edx, eax
mov ebx, eax
call fcn.14013f050
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140125b60
jmp 0x140124110
mov byte [rdi + 0xde], 0
mov dword [rdi + 0x10c], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.14013f050
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140125b60
jmp 0x140124110
mov rcx, rdi
call fcn.140123df0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140166980
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140124460
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
mov r10, rdx
mov edx, 6
mov eax, dword [rbx + 0x44c]
mov rdi, rcx
lea r9, [rsp + 0x40]
lea r8d, [rdx - 5]
mov rcx, r10
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401244cd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
call fcn.14013f050
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.140125a80
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.140125a80
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401244f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14012453f
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140124560
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x140124c60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
movsxd rax, dword [rcx + 0x740]
cmp eax, 0xffffffff
je 0x140124ce0
mov r8, rax
mov rax, qword [rcx + 0x730]
mov rcx, qword [rax]
mov rax, qword [rcx + r8*8]
test rax, rax
je 0x140124ce0
mov qword [rsp + 0x20], rbx
test rdx, rdx
je 0x140124c93
mov qword [rdx], rax
cmp dword [rax + 0x1b8], 0
mov rbx, qword [rax + 0x188]
je 0x140124cb1
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov r9d, 2
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
or rcx, 0xffffffffffffffff
test eax, eax
cmove rbx, rcx
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
or rax, 0xffffffffffffffff
add rsp, 0x28
ret

Function at 0x140125520
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov edx, reloc.WS2_32.dll_WSASetLastError
mov rbx, rcx
lea ecx, [rdx - 0x6f]
mov r14d, r8d
call qword [fcn.14016f76c]
mov ebp, 8
mov rsi, rax
mov qword [rbx + 0x4c8], rax
test rax, rax
je 0x14012561d
xor edi, edi
mov dword [rbx + 0x4b0], r14d
lea rcx, [rax + 0x18]
mov qword [rbx + 0x4c0], rdi
mov qword [rbx + 0x4b8], rdi
mov r8d, r14d
mov rdx, r15
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax], rdi
call fcn.140125350
test eax, eax
je 0x14012561d
mov rcx, qword [rbx + 0x4a8]
test rcx, rcx
je 0x1401255b4
call qword [fcn.1401673d0]
mov rcx, r15
call qword [fcn.140191714]
mov qword [rbx + 0x4a8], rax
test rax, rax
je 0x14012561d
mov edx, 2
xor r8d, r8d
mov ecx, edx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14012561d
lea r9, [rsi + 0x18]
lea r8, [0x1401253e0]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.14016a50c
mov rcx, rax
dec rax
cmp rax, 0xfffffffffffffffd
cmovbe rdi, rcx
mov qword [rsi], rdi
test rdi, rdi
jne 0x140125652
call fcn.14016a3d4
mov ebp, dword [rax]
lea rcx, [rbx + 0x4a8]
call fcn.140125490
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov eax, 1
jmp 0x140125633