joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001860
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x490
xor r9d, r9d
movdqu xmm2, xmmword [rdx]
lea rsi, [rsp + 0x70]
movups xmmword [rsp + 0x30], xmm2
mov rbp, rcx
mov rbx, rdx
movdqu xmm3, xmmword [rdx + 0x10]
lea r12, [rsp + 0x30]
mov rdi, r8
mov rcx, rsi
mov rdx, r12
lea r8, [rsp + 0x5f]
mov byte [rsp + 0x5f], 0
movups xmmword [rsp + 0x40], xmm3
call sym.tb_tcp_recv8
mov edx, dword [rsp + 0x80]
test edx, edx
je 0x1400018d8
mov rdi, rbp
mov ecx, 0x83
mov rax, rbp
rep movsq qword [rdi], qword [rsi]
add rsp, 0x490
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movdqu xmm4, xmmword [rbx]
xor r9d, r9d
mov rdx, r12
mov rcx, rsi
lea r8, [rdi + 0x22d0]
movups xmmword [rsp + 0x30], xmm4
movdqu xmm5, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm5
call sym.tb_tcp_recv8
mov eax, dword [rsp + 0x80]
test eax, eax
jne 0x1400018b6
cmp dword [rdi + 0x22d0], 2
jbe 0x140001928
mov dword [rsp + 0x80], 0
jmp 0x1400018b6
movdqu xmm5, xmmword [rbx]
lea r8, [rsp + 0x60]
mov rdx, r12
mov rcx, rsi
lea r9, [rsp + 0x68]
mov qword [rsp + 0x60], rdi
movups xmmword [rsp + 0x30], xmm5
movdqu xmm5, xmmword [rbx + 0x10]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x68], 0
movups xmmword [rsp + 0x40], xmm5
call sym.tb_tcp_unsized_recv
mov rdx, qword [rsp + 0x68]
mov r10d, dword [rsp + 0x80]
movzx r8d, byte [rsp + 0x5f]
test rdx, rdx
je 0x140001a68
lea rax, [rdx - 1]
cmp rax, 0xe
jbe 0x140001a7f
movd xmm1, r8d
mov rcx, rdx
mov rax, rdi
punpcklbw xmm1, xmm1
and rcx, 0xfffffffffffffff0
punpcklwd xmm1, xmm1
add rcx, rdi
pshufd xmm1, xmm1, 0
nop
movdqu xmm0, xmmword [rax]
add rax, 0x10
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rcx
jne 0x1400019b0
mov rax, rdx
and rax, 0xfffffffffffffff0
test dl, 0xf
je 0x140001a68
mov r9, rdx
sub r9, rax
lea rcx, [r9 - 1]
cmp rcx, 6
jbe 0x140001a16
movzx ecx, r8b
lea r11, [rdi + rax]
mov ch, cl
movq xmm1, qword [r11]
movd xmm4, ecx
mov rcx, r9
and rcx, 0xfffffffffffffff8
pshuflw xmm0, xmm4, 0
pxor xmm0, xmm1
add rax, rcx
and r9d, 7
movq qword [r11], xmm0
je 0x140001a68
lea rcx, [rax + 1]
xor byte [rdi + rax], r8b
cmp rcx, rdx
jae 0x140001a68
xor byte [rdi + rcx], r8b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x140001a68
xor byte [rdi + rcx], r8b
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x140001a68
xor byte [rdi + rcx], r8b
lea rcx, [rax + 4]
cmp rcx, rdx
jae 0x140001a68
xor byte [rdi + rcx], r8b
lea rcx, [rax + 5]
cmp rcx, rdx
jae 0x140001a68
add rax, 6
xor byte [rdi + rcx], r8b
cmp rax, rdx
jae 0x140001a68
xor byte [rdi + rax], r8b
test r10d, r10d
jne 0x1400018b6
mov rax, qword [rsp + 0x60]
mov byte [rax + rdx], 0
jmp 0x140001914
xor eax, eax
jmp 0x1400019d5
Function at 0x140001a90
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x470
mov rbp, rcx
mov rcx, r8
mov r13, rdx
mov rdi, r8
call sym.strlen
lea rsi, [rsp + 0x50]
lea r14, [rsp + 0x30]
mov r12, rax
call sym.rand
movdqu xmm2, xmmword [r13]
xor r9d, r9d
mov rcx, rsi
movsxd rbx, eax
cdq
imul rbx, rbx, 0xffffffff80808081
movups xmmword [rsp + 0x30], xmm2
movdqu xmm3, xmmword [r13 + 0x10]
movups xmmword [rsp + 0x40], xmm3
shr rbx, 0x20
add ebx, eax
sar ebx, 7
sub ebx, edx
mov edx, ebx
shl edx, 8
sub edx, ebx
sub eax, edx
mov rdx, r14
movzx r8d, al
mov ebx, eax
call sym.tb_tcp_send8
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x140001c50
test r12, r12
je 0x140001c09
lea rax, [r12 - 1]
mov ecx, ebx
cmp rax, 0xe
jbe 0x140001c5d
movd xmm0, ebx
mov rax, r12
mov rdx, rdi
punpcklbw xmm0, xmm0
and rax, 0xfffffffffffffff0
punpcklwd xmm0, xmm0
add rax, rdi
pshufd xmm0, xmm0, 0
nop dword [rax]
movdqu xmm1, xmmword [rdx]
add rdx, 0x10
pxor xmm1, xmm0
movups xmmword [rdx - 0x10], xmm1
cmp rax, rdx
jne 0x140001b58
mov rax, r12
and rax, 0xfffffffffffffff0
test r12b, 0xf
je 0x140001c09
mov r8, r12
sub r8, rax
lea rdx, [r8 - 1]
cmp rdx, 6
jbe 0x140001bbe
movzx edx, cl
lea r9, [rdi + rax]
mov dh, dl
movq xmm1, qword [r9]
movd xmm4, edx
mov rdx, r8
and rdx, 0xfffffffffffffff8
pshuflw xmm0, xmm4, 0
pxor xmm0, xmm1
add rax, rdx
and r8d, 7
movq qword [r9], xmm0
je 0x140001c09
lea rdx, [rax + 1]
xor byte [rdi + rax], cl
cmp rdx, r12
jae 0x140001c09
xor byte [rdi + rdx], cl
lea rdx, [rax + 2]
cmp rdx, r12
jae 0x140001c09
xor byte [rdi + rdx], cl
lea rdx, [rax + 3]
cmp rdx, r12
jae 0x140001c09
xor byte [rdi + rdx], cl
lea rdx, [rax + 4]
cmp rdx, r12
jae 0x140001c09
xor byte [rdi + rdx], cl
lea rdx, [rax + 5]
cmp rdx, r12
jae 0x140001c09
add rax, 6
xor byte [rdi + rdx], cl
cmp rax, r12
jae 0x140001c09
xor byte [rdi + rax], cl
movdqu xmm5, xmmword [r13]
mov r9, r12
mov r8, rdi
mov rdx, r14
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm5
movdqu xmm5, xmmword [r13 + 0x10]
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x40], xmm5
call sym.tb_tcp_sized_send
mov rax, rbp
add rsp, 0x470
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, 0x83
mov rdi, rbp
rep movsq qword [rdi], qword [rsi]
jmp 0x140001c38
xor eax, eax
jmp 0x140001b7e
Function at 0x140001c70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x488
xor r9d, r9d
movdqu xmm2, xmmword [rdx]
lea rsi, [rsp + 0x60]
movups xmmword [rsp + 0x30], xmm2
mov rbx, rcx
mov rdi, rdx
movdqu xmm3, xmmword [rdx + 0x10]
lea rbp, [rsp + 0x30]
mov rcx, rsi
mov byte [rsp + 0x57], 0
mov qword [rsp + 0x4c0], r8
mov rdx, rbp
lea r8, [rsp + 0x57]
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x40], xmm3
call sym.tb_tcp_recv8
mov edx, dword [rsp + 0x70]
test edx, edx
je 0x140001cf0
mov rdi, rbx
mov ecx, 0x83
mov rax, rbx
rep movsq qword [rdi], qword [rsi]
add rsp, 0x488
pop rbx
pop rsi
pop rdi
pop rbp
ret
movdqu xmm4, xmmword [rdi]
lea r9, [rsp + 0x58]
mov rdx, rbp
mov rcx, rsi
lea r8, [rsp + 0x4c0]
movups xmmword [rsp + 0x30], xmm4
movdqu xmm5, xmmword [rdi + 0x10]
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x40], xmm5
call sym.tb_tcp_unsized_recv
mov eax, dword [rsp + 0x70]
test eax, eax
jne 0x140001ccf
mov r8, qword [rsp + 0x58]
movzx r9d, byte [rsp + 0x57]
mov rcx, qword [rsp + 0x4c0]
test r8, r8
je 0x140001e31
lea rax, [r8 - 1]
cmp rax, 0xe
jbe 0x140001e3e
movd xmm1, r9d
mov rax, r8
mov rdx, rcx
punpcklbw xmm1, xmm1
and rax, 0xfffffffffffffff0
punpcklwd xmm1, xmm1
add rax, rcx
pshufd xmm1, xmm1, 0
nop dword [rax]
movdqu xmm0, xmmword [rdx]
add rdx, 0x10
pxor xmm0, xmm1
movups xmmword [rdx - 0x10], xmm0
cmp rdx, rax
jne 0x140001d78
mov rax, r8
and rax, 0xfffffffffffffff0
test r8b, 0xf
je 0x140001e31
mov r10, r8
sub r10, rax
lea rdx, [r10 - 1]
cmp rdx, 6
jbe 0x140001ddf
movzx edx, r9b
lea r11, [rcx + rax]
mov dh, dl
movq xmm1, qword [r11]
movd xmm4, edx
mov rdx, r10
and rdx, 0xfffffffffffffff8
pshuflw xmm0, xmm4, 0
pxor xmm0, xmm1
add rax, rdx
and r10d, 7
movq qword [r11], xmm0
je 0x140001e31
lea rdx, [rax + 1]
xor byte [rcx + rax], r9b
cmp rdx, r8
jae 0x140001e31
xor byte [rcx + rdx], r9b
lea rdx, [rax + 2]
cmp rdx, r8
jae 0x140001e31
xor byte [rcx + rdx], r9b
lea rdx, [rax + 3]
cmp rdx, r8
jae 0x140001e31
xor byte [rcx + rdx], r9b
lea rdx, [rax + 4]
cmp rdx, r8
jae 0x140001e31
xor byte [rcx + rdx], r9b
lea rdx, [rax + 5]
cmp rdx, r8
jae 0x140001e31
add rax, 6
xor byte [rcx + rdx], r9b
cmp rax, r8
jae 0x140001e31
xor byte [rcx + rax], r9b
mov dword [rsp + 0x70], 0
jmp 0x140001ccf
xor eax, eax
jmp 0x140001d9e
Function at 0x1400020e0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x518
xor eax, eax
pxor xmm0, xmm0
xor r9d, r9d
mov rbx, rcx
mov rbp, r8
lea rdi, [rsp + 0x88]
mov ecx, 0xc
lea r8, [rsp + 0x80]
lea rsi, [rsp + 0xf0]
mov qword [rsp + 0x84], 0
mov qword [rsp + 0xe0], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400021c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rbp], rax
call sym.tb_err.constprop.0
mov rax, rbx
add rsp, 0x518
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov r9d, 0x400
mov qword [rsp + 0x58], 0
mov edi, eax
lea rax, [rsp + 0x58]
mov ecx, 0x1300
mov qword [rsp + 0x30], 0
mov r8d, edi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x58]
mov r8d, edi
mov rcx, rsi
mov edx, 4
mov rdi, rbx
call sym.tb_err
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0x83
mov rax, rbx
rep movsq qword [rdi], qword [rsi]
add rsp, 0x518
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140003b10
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
mov rdx, r8
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140003b50
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sym.tb_err.constprop.0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
mov rcx, rbx
mov r8d, eax
call sym.tb_win32_err_to_tb_err
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140003c90
Capabilities:
Copy file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140003cc8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sym.tb_err.constprop.0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
mov rcx, rbx
mov r8d, eax
call sym.tb_win32_err_to_tb_err
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140003cf0
Capabilities:
Create directory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x898
xor eax, eax
lea rbx, [rsp + 0x50]
mov r8, rdx
mov rbp, rcx
mov ecx, 0x83
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x140003d40
mov rdi, rbp
mov rsi, rbx
mov ecx, 0x83
mov rax, rbp
rep movsq qword [rdi], qword [rsi]
add rsp, 0x898
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0x470]
mov r9d, 0x400
xor edx, edx
mov edi, eax
lea rax, [rsp + 0x48]
mov ecx, 0x1300
mov qword [rsp + 0x48], 0
mov r8d, edi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x48]
mov r8d, edi
mov rcx, rsi
mov edx, 1
mov rdi, rbx
call sym.tb_err
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0x83
rep movsq qword [rdi], qword [rsi]
jmp 0x140003d22

Function at 0x140004160
Capabilities:
Create process on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x938
xor eax, eax
pxor xmm0, xmm0
xor r9d, r9d
mov rbx, rcx
mov rsi, r8
lea rdi, [rsp + 0x88]
mov ecx, 0xc
lea r8, [rsp + 0x80]
lea rbp, [rsp + 0xf0]
mov qword [rsp + 0x84], 0
mov qword [rsp + 0xe0], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004250
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsi], rax
call sym.tb_err.constprop.0
mov rdi, rbx
mov rsi, rbp
mov ecx, 0x83
mov rax, rbx
rep movsq qword [rdi], qword [rsi]
add rsp, 0x938
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, [rsp + 0x510]
mov r9d, 0x400
xor edx, edx
mov edi, eax
lea rax, [rsp + 0x58]
mov ecx, 0x1300
mov qword [rsp + 0x58], 0
mov r8d, edi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x58]
mov r8d, edi
mov rcx, rsi
mov edx, 4
mov rdi, rbp
call sym.tb_err
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0x83
rep movsq qword [rdi], qword [rsi]
jmp 0x14000422c
Function at 0x140004bb0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
pxor xmm0, xmm0
mov r14, r8
mov r15, rcx
mov rcx, rdx
mov r13, rdx
mov rsi, r9
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x38], 0
call sym.strlen
mov rcx, r14
mov rdi, rax
call sym.strlen
mov rbx, rax
cmp rdi, 0xf
ja 0x140004d38
cmp rbx, 5
ja 0x140004d5c
lea rcx, [rsi + 8]
lea r8, [rdi + 1]
mov rdx, r13
call sym.memcpy
lea r8, [rbx + 1]
lea rcx, [rsi + 0x18]
mov rdx, r14
call sym.memcpy
lea r9, [rsp + 0x38]
mov rdx, r14
mov rcx, r13
mov rax, qword [0x140010690]
pxor xmm0, xmm0
lea r8, [rsp + 0x40]
mov qword [rsi], 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x140004d80
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140004cfd
mov rdi, qword [sym.imp.WS2_32.dll_socket]
mov rbp, qword [sym.imp.WS2_32.dll_connect]
mov r12, qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140004cc5
mov rdx, qword [rbx + 0x20]
mov r8d, dword [rbx + 0x10]
call rbp
cmp eax, 0xffffffff
jne 0x140004cf8
mov rcx, qword [rsi]
call r12
mov rbx, qword [rbx + 0x28]
mov qword [rsi], 0xffffffffffffffff
test rbx, rbx
je 0x140004cf8
mov ecx, dword [rbx + 4]
mov edx, dword [rbx + 8]
mov r8d, dword [rbx + 0xc]
call rdi
mov qword [rsi], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x140004ca0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r15
mov r8d, eax
call sym.tb_win32_err_to_tb_err
jmp 0x140004d20
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp qword [rsi], 0xffffffffffffffff
je 0x140004da0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call sym.tb_err.constprop.0
mov rax, r15
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0x585
lea rdx, str.._cli_.._common_tb.h
lea rcx, str.sizeof_sock__addr___addr_len
call qword [sym.imp.msvcrt.dll__assert]
cmp rbx, 5
jbe 0x140004c12
mov r8d, 0x586
lea rdx, str.._cli_.._common_tb.h
lea rcx, str.sizeof_sock__port___port_len
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x140004c12
mov ecx, eax
call dbg.gai_strerrorA
movsxd r8, ebx
mov edx, 2
mov rcx, r15
mov r9, rax
call sym.tb_err
jmp 0x140004d20
mov qword [rsp + 0x28], r14
lea r9, str.Could_not_connect_to__s:_s
mov r8d, 1
mov rcx, r15
mov qword [rsp + 0x20], r13
mov edx, 2
call sym.tb_err
jmp 0x140004d20
Function at 0x140004e00
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [0x140010690]
pxor xmm0, xmm0
movups xmmword [rsp + 0x44], xmm0
mov r13, rcx
mov r14, rdx
mov rbx, r9
mov dword [rsp + 0xd0], r8d
lea r9, [rsp + 0x38]
xor ecx, ecx
lea r8, [rsp + 0x40]
movups xmmword [rsp + 0x54], xmm0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test eax, eax
jne 0x140004f80
mov r15, qword [rsp + 0x38]
test r15, r15
je 0x140004f12
mov rsi, qword [sym.imp.WS2_32.dll_socket]
mov rdi, qword [sym.imp.WS2_32.dll_setsockopt]
mov rbp, qword [sym.imp.WS2_32.dll_bind]
mov r12, qword [sym.imp.WS2_32.dll_closesocket]
nop word [rax + rax]
mov edx, dword [r15 + 8]
mov ecx, dword [r15 + 4]
mov r8d, dword [r15 + 0xc]
call rsi
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140004f04
mov dword [rsp + 0x34], 1
lea r9, [rsp + 0x34]
mov r8d, 4
mov rcx, rax
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call rdi
cmp eax, 0xffffffff
je 0x140004f67
mov rdx, qword [r15 + 0x20]
mov rcx, qword [rbx]
mov r8d, dword [r15 + 0x10]
call rbp
cmp eax, 0xffffffff
jne 0x140004f0d
mov rcx, qword [rbx]
call r12
mov qword [rbx], 0xffffffffffffffff
mov r15, qword [r15 + 0x28]
test r15, r15
jne 0x140004ea0
mov r15, qword [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140004fa0
mov edx, dword [rsp + 0xd0]
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x140004f5e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call sym.tb_err.constprop.0
mov rax, r13
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r13
mov r8d, eax
call sym.tb_win32_err_to_tb_err
jmp 0x140004f4a
mov ecx, eax
call dbg.gai_strerrorA
movsxd r8, esi
mov edx, 2
mov rcx, r13
mov r9, rax
call sym.tb_err
jmp 0x140004f4a
mov qword [rsp + 0x20], r14
lea r9, str.Could_not_bind_port__s
mov edx, 2
mov rcx, r13
mov r8d, 1
call sym.tb_err
jmp 0x140004f4a

Function at 0x1400050a0
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov edi, dword [rsp + 0x90]
mov r14, rcx
mov rsi, r8
mov rbx, r9
test r9, r9
je 0x140005120
mov r12, qword [rdx]
mov rbp, qword [sym.imp.WS2_32.dll_send]
mov r13d, r9d
xor r15d, r15d
jmp 0x1400050ea
cdqe
add r15, rax
cmp r15, rbx
jae 0x140005120
mov r8d, r13d
lea rdx, [rsi + r15]
mov r9d, edi
mov rcx, r12
sub r8d, r15d
call rbp
cmp eax, 0xffffffff
jne 0x1400050e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r14
mov r8d, eax
call sym.tb_win32_err_to_tb_err
jmp 0x140005130
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call sym.tb_err.constprop.0
mov rax, r14
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005150
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [sym.imp.msvcrt.dll__time64]
mov rbp, qword [rdx]
mov r13d, dword [rsp + 0xb0]
mov rsi, r9
mov qword [rsp + 0x90], rcx
mov rdi, r8
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 0x300
test rsi, rsi
je 0x140005278
add rax, 0xa
mov r14, qword [sym.imp.WS2_32.dll_recv]
xor ebx, ebx
lea r12, [rsp + 0x30]
mov qword [rsp + 0x28], rax
jmp 0x1400051cf
movsxd rdx, r15d
add rbx, rdx
cmp rbx, rsi
jae 0x140005278
mov r8d, 0x2710
mov edx, 1
mov rcx, r12
call sym.WSAPoll
test eax, eax
jle 0x140005240
mov r8d, esi
lea rdx, [rdi + rbx]
mov r9d, r13d
mov rcx, rbp
sub r8d, ebx
call r14
mov r15d, eax
cmp eax, 0xffffffff
je 0x140005240
test eax, eax
jne 0x1400051c0
xor ecx, ecx
mov rax, qword [rsp + 0x20]
call rax
cmp qword [rsp + 0x28], rax
jge 0x1400051c0
mov rcx, qword [rsp + 0x90]
mov r8d, 1
mov edx, 2
lea r9, str.Timed_out
call sym.tb_err
jmp 0x14000525b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, qword [rsp + 0x90]
mov edx, 2
mov r8d, eax
call sym.tb_win32_err_to_tb_err
mov rax, qword [rsp + 0x90]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x90]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call sym.tb_err.constprop.0
jmp 0x14000525b

Function at 0x140005290
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [sym.imp.WS2_32.dll_send]
mov rbp, qword [rdx]
mov byte [rsp + 0x60], r8b
mov r12, rcx
mov ebx, r9d
lea rdi, [rsp + 0x60]
jmp 0x1400052c4
test eax, eax
jne 0x140005300
mov r9d, ebx
mov r8d, 1
mov rdx, rdi
mov rcx, rbp
call rsi
cmp eax, 0xffffffff
jne 0x1400052c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r12
mov r8d, eax
call sym.tb_win32_err_to_tb_err
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sym.tb_err.constprop.0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140005320
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [sym.imp.WS2_32.dll_send]
xor r14d, r14d
mov esi, 2
mov r12, qword [rdx]
rol r8w, 8
mov r13, rcx
lea rbp, [rsp + 0x70]
mov ebx, r9d
mov word [rsp + 0x70], r8w
jmp 0x14000536b
cdqe
add r14, rax
cmp r14, 1
ja 0x1400053a0
mov r8d, esi
lea rdx, [rbp + r14]
mov r9d, ebx
mov rcx, r12
sub r8d, r14d
call rdi
cmp eax, 0xffffffff
jne 0x140005360
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r13
mov r8d, eax
call sym.tb_win32_err_to_tb_err
jmp 0x1400053b0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call sym.tb_err.constprop.0
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x1400053d0
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [sym.imp.WS2_32.dll_send]
xor r14d, r14d
mov esi, 4
mov r12, qword [rdx]
bswap r8d
mov r13, rcx
mov dword [rsp + 0x70], r8d
mov ebx, r9d
lea rbp, [rsp + 0x70]
jmp 0x140005413
cdqe
add r14, rax
cmp r14, 3
ja 0x140005448
mov r8d, esi
lea rdx, [rbp + r14]
mov r9d, ebx
mov rcx, r12
sub r8d, r14d
call rdi
cmp eax, 0xffffffff
jne 0x140005408
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r13
mov r8d, eax
call sym.tb_win32_err_to_tb_err
jmp 0x140005458
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call sym.tb_err.constprop.0
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140005470
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [sym.imp.WS2_32.dll_send]
xor r14d, r14d
mov esi, 8
mov r12, qword [rdx]
bswap r8
mov r13, rcx
mov qword [rsp + 0x70], r8
mov ebx, r9d
lea rbp, [rsp + 0x70]
jmp 0x1400054b3
cdqe
add r14, rax
cmp r14, 7
ja 0x1400054e8
mov r8d, esi
lea rdx, [rbp + r14]
mov r9d, ebx
mov rcx, r12
sub r8d, r14d
call rdi
cmp eax, 0xffffffff
jne 0x1400054a8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov rcx, r13
mov r8d, eax
call sym.tb_win32_err_to_tb_err
jmp 0x1400054f8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call sym.tb_err.constprop.0
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret