joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1f10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
movzx esi, dl
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400b1f43
lea rdx, str.SEInputManager::Uninitialize_failed__NULL__m_pApiHighLevel_n
mov ecx, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.1400ab7f0
mov rax, qword [rcx]
xor edx, edx
mov qword [rsp + 0x30], rdi
call qword [rax + 0x68]
mov rdi, rax
test rax, rax
je 0x1400b1f8c
nop dword [rax + rax]
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400bc510
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rcx, qword [rbx]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rdi, rax
test rax, rax
jne 0x1400b1f60
mov rcx, qword [rbx]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rdi, rax
test rax, rax
je 0x1400b1fd1
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400bc8f0
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rcx, qword [rbx]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rdi, rax
test rax, rax
jne 0x1400b1fa2
test sil, sil
je 0x1400b2035
mov rcx, qword [rbx]
lea rdx, [rbx + 0x30]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0xa0]
test al, al
jne 0x1400b1ffe
lea rdx, str.SEInputDeviceMouse::Uninitialize_failed__pApiHighLevel__DeviceMouseUnplug_n
mov ecx, 1
call fcn.1400ab7f0
mov byte [rbx + 0x50], 0
lea rdx, [rbx + 8]
mov rcx, qword [rbx]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x90]
test al, al
jne 0x1400b202a
lea rdx, str.SEInputDeviceKeyboard::Uninitialize_failed__pApiHighLevel__DeviceHidKeyboardUnplug_n
mov ecx, 1
call fcn.1400ab7f0
mov byte [rbx + 0x28], 0
mov qword [rbx], 0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1400b84b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov r14d, ecx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
lea rdx, str.Softwaredatronicsoft_spacedesk
lea rcx, [rsp + 0x48]
call fcn.14008f3f0
mov edi, 1
mov dword [rsp + 0x40], edi
lea rsi, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 8]
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400b854f
mov r9d, eax
mov r8, rsi
lea rdx, str.SEUtilRegistryKeysEnumerate_failed___s__d_n
mov ecx, edi
call fcn.1400ab7f0
xor bpl, bpl
jmp 0x1400b862c
movzx ebp, dil
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x80]
call fcn.1402ae030
mov dword [rsp + 0x70], 0xff
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400b85be
cmp eax, 0x103
je 0x1400b85bb
mov r8d, eax
lea rdx, str.SEUtilRegistryKeysEnumerate_RegEnumKeyEx_failed___d_n
mov ecx, edi
call fcn.1400ab7f0
xor bpl, bpl
lea rax, [rsp + 0x80]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400b85d0
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x1400b8611
mov rsi, rbx
cmp rax, 8
jb 0x1400b85ef
mov rsi, qword [rbx]
mov qword [rbx + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1402ad790
mov word [rbx + rsi], r15w
jmp 0x1400b8621
lea r9, [rsp + 0x80]
mov rcx, rbx
call fcn.14008ff70
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and edi, 0xfffffffe
mov dword [rsp + 0x40], edi
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400b8671
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b866c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b86b0
call fcn.1402ab340
movdqa xmm0, xmmword [0x1404332f0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r15w
movzx eax, bpl
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1402ab320
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1402b2324
int3
Function at 0x1400c0110
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rdx]
mov rcx, rdx
mov rbx, rdx
call qword [rax + 0x28]
mov rdi, rax
test rax, rax
jne 0x1400c0147
lea rdx, str.SEListDisplayViewers::PrivateHeartbeatTransmit_TransmitBufferSimpleAcquire_failed__n
lea ecx, [rax + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ab7f0
mov rax, qword [rax]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rax + 0x18]
test al, al
jne 0x1400c0174
lea rdx, str.SEListDisplayViewers::PrivateHeartbeatTransmit_InitializePing_failed__n
mov ecx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ab7f0
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x30]
test al, al
jne 0x1400c01a1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea rdx, str.SEListDisplayViewers::PrivateHeartbeatTransmit_failed__TransmitBufferSimpleSubmit__s_n
mov ecx, 1
mov r8, rax
call fcn.1400ab7f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c7420
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebp, ebp
movzx r12d, dl
mov esi, ebp
mov ebx, 0x400
mov r15, 0xffffffffffffffff
nop
mov edi, ebx
mov eax, 4
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.1402ab3b0
mov r14, rax
lea rcx, [rdi*4]
mov rdi, rax
lea edx, [rbx*4]
xor eax, eax
lea r8, [rsp + 0x20]
rep stosb byte [rdi], al
mov rcx, r14
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x1400c762f
mov edi, dword [rsp + 0x20]
shr edi, 2
cmp edi, ebx
jb 0x1400c74df
mov rcx, r14
add ebx, 0x400
call fcn.1402ab340
inc esi
cmp esi, 5
jl 0x1400c7460
lea rdx, str.SEUtilProcessFind_failed__n
mov ecx, 1
call fcn.1400ab7f0
jmp 0x1400c7651
xor r15b, r15b
test edi, edi
je 0x1400c7621
mov rsi, r14
nop dword [rax]
mov r8d, dword [rsi]
test r8d, r8d
je 0x1400c759c
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400c752e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsi]
lea rdx, str.SEUtilProcessFind_OpenProcess_failed__PID:_d_Error:_d_n
mov r9d, eax
lea ecx, [rbx + 1]
call fcn.1400ab7f0
jmp 0x1400c759c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1402ae030
lea r9, [rsp + 0x24]
mov dword [rsp + 0x24], 0x104
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x1400c757d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SEUtilProcessFind_QueryFullProcessImageNameW_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400ab7f0
jmp 0x1400c7593
lea rdx, str.dwm.exe
lea rcx, [rsp + 0x30]
call fcn.1402ad108
test rax, rax
jne 0x1400c75bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebp
add rsi, 4
cmp ebp, edi
jb 0x1400c74f0
mov rcx, r14
call fcn.1402ab340
movzx eax, r15b
jmp 0x1400c7653
mov r15b, 1
test r12b, r12b
je 0x1400c7618
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1400c75ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SEUtilProcessFind_TerminateProcess_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400ab7f0
xor r15b, r15b
mov edx, 0x7530
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400c7618
mov r8d, eax
lea rdx, str.SEUtilProcessFind_WaitForSingleObject_failed___d_n
mov ecx, 1
call fcn.1400ab7f0
xor r15b, r15b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.1402ab340
movzx eax, r15b
jmp 0x1400c7653
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SEUtilProcessFind_EnumProcesses_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400ab7f0
mov rcx, r14
call fcn.1402ab340
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402ab320
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ccdf0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x2058
call fcn.1402aba50
sub rsp, rax
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x2030], rax
test dword [0x14046e6f8], ecx
je 0x1400ccf0d
mov qword [rsp + 0x2050], rbx
mov qword [rsp + 0x2048], rsi
mov qword [rsp + 0x2040], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str.SLI___04d:_04d_:
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140093970
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
lea rsi, [rsp + 0x2070]
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400cce80
mov edi, 0x1000
lea rbx, [rsp + 0x30]
sub rdi, rax
lea rbx, [rbx + rax*2]
call fcn.140092a40
mov r9, qword [rsp + 0x2068]
mov r8, rdi
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.1402b828c
mov rax, qword [0x14046e6f0]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x2040]
mov rsi, qword [rsp + 0x2048]
mov rbx, qword [rsp + 0x2050]
test rax, rax
je 0x1400ccf07
call rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret
Function at 0x1400ccf30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x40], 4
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SYSTEMCurrentControlSetServices_spacedeskService
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400ccfa0
mov r9d, eax
lea r8, str.SYSTEMCurrentControlSetServices_spacedeskService
lea rdx, str.SLIUtilRegistryValueGet_RegOpenKeyEx_failed___s__d_n
mov ecx, 1
call fcn.1400ccdf0
jmp 0x1400cd003
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400cd019
mov r8, rbx
mov ecx, 1
cmp eax, 2
jne 0x1400ccfe9
lea rdx, str.SLIUtilRegistryValueGet_RegQueryValueExW_failed___s_ERROR_FILE_NOT_FOUND_n
call fcn.1400ccdf0
jmp 0x1400ccff8
mov r9d, eax
lea rdx, str.SLIUtilRegistryValueGet_RegQueryValueExW_failed___s__d_n
call fcn.1400ccdf0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, rbx
lea rdx, str.SLIUtilSettingsServerDwordGet_failed__SLIUtilRegistryValueGet__s_n
mov ecx, 0x10
call fcn.1400ccdf0
jmp 0x1400cd05e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x48], 1
lea r8, str.SYSTEMCurrentControlSetServices_spacedeskService
mov r9, rbx
mov ecx, 0x10
jne 0x1400cd052
lea rax, [rsp + 0x38]
lea rdx, str.SLIUtilRegistryValueGet_RegQueryValueExW__s__s_Data:__s_n
mov qword [rsp + 0x20], rax
call fcn.1400ccdf0
jmp 0x1400cd05e
lea rdx, str.SLIUtilRegistryValueGet_RegQueryValueExW__s__s_n
call fcn.1400ccdf0
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x60
pop rbx
ret

Function at 0x1400d3850
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400d38bd
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x10000002
call qword [rax + 0xb8]
test eax, eax
jns 0x1400d388b
mov r8d, eax
lea rdx, str.SLEncMFTH264::StreamEnd_failed__m_pTransform__ProcessMessage_MFT_MESSAGE_NOTIFY_END_OF_STREAM_0x_x_n
mov ecx, 1
call fcn.1400ccdf0
mov rcx, qword [rbx + 0x18]
xor r8d, r8d
mov edx, 0x10000001
mov rax, qword [rcx]
call qword [rax + 0xb8]
test eax, eax
jns 0x1400d38bd
mov r8d, eax
lea rdx, str.SLEncMFTH264::StreamEnd_failed__m_pTransform__ProcessMessage_MFT_MESSAGE_NOTIFY_END_STREAMING_0x_x_n
mov ecx, 1
add rsp, 0x20
pop rbx
jmp fcn.1400ccdf0
add rsp, 0x20
pop rbx
ret
Function at 0x1400d3f90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x2058
call fcn.1402aba50
sub rsp, rax
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x2030], rax
test dword [0x14046e708], ecx
je 0x1400d40ad
mov qword [rsp + 0x2050], rbx
mov qword [rsp + 0x2048], rsi
mov qword [rsp + 0x2040], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str.L4___04d:_04d_:
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140093970
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
lea rsi, [rsp + 0x2070]
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400d4020
mov edi, 0x1000
lea rbx, [rsp + 0x30]
sub rdi, rax
lea rbx, [rbx + rax*2]
call fcn.140092a40
mov r9, qword [rsp + 0x2068]
mov r8, rdi
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.1402b828c
mov rax, qword [0x14046e700]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x2040]
mov rsi, qword [rsp + 0x2048]
mov rbx, qword [rsp + 0x2050]
test rax, rax
je 0x1400d40a7
call rax
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x2058
ret

Function at 0x1400d40d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServices_spacedeskService
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d415c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.QosDisable
mov dword [rsp + 0x3c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmove ebx, dword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x50
pop rbx
ret
Function at 0x1400d4640
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x58]
mov rbx, rcx
test rdi, rdi
je 0x1400d4680
mov rcx, rdi
call fcn.1400e93d0
test eax, eax
jg 0x1400d4680
mov edx, eax
mov rcx, rdi
call fcn.1400e85a0
mov r8d, eax
lea rdx, str.L4SecureSocketLayerConnectionClose_failed__SSL_shutdown_Error:_d_n
mov ecx, 1
call fcn.1400d3f90
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400d4696
call fcn.1400e6be0
mov qword [rbx + 0x50], 0
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
jne 0x1400d46bb
lea rdx, str.L4SocketTcpConnected::Detach_failed__INVALID_SOCKET__m_Socket_n
mov ecx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400d3f90
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x1400d46e5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.L4SocketTcpConnected::Detach_shutdown_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400d3f90
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d46f0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 8]
lea r9, [rcx + 0x28]
mov dword [rsp + 0x30], edx
cmp edx, 0xffffffff
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
je 0x1400d472c
lea r9, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400d4767
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.L4SocketTcpConnected::SendBufferSizeSet_setsockopt_SO_SNDBUF_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400d3f90
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x48
ret
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x48
ret

Function at 0x1400d4780
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], edx
mov r8d, 0x1005
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400d47eb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.L4SocketTcpConnected::SendTimeoutSet_setsockopt_SO_SNDTIMEO_failed___d_n
mov ecx, 1
mov r8d, eax
call fcn.1400d3f90
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x48
ret
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0x48
ret
Function at 0x1400d4800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r12d, r8d
mov rsi, rdx
mov r14, rcx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x1400d4872
call fcn.1400e8e50
test eax, eax
jg 0x1400d4866
mov edx, eax
mov rcx, qword [r14 + 0x58]
call fcn.1400e85a0
mov r8d, eax
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_failed__SSL_error__d_n
mov ecx, 1
call fcn.1400d3f90
xor al, al
jmp 0x1400d4a13
jmp 0x1400d4a05
mov rcx, r14
cmp dword [r14 + 0x2c], 2
jne 0x1400d4a09
xor edi, edi
mov qword [rsp + 0x48], rdi
lea r8d, [rdi + 6]
lea rdx, [rsp + 0x48]
call fcn.1400d5840
test al, al
je 0x1400d4a01
movzx r13d, byte [rsp + 0x48]
and r13d, 0x7f
movzx ebx, byte [rsp + 0x49]
and ebx, 0x7f
cmp ebx, 0x7e
jne 0x1400d48c3
movzx ebx, byte [rsp + 0x4a]
shl ebx, 8
movzx eax, byte [rsp + 0x4b]
or ebx, eax
mov r15d, 2
cmp ebx, 0x80
jb 0x1400d48e9
mov r8d, r15d
lea rdx, [rsp + 0x4e]
mov rcx, r14
call fcn.1400d5840
test al, al
je 0x1400d4a01
mov r8d, ebx
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_PayloadLength__d__n
mov ecx, 0x40
call fcn.1400d3f90
cmp ebx, r12d
cmovb r12d, ebx
mov r8d, r12d
mov rdx, rsi
mov rcx, r14
call fcn.1400d5840
test al, al
je 0x1400d4a01
movzx eax, byte [rsi + 2]
movzx r9d, byte [rsi + 1]
mov dword [rsp + 0x20], eax
mov r8, rsi
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_Payload_Masked__x__x__x__n
mov ecx, 0x40
call fcn.1400d3f90
mov rax, r15
mov r12d, 4
cmp ebx, 0x80
cmovae rax, r12
lea r8, [rsp + 0x48]
add r8, rax
test ebx, ebx
je 0x1400d497a
mov rcx, rsi
mov edx, ebx
nop
mov rax, rdi
and eax, 3
movzx eax, byte [rax + r8]
xor byte [rcx], al
inc rdi
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400d4960
movzx eax, byte [rsi + 2]
movzx r9d, byte [rsi + 1]
movzx r8d, byte [rsi]
mov dword [rsp + 0x20], eax
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_Payload_Unmasked__x__x__x__n
mov ecx, 0x40
call fcn.1400d3f90
cmp r13d, 8
jne 0x1400d4a05
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], 0x288
test ebx, ebx
je 0x1400d49c6
movzx eax, byte [rsi]
mov byte [rsp + 0x32], al
movzx eax, byte [rsi + 1]
mov byte [rsp + 0x33], al
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x50], eax
test ebx, ebx
cmovne r15d, r12d
mov dword [rsp + 0x38], r15d
mov r8d, 1
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.1400d5730
test al, al
jne 0x1400d4a05
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_SendSynchronous_failed__n
mov ecx, 1
call fcn.1400d3f90
xor al, al
jmp 0x1400d4a13
mov al, 1
jmp 0x1400d4a13
call fcn.1400d5840
test al, al
setne al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1402ab320
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d4a40
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1070
call fcn.1402aba50
sub rsp, rax
mov rax, qword [0x140467f78]
xor rax, rsp
mov qword [rsp + 0x1060], rax
cmp qword [r8 + 0x18], 0x10
mov rdi, r8
mov rbx, rcx
mov rax, r8
jb 0x1400d4a7a
mov rax, qword [r8]
lea rsi, [r8 + 0x10]
xor ebp, ebp
mov qword [rsi], rbp
lea rcx, [rsp + 0x60]
xor edx, edx
mov byte [rax], bpl
mov r8d, 0x1000
call fcn.1402ae030
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea r8d, [rbp + 1]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x40], 0x1000
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x1400d4aff
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_WSARecv_failed__SOCKET_ERROR_WSAGetLastError:__d_n
lea ecx, [rbp + 1]
call fcn.1400d3f90
xor al, al
jmp 0x1400d4b6c
cmp dword [rsp + 0x50], ebp
jne 0x1400d4b1a
lea rdx, str.L4SocketTcpConnected::ReceiveSynchronous_failed__Connection_closed_terminating..._n
mov ecx, 1
call fcn.1400d3f90
xor al, al
jmp 0x1400d4b6c
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], bpl
jne 0x1400d4b26
mov rax, qword [rdi + 0x18]
cmp rbx, rax
ja 0x1400d4b5a
cmp rax, 0x10
jb 0x1400d4b41
mov rdi, qword [rdi]
mov r8, rbx
mov qword [rsi], rbx
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1402ad790
mov byte [rdi + rbx], bpl
jmp 0x1400d4b6a
lea r9, [rsp + 0x60]
mov rdx, rbx
mov rcx, rdi
call fcn.1400d5aa0
mov al, 1
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1402ab320
mov rbx, qword [rsp + 0x1098]
add rsp, 0x1070
pop rdi
pop rsi
pop rbp
ret