joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140183a40
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov esi, ecx
test ecx, ecx
js 0x140183ad8
test rbx, rbx
je 0x140183ad8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea r8, str.getEntropy
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400d9650
nop
xor bpl, bpl
call fcn.1400d8840
mov rdi, rax
test rax, rax
jne 0x140183aa1
xor bl, bl
jmp 0x140183ac9
mov r8, rbx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx ebx, bpl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
lea rcx, [rsp + 0x20]
call fcn.1400d9770
movzx eax, bl
jmp 0x140183ada
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019bff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 0x18]
cmp eax, ecx
jb 0x14019c06c
cmp eax, dword [rbx + 0x28]
jb 0x14019c06c
sub eax, ecx
mov ecx, eax
je 0x14019c0ee
mov r8, qword [rbx + 8]
mov eax, 1
add r8, rcx
cmove r8, rax
mov r9, qword [rbx + 0x20]
add r9, qword [rbx + 0x10]
imul rax, r9, 0x3e8
cqo
idiv r8
mov ecx, 0xffffffff
cmp rax, rcx
jg 0x14019c0ee
mov qword [rbx + 0x30], r9
mov qword [rbx + 0x38], rax
jmp 0x14019c0ee
xor edx, edx
mov r8d, 0x178
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.1400db140
nop
cmp byte [0x1403aedd5], 0
je 0x14019c0c3
mov eax, dword [rbx + 0x44]
cmp eax, 1
jne 0x14019c0a3
lea rdx, str.resetSendPerfMon
jmp 0x14019c0b6
cmp eax, 2
lea rdx, str.resetReceivePerfMon
je 0x14019c0b6
lea rdx, str.resetPerformanceMon
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call qword [rax + 0x30]
xor edi, edi
mov dword [rbx + 0x28], edi
mov qword [rbx + 0x20], rdi
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 0x18], eax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
lea rcx, [rsp + 0x20]
call fcn.1400db170
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x1b0
pop rdi
ret

Function at 0x14019ecd0
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x14019ecdc
mov al, 1
ret
jmp fcn.140155f20

Function at 0x1401a0670
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x2a0], 2
je fcn.1401a15d0
jmp fcn.1401a16e0
Function at 0x1401a0e90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x1401a0ebf
xor al, al
jmp 0x1401a0f50
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x1401a0f30
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x1401a0f35
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x80
pop rbx
ret

Function at 0x1401a13d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x1401a1471
mov r8d, dword [rcx + 0xdc]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x1401a146c
and r8d, 0xfffff000
mov dword [rcx + 0xdc], r8d
cmp byte [rdx + 0x169], 0
je 0x1401a1445
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_RCVBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xdc]
lea rdx, str.recvBufSize
mov rcx, rsi
call fcn.1400d9e50
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xdc]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401a1480
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x1401a1521
mov r8d, dword [rcx + 0xd8]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x1401a151c
and r8d, 0xfffff000
mov dword [rcx + 0xd8], r8d
cmp byte [rdx + 0x169], 0
je 0x1401a14f5
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_SNDBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd8]
lea rdx, str.sendBufSize
mov rcx, rsi
call fcn.1400d9e50
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xd8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401a15d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea r8, str.ck_getsockname_ipv4
mov rdx, r9
lea rcx, [rsp + 0x38]
call fcn.1400d9650
nop
mov rcx, rsi
call fcn.1400c4d90
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x1401a169f
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x1401a167b
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov rcx, rsi
call fcn.1400c0a30
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x1401a16b1
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.1401a3fd0
jmp 0x1401a16af
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.1400d9770
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401a16e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea r8, str.ck_getsockname_ipv6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400d9650
nop
mov rcx, rsi
call fcn.1400c4d90
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x1401a17af
mov dword [rsp + 0x20], 0x1c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x1401a178b
mov rcx, rsi
call fcn.1400c4d90
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1401a2f40
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x1401a17c1
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname_ipv6
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.1401a3fd0
jmp 0x1401a17bf
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.1400d9770
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a3e00
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.1402639f0
sub rsp, rax
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140103330
mov rdx, rbx
mov rcx, rdi
call fcn.1401034b0
test al, al
je 0x1401a3e6d
mov byte [rdi + 0x29], 1
mov rax, qword [rbx]
lea rdx, str.Wait_for_data_on_socket_aborted_by_app
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x1401a3f2f
cmp qword [rsi + 0x298], 0xffffffffffffffff
jne 0x1401a3e92
mov rax, qword [rbx]
lea rdx, str.Cannot_wait_for_socket_data:_not_connected__invalid_socket_
mov rcx, rbx
call qword [rax + 0x28]
mov byte [rdi + 0x2a], 1
xor al, al
jmp 0x1401a3f2f
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
call fcn.1400b6710
lea r15, vtable.ckFdSet.0
mov qword [rsp + 0x40], r15
mov ebx, 0x3004bc8d
mov dword [rsp + 0x50], ebx
mov dword [rbp + 0xfe0], ebx
mov dword [rsp + 0x58], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf60], xmm0
movups xmmword [rbp + 0xf70], xmm0
movups xmmword [rbp + 0xf80], xmm0
movups xmmword [rbp + 0xf90], xmm0
movups xmmword [rbp + 0xfa0], xmm0
movups xmmword [rbp + 0xfb0], xmm0
movups xmmword [rbp + 0xfc0], xmm0
movups xmmword [rbp + 0xfd0], xmm0
movsxd r9, dword [rsi + 0x298]
test r9d, r9d
jns 0x1401a3f55
mov byte [rdi + 0x2a], 1
xor bl, bl
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x50], r14d
mov dword [rbp + 0xfe0], r14d
lea rcx, [rsp + 0x40]
call fcn.1400b67f0
movzx eax, bl
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + r14*8 + 0x60], r9
inc dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x1401a3f0f
jne 0x1401a3f87
mov byte [rdi + 0x28], 1
jmp 0x1401a3f0f
mov bl, 1
jmp 0x1401a3f11

Function at 0x1401a3f90
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xdc]
je 0x1401a3faa
mov dword [rcx + 0xdc], edx
test edx, edx
je 0x1401a3faa
mov rdx, r8
jmp fcn.1401a13d0
ret

Function at 0x1401a3fb0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd8]
je 0x1401a3fca
mov dword [rcx + 0xd8], edx
test edx, edx
je 0x1401a3fca
mov rdx, r8
jmp fcn.1401a1480
ret
Function at 0x1401a4710
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rbx, rcx
je 0x1401a47a1
movzx eax, byte [r8 + 0x169]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 0
test dl, dl
je 0x1401a4769
test al, al
je 0x1401a4762
mov rax, qword [r8]
lea rdx, str.Turning_on_TCP_NODELAY.
mov rcx, r8
call qword [rax + 0x30]
lea r9, [rsp + 0x30]
jmp 0x1401a4782
test al, al
je 0x1401a477d
mov rax, qword [r8]
lea rdx, str.Turning_off_TCP_NODELAY.
mov rcx, r8
call qword [rax + 0x30]
lea r9, [rsp + 0x34]
mov rcx, qword [rbx + 0x298]
mov r8d, 1
mov dword [rsp + 0x20], 4
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x40
pop rbx
ret

Function at 0x1401a47c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rcx
cmp dword [rcx + 0xdc], edx
je 0x1401a485b
cmp edx, 0x1000
jb 0x1401a485b
mov eax, 0x800000
cmp edx, eax
cmovbe eax, edx
and eax, 0xfffff000
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov dword [rcx + 0xdc], eax
je 0x1401a485b
cmp byte [r8 + 0x169], 0
je 0x1401a4834
mov rax, qword [r8]
lea rdx, str.Setting_SO_RCVBUF_size
mov rcx, rbx
call qword [rax + 0x30]
mov r8d, dword [rsi + 0xdc]
lea rdx, str.recvBufSize
mov rcx, rbx
call fcn.1400d9e50
mov rcx, qword [rsi + 0x298]
lea r9, [rsi + 0xdc]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401a4870
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xd0], 0x4901fb2a
mov rbx, r8
mov rdi, rcx
je 0x1401a48ad
mov rax, qword [r8]
lea rdx, str.Internal_error:_Socket_object_already_deleted.
mov rcx, rbx
call qword [rax + 0x28]
xor ecx, ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140001920
mov qword [rsp + 0x40], rsi
cmp dword [rcx + 0xd8], edx
je 0x1401a4938
cmp edx, 0x1000
jb 0x1401a4938
mov eax, 0x800000
cmp edx, eax
cmovbe eax, edx
and eax, 0xfffff000
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov dword [rcx + 0xd8], eax
je 0x1401a4938
cmp byte [r8 + 0x169], 0
je 0x1401a4911
mov rax, qword [r8]
lea rdx, str.Setting_SO_SNDBUF_size
mov rcx, rbx
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd8]
lea rdx, str.sendBufSize
mov rcx, rbx
call fcn.1400d9e50
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xd8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401a4950
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x1401a4983
mov byte [rbx + 0x290], 0
cmp byte [rbx + 0x290], 0
je 0x1401a49e0
cmp byte [rbx + 0xd6], 0
jne 0x1401a49e0
cmp byte [rbx + 0xd5], 0
jne 0x1401a4a47
cmp byte [rbx + 0xd4], 0
jne 0x1401a4a47
cmp byte [rdx + 0x173], 0
jne 0x1401a4a47
mov r9d, 2
lea r8d, [r9 - 1]
lea rdx, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x1401a49fa
mov rdx, rdi
mov rcx, rbx
call fcn.1401a3c70
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp eax, 0xffffffff
jg 0x1401a4a47
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1401a4a47
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
lea r8, str.isConnected_recv_peek
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400d9650
nop
mov rdx, rdi
xor ecx, ecx
call fcn.1401a4570
nop
lea rcx, [rsp + 0x20]
call fcn.1400d9770
jmp 0x1401a49e0
mov al, 1
jmp 0x1401a49e2
Function at 0x1401a5ad0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
cmp byte [0x140376084], 0
jne 0x1401a5b02
mov al, 1
jmp 0x1401a5c8d
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
nop
mov ecx, 0x909
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x30], eax
cmp eax, 0x276c
jne 0x1401a5bf2
mov ecx, 5
mov dword [rsp + 0x38], ecx
mov edx, 2
mov dword [rsp + 0x34], edx
cmp ecx, 1
jl 0x1401a5baa
sub edx, 1
mov dword [rsp + 0x34], edx
jns 0x1401a5b64
mov dword [rsp + 0x34], 9
dec ecx
mov dword [rsp + 0x38], ecx
mov dl, 9
test ecx, ecx
je 0x1401a5baa
movzx ebx, dl
shl bx, 8
movzx eax, cl
or bx, ax
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x30], eax
cmp eax, 0x276c
jne 0x1401a5baa
mov ecx, dword [rsp + 0x38]
mov edx, dword [rsp + 0x34]
jmp 0x1401a5b46
test eax, eax
jne 0x1401a5bfa
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
lea r8, str.Using_ws2_32.dll_version__d__d
mov edx, 0x50
lea rcx, [rsp + 0x1e0]
call fcn.1400d7e60
mov rax, qword [rdi]
lea r8, [rsp + 0x1e0]
lea rdx, str.ws2_32_DLL_Version
mov rcx, rdi
call qword [rax + 0x58]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1401a5c7d
cmp eax, 0x276b
jne 0x1401a5c0a
lea rdx, str.The_underlying_network_subsystem_is_not_ready_for_network_communication.
jmp 0x1401a5c70
cmp eax, 0x276c
jne 0x1401a5c1a
lea rdx, str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation.
jmp 0x1401a5c70
cmp eax, 0x2734
jne 0x1401a5c2a
lea rdx, str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress.
jmp 0x1401a5c70
cmp eax, 0x2753
jne 0x1401a5c3a
lea rdx, str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached.
jmp 0x1401a5c70
cmp eax, 0x271e
jne 0x1401a5c4a
lea rdx, str.The_lpWSAData_is_not_a_valid_pointer.
jmp 0x1401a5c70
lea r9, [rsp + 0x30]
lea r8, str.WSAStartup_error:_0x_x
mov edx, gethostbyname
lea rcx, [rsp + 0x1e0]
call fcn.1400d7d70
lea rdx, [rsp + 0x1e0]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov eax, dword [rsp + 0x30]
mov byte [0x140376084], 0
test eax, eax
sete al
jmp 0x1401a5c8d
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x1401d1960
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
lea r8, str.dns_gethostbyname
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400d9650
nop
xor ebp, ebp
mov dword [r14], ebp
mov rcx, rsi
call fcn.1400b9c60
mov rax, qword [rdi]
mov r8, rbx
lea rdx, str.hostname
mov rcx, rdi
call qword [rax + 0x58]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1401d1a53
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
test rdx, rdx
je 0x1401d19ec
mov ebp, dword [rdx]
mov dword [r14], ebp
mov rax, qword [rax + 0x18]
mov r9, qword [rax]
lea rax, [r9 + 3]
lea rcx, [r9 + 2]
lea rdx, [r9 + 1]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea r8, str._b._b._b._b
mov edx, 0x28
lea rcx, [rsp + 0x58]
call fcn.1400d8050
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400c0a30
cmp byte [rdi + 0x169], 0
je 0x1401d1a4f
mov r8, rsi
lea rdx, [0x1402ae358]
mov rcx, rdi
call fcn.1400da210
mov bl, 1
jmp 0x1401d1a55
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.1400d9770
movzx eax, bl
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401d33b0
Capabilities:
Connect socket
Connect udp socket
Create udp socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov esi, 2
mov qword [rcx + 8], 0
mov rdi, rcx
mov edx, esi
mov ecx, esi
xor r8d, r8d
mov rbx, r9
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x1401d340b
mov rax, qword [rbx]
lea rdx, str.Failed_to_create_a_UDP_socket.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x1401d347e
lea rcx, [rdi + 0x28]
mov qword [rsp + 0x28], 0
mov word [rsp + 0x20], si
call fcn.1400bcff0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x35
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1401d347c
mov rax, qword [rbx]
lea rdx, str.Failed_to_specify_a_UDP_socket_destination_address.
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rdi]
call qword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov qword [rdi], 0xffffffffffffffff
jmp 0x1401d347e
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008b8a0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401d3cf0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14036a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rcx]
mov r10d, r8d
mov rdi, qword [rsp + 0x90]
mov rbp, rdx
mov rsi, rcx
cmp rax, 0xffffffffffffffff
jne 0x1401d3d38
mov rax, qword [rdi]
lea rdx, str.Cannot_send_to_invalid_UDP_socket
mov rcx, rdi
call qword [rax + 0x28]
xor al, al
jmp 0x1401d3e28
cmp dword [rcx + 0x10], 6
jl 0x1401d3d55
mov rax, qword [rdi]
lea rdx, str.Too_many_retries_for_this_nameserver.
mov rcx, rdi
call qword [rax + 0x28]
xor al, al
jmp 0x1401d3e28
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, r10d
mov ecx, eax
call fcn.1401d4280
test al, al
jne 0x1401d3d92
lea rdx, str.Waited__but_cannot_send_on_UDP_socket_without_waiting_longer.
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov qword [rsi], 0xffffffffffffffff
jmp 0x1401d3e28
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x48], rbx
mov ecx, 2
call fcn.1400f0e80
mov rcx, rbp
call fcn.1400c9610
movzx edx, byte [rsp + 0x30]
mov rcx, rbp
mov byte [rax], dl
movzx edx, byte [rsp + 0x31]
mov byte [rax + 1], dl
movsxd rdx, dword [rsi + 0x10]
movzx eax, byte [rsp + 0x30]
mov byte [rsi + rdx*2 + 0x14], al
movsxd rdx, dword [rsi + 0x10]
movzx eax, byte [rsp + 0x31]
mov byte [rsi + rdx*2 + 0x15], al
call fcn.1400c9940
mov rcx, rbp
mov ebx, eax
call fcn.1400c9610
mov rcx, qword [rsi]
mov rdx, rax
xor r9d, r9d
mov r8d, ebx
call qword [sym.imp.WS2_32.dll_send]
mov rbx, qword [rsp + 0x48]
cmp eax, 0xffffffff
jne 0x1401d3e23
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.1401a3fd0
lea rdx, str.Failed_to_send_DNS_query_on_UDP_socket.
jmp 0x1401d3d72
inc dword [rsi + 0x10]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b8a0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401dadf0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, r8
mov rcx, rdx
mov rsi, rdx
call fcn.1400b9c60
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1401dae42
add rcx, 0xc8
mov r9b, 1
mov qword [rsp + 0x20], rbx
mov r8, rsi
xor edx, edx
call fcn.14013e7e0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1401dae62
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1401e98e0
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x1401dae9b
add rcx, 0x550
mov qword [rsp + 0x20], rbx
mov r9b, 1
mov r8, rsi
xor edx, edx
call fcn.14013e7e0
mov dl, 0x2c
mov rcx, rsi
call fcn.1400b7b70
mov rcx, qword [rdi + 0x20]
add rcx, 0x570
jmp 0x1401dae20
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1401daede
add rcx, 0xa0
call fcn.1400c9940
mov rcx, qword [rdi + 0x28]
mov ebx, eax
add rcx, 0xa0
call fcn.1400c9610
mov rcx, rax
mov r8, rsi
mov edx, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400d63e0
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret