joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008970c
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x180089736
cmp dword [rdx], 0
jne 0x18008974c
test rbx, rbx
je 0x180089741
cmp dword [r8], 0
jne 0x18008974c
test rdi, rdi
je 0x180089798
cmp dword [r9], 0
je 0x180089798
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.18009c55c
test rdi, rdi
je 0x180089765
cmp dword [rdi], 0
jne 0x180089767
xor edi, edi
test rbx, rbx
je 0x180089771
cmp dword [rbx], 0
jne 0x180089773
xor ebx, ebx
test rsi, rsi
je 0x18008977d
cmp dword [rsi], 0
jne 0x18008977f
xor esi, esi
lea ecx, [rbp + 1]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
jmp 0x1800897a2
mov rcx, qword [rsp + 0x60]
call fcn.1800896cc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18008cc30
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rax - 0x18], xmm6
lea rcx, [rax - 0x38]
mov rdi, rdx
call fcn.18007358c
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.18008abfc
mov rcx, rdi
mov rsi, rax
call fcn.18008abfc
mov rbx, rax
mov rdx, rax
mov edi, 1
jmp 0x18008ccb1
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.18007358c
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.180073604
cmp rax, 0x3e8
ja 0x18008ccf4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rbx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x18008cc76
test rsi, rsi
je 0x18008cccf
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x18008ccdd
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x18008cd02
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x18008cd10
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, edi
jmp 0x18008ccdf
Function at 0x18008d13c
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, r9
xor edi, edi
and qword [r9], rdi
xor r13d, r13d
lea r9, [rax + 0x20]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x18008d29e
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x18008d28b
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18008d199
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r14, [rax + 1]
jmp 0x18008d19c
xor r14d, r14d
cmp dword [rbx + 4], 2
jne 0x18008d1aa
mov r15d, reloc.WS2_32.dll_recv
jmp 0x18008d1ba
cmp dword [rbx + 4], 0x17
jne 0x18008d252
mov r15d, 0x1c
cmp qword [rbx + 0x20], 0
je 0x18008d252
cmp qword [rbx + 0x10], 0
jbe 0x18008d252
cmp qword [rbx + 0x10], r15
jb 0x18008d252
lea rcx, [r14 + 0x30]
add rcx, r15
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x18008d261
mov ecx, dword [rbx]
mov r8, r15
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
and qword [rax + 0x18], 0
and qword [rax + 0x28], 0
mov dword [rax + 0xc], ecx
lea rcx, [rax + 0x30]
mov qword [rax + 0x20], rcx
mov dword [rax + 0x10], r15d
mov rdx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
test r14, r14
je 0x18008d23f
mov rcx, qword [rsi + 0x20]
mov r8, r14
add rcx, r15
mov qword [rsi + 0x18], rcx
mov rdx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
test rdi, rdi
cmove rdi, rsi
test r13, r13
je 0x18008d24f
mov qword [r13 + 0x28], rsi
mov r13, rsi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x18008d185
jmp 0x18008d266
mov ebp, 8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18008d276
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x18008d286
mov rcx, rdi
call fcn.18008d118
xor edi, edi
jmp 0x18008d298
test rdi, rdi
jne 0x18008d298
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov qword [r12], rdi
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18008d638
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
je 0x18008d669
cmp rax, 0xffffffffffffffff
cmovne rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x18008f1e0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x10], 0
mov rdi, r8
and qword [rbp - 0x18], 0
mov rbx, r9
and dword [rbp + 0x38], 0
mov rsi, rdx
mov r14, rcx
mov dword [rbp - 0x20], 4
mov rcx, rdi
mov dword [rbp - 0x1c], ebx
mov r8, r9
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [rbp + 0x40]
lea rcx, [rbp - 0x10]
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18008f2e3
mov edx, dword [rbp + 0x48]
lea rax, [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x18008f2c3
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x18008f2c3
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
and dword [rsp + 0x20], 0
lea r8, [rbp + 0x38]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x18008f2c3
mov eax, dword [rbp + 0x38]
cmp rbx, rax
jb 0x18008f2c3
and dword [rsp + 0x20], 0
lea r9, [rbp - 0x1c]
mov rcx, qword [rbp - 0x18]
mov r8, rdi
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x18008f2d2
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18008f2e3
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x1800903d8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, rcx
xor ecx, ecx
lea edi, [rbp + 1]
jmp 0x18009042a
mov r8d, edi
mov rdx, rbx
mov rcx, r14
mov rbp, rbx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x180090466
cmp edi, esi
je 0x180090466
cmp edi, 0x8000
ja 0x180090466
cmp edi, esi
jb 0x180090461
mov rcx, rbx
mov rdx, rdi
call qword [case.0x180078642.0]
mov rbx, rax
test rax, rax
jne 0x1800903fd
mov rcx, rbp
call qword [fcn.1800a348e]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x180090446
mov rcx, rbx
jmp 0x18009043e
jmp 0x1800903d8

Function at 0x18009046c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r14, rcx
xor ecx, ecx
lea edi, [rbp + 1]
jmp 0x18009042a
mov r8d, edi
mov rdx, rbx
mov rcx, r14
mov rbp, rbx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x180090466
cmp edi, esi
je 0x180090466
cmp edi, 0x8000
ja 0x180090466
cmp edi, esi
jb 0x180090461
mov rcx, rbx
mov rdx, rdi
call qword [case.0x180078642.0]
mov rbx, rax
test rax, rax
jne 0x1800903fd
mov rcx, rbp
call qword [fcn.1800a348e]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rbx
jmp 0x180090446
mov rcx, rbx
jmp 0x18009043e
jmp 0x1800903d8
Function at 0x180091efc
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rbx, rdx
mov r13, rcx
cmp r8, 4
jb 0x180092070
inc rbx
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rbx
sub rdi, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strspn]
mov rbp, rax
cmp rdi, rax
je 0x180092002
cmp byte [rbx + rax], 0x25
mov rdi, rax
jne 0x180092070
lea r15, [rbx + rax]
xor r14d, r14d
lea rdx, [0x1800adfc4]
lea rcx, [r15 + 1]
lea rsi, [r15 + 1]
lea r8d, [r14 + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x180091f91
lea rcx, [r15 + 3]
mov al, byte [rcx]
test al, al
je 0x180091f91
cmp al, 0x5d
cmovne rsi, rcx
mov al, byte [rsi]
test al, al
je 0x180092070
xor ecx, ecx
cmp al, 0x5d
je 0x180091fba
cmp rcx, 0xf
jge 0x180091fba
inc rsi
mov byte [rsp + rcx + 0x20], al
inc r14d
inc rcx
mov al, byte [rsi]
test al, al
jne 0x180091f9d
test r14d, r14d
je 0x180092070
cmp byte [rsi], 0x5d
jne 0x180092070
movsxd rax, r14d
cmp rax, 0x10
jae 0x180092091
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call qword [case.0x180078642.1]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x180091ff9
mov eax, 7
jmp 0x180092075
mov byte [rbx + rbp], 0x5d
mov byte [r15 + 1], 0
mov esi, reloc.WS2_32.dll_socket
mov byte [rdi + rbx], 0
mov ecx, esi
lea r8, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x180092070
lea r9d, [rsi + 0x17]
mov ecx, esi
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x180092068
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, rdi
jae 0x180092068
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
mov byte [rax + rbx + 1], 0
mov byte [rdi + rbx], 0x5d
xor eax, eax
jmp 0x180092075
mov eax, socket
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800a21a0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1800a2930
int3
Function at 0x1800934c8
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov byte [r8], 0
mov r13, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18009372e
cmp byte [rcx], 0
je 0x18009372e
test rdx, rdx
je 0x18009372e
cmp byte [rdx], 0
je 0x18009372e
lea rcx, [0x1800a9044]
xor r12d, r12d
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x18009375b
cmp byte [rdi], 0x5b
mov rcx, rdi
jne 0x180093595
lea edx, [r12 + 0x5d]
call sub.VCRUNTIME140.dll_strchr
mov rsi, rax
test rax, rax
je 0x18009372e
inc rdi
sub rsi, rdi
cmp rsi, 0x80
jae 0x18009372e
mov r8, rsi
lea rcx, [rsp + 0xb0]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rsi + 0xb0], r12b
lea rdi, [rsp + 0xb0]
mov r12d, 2
jmp 0x1800935c4
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
mov rsi, rax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800935ba
mov r12d, eax
jmp 0x1800935c4
cmp byte [rdi + rsi - 1], 0x2e
jne 0x1800935c4
dec rsi
mov al, byte [rbx]
jmp 0x180093726
xor ebp, ebp
cmp al, 0x20
je 0x1800935d7
mov cl, al
cmp al, 9
jne 0x1800935e2
inc rbx
mov al, byte [rbx]
mov cl, al
test al, al
jne 0x1800935cd
mov r9, rbx
test cl, cl
je 0x1800936fc
cmp cl, 0x2c
ja 0x180093602
movabs rax, 0x100100000200
bt rax, rcx
jb 0x18009360e
inc rbx
inc rbp
mov cl, byte [rbx]
test cl, cl
jne 0x1800935ed
test rbp, rbp
je 0x1800936fc
mov ecx, r12d
test r12d, r12d
je 0x180093698
sub ecx, 1
je 0x18009362d
cmp ecx, 1
jne 0x1800936fc
xor r14d, r14d
cmp rbp, 0x80
jae 0x1800936fc
mov r8, rbp
lea rcx, [rsp + 0x30]
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
lea edx, [r14 + 0x2f]
mov byte [rsp + rbp + 0x30], r14b
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_strchr
mov r15, rax
test rax, rax
je 0x180093679
lea rcx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov r14d, eax
mov byte [r15], 0
lea rdx, [rsp + 0x30]
mov r8d, r14d
mov rcx, rdi
cmp r12d, 2
jne 0x180093691
call fcn.180093800
jmp 0x1800936f8
call fcn.180093760
jmp 0x1800936f8
cmp byte [r9 + rbp - 1], 0x2e
lea rax, [rbp - 1]
cmovne rax, rbp
mov r8, rax
test rax, rax
je 0x1800936bb
cmp byte [r9], 0x2e
jne 0x1800936bb
inc r9
lea r8, [rax - 1]
cmp r8, rsi
jne 0x1800936d5
mov r8, rsi
mov rdx, rdi
mov rcx, r9
call fcn.180080030
test eax, eax
setne al
jmp 0x1800936f8
jae 0x1800936fc
mov rdx, rdi
sub rdx, r8
add rdx, rsi
cmp byte [rdx - 1], 0x2e
jne 0x1800936f6
mov rcx, r9
call fcn.180080030
test eax, eax
je 0x1800936f6
mov al, 1
jmp 0x1800936f8
xor al, al
test al, al
jne 0x18009375b
mov al, byte [rbx]
cmp al, 0x20
je 0x180093706
cmp al, 9
jne 0x18009370b
inc rbx
jmp 0x1800936fc
test al, al
je 0x180093722
cmp al, 0x2c
je 0x18009371d
mov byte [r13], 1
jmp 0x1800935c4
inc rbx
mov al, byte [rbx]
cmp al, 0x2c
je 0x18009371d
test al, al
jne 0x1800935cb
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800a21a0
mov rbx, qword [rsp + 0x198]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov al, 1
jmp 0x180093730
Function at 0x180093760
Capabilities:
Convert ip address from string

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov esi, 0x20
and dword [rax + 0x18], 0
mov edi, r8d
mov rbx, rdx
cmp r8d, esi
ja 0x1800937ee
mov rdx, rcx
lea r8, [rax + 0x20]
lea ecx, [rsi - 0x1e]
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800937ee
lea r8, [rsp + 0x40]
mov rdx, rbx
lea ecx, [rsi - 0x1e]
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800937ee
test edi, 0xffffffdf
je 0x1800937e4
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
sub esi, edi
or edx, 0xffffffff
mov cl, sil
xor eax, ebx
shl edx, cl
test edx, eax
sete al
jmp 0x1800937f0
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
jmp 0x1800937df
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180093800
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
test r8d, r8d
mov rsi, rdx
mov rdx, rcx
mov edi, 0x80
cmovne edi, r8d
mov ecx, reloc.WS2_32.dll_socket
mov ebx, edi
lea r8, [rsp + 0x30]
shr ebx, 3
and edi, 7
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800938aa
lea r8, [rsp + 0x20]
mov rdx, rsi
lea ecx, [rax + 0x16]
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800938aa
cmp ebx, 0x10
ja 0x1800938aa
jne 0x180093867
test edi, edi
jne 0x1800938aa
test ebx, ebx
je 0x180093881
mov r8d, ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800938aa
test edi, edi
je 0x1800938a6
movzx ecx, byte [rsp + rbx + 0x30]
mov edx, 0xff
movzx r8d, byte [rsp + rbx + 0x20]
xor r8d, ecx
mov ecx, 8
sub ecx, edi
shl edx, cl
test edx, r8d
je 0x1800938aa
mov al, 1
jmp 0x1800938ac
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800a21a0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180094ae4
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov rbx, rcx
mov eax, dword [0x1800cabf0]
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x180094b40
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.180098a1c
test al, al
je 0x180094b35
mov dword [0x1800cabf0], 2
jmp 0x180094b97
mov eax, 1
mov dword [0x1800cabf0], eax
cmp eax, 2
je 0x180094b97
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x180094b76
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x180094b97
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1800953f8
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rdi, rdx
mov rsi, rcx
mov r8d, dword [rbx + 0x14]
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180095445
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rbx + 0xe0]
mov rcx, rdi
mov r8d, eax
call fcn.1800958d4
jmp 0x180095463
mov rdx, rdi
mov rcx, rsi
call fcn.18009568c
mov rcx, qword [rbx + 0x98]
mov edx, 1
call fcn.18009c5bc
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180095580
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
or eax, 0xffffffff
test r8b, r8b
jne 0x1800955a5
mov r8d, dword [rcx + 0x14]
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_connect]
add rsp, 0x28
ret

Function at 0x1800955ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rax, qword [rcx]
mov rsi, rcx
mov rdi, r9
mov rcx, qword [rax + 0x10]
and dword [r9], 0
xor r9d, r9d
mov rcx, qword [rcx + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rax, 0xffffffffffffffff
jne 0x180095642
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x180095609
mov dword [rdi], 0x51
jmp 0x18009563e
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.18008b540
mov rcx, qword [rsi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.18007c340
mov rax, qword [rsi + 8]
mov dword [rax + 0xcdc], ebx
mov dword [rdi], 0x38
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800a21a0
add rsp, 0x130
pop rdi
pop rsi
pop rbx
ret

Function at 0x180095660
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, 0x29
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x18009568c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov r8d, 0x80
lea rcx, [rsp + 0x30]
xor edx, edx
mov dword [rsp + 0x20], r8d
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180095722
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.18008b540
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.18007c340
mov eax, 2
jmp 0x180095776
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x144]
lea r8, [rbx + 0x114]
lea rcx, [rsp + 0x30]
call fcn.18007cf1c
test al, al
jne 0x180095774
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.18008b540
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
jmp 0x180095710
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800a21a0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800959f4
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x20], 4
cmp byte [rcx + 0xa2c], al
lea r9, [rsp + 0x50]
mov rdi, rdx
mov rbx, rcx
setne al
mov edx, 0xffff
mov r8d, 8
mov dword [rsp + 0x50], eax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x180095a5e
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d
mov rcx, rbx
call fcn.18007c40c
jmp 0x180095af1
mov ecx, dword [rbx + 0x9b0]
mov dword [rsp + 0x58], 1
call fcn.18007dfec
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0x9b4]
call fcn.18007dfec
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9d, recv
imul ecx, eax, 0x3e8
mov edx, 0x98000004
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x180095af1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
mov r9d, eax
mov rcx, rbx
call fcn.18007c40c
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800a21a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x180095b0c
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1800c86c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r8d, 1
mov dword [rsp + 0x20], 4
mov rax, rdx
mov dword [rsp + 0x30], r8d
mov rbx, rcx
lea r9, [rsp + 0x30]
mov rcx, rax
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x180095b80
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.18008b540
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
call fcn.18007c40c
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800a21a0
add rsp, 0x150
pop rbx
ret
Function at 0x180099394
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
xor edx, edx
mov rdi, rcx
call sub.VCRUNTIME140.dll_memset
mov r9d, 2
mov r8d, ebx
mov rdx, rdi
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 2
add rsp, 0x20
pop rdi
ret