joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046020
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
test dword [rcx + 0x68], 0x2000
mov rbx, rcx
je 0x14004603d
call sub.ntdll.dll_NtTestAlert
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 0x88]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
call fcn.14004edb0
cmp dword [rsp + 0x50], 0
je 0x1400461fe
mov rax, qword [rbx + 0x140]
or dword [rbx + 0x68], 0x2000
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x140]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, rbx
call fcn.14004aca0
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140043570]
mov r9, qword [rbx + 0x140]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
movsxd rcx, eax
call fcn.140172320
mov ebp, 0x2fe0
mov rsi, rax
test eax, eax
jne 0x1400461d0
mov rcx, qword gs:[0x58]
mov edi, ebp
add rdi, qword [rcx]
mov rax, qword [rdi]
test rax, rax
jne 0x140046100
call fcn.140176664
cmp dword [rax], 0xe8
jne 0x140046221
mov rax, qword [rdi]
test rax, rax
jne 0x140046119
call fcn.140176664
cmp dword [rax], 0xe8
jne 0x1400461d0
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x140272fb0]
mov rcx, qword [rbx + 0xe0]
jne 0x14004614a
mov qword [0x140272fb0], rcx
jmp 0x14004615f
mov rax, qword [rbx + 0xe8]
mov qword [rax + 0xe0], rcx
mov rcx, qword [0x140272fb0]
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
je 0x14004617b
mov rax, qword [rbx + 0xe8]
mov qword [rdx + 0xe8], rax
jmp 0x14004618e
test rcx, rcx
je 0x14004618e
mov rax, qword [rbx + 0xe8]
mov qword [rcx + 0xe8], rax
xor eax, eax
lea rcx, [0x140272f60]
mov qword [rbx + 0xe0], rax
mov qword [rbx + 0xe8], rax
call fcn.14002ec90
mov eax, dword [rbx + 0x68]
btr eax, 0xd
bts eax, 0x1a
mov dword [rbx + 0x68], eax
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x1400461d0
mov rcx, rbx
call fcn.140042af0
cmp dword [rsp + 0x50], 0
je 0x1400461fe
test esi, esi
jne 0x14004620c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rbp + rcx]
test rax, rax
jne 0x1400461f6
call fcn.140176664
cmp dword [rax], 0xe8
jne 0x14004620c
mov eax, dword [rbx + 0x68]
test al, 0x10
jne 0x14004620c
btr eax, 0xd
mov dword [rbx + 0x68], eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
lea rdx, str.WriteFileEx_failed:__m
mov ecx, 0x580000
call fcn.140029170
int3
Function at 0x1400472b0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov word [rsp + 0x48], dx
mov eax, 0x10624dd3
imul r8d
movsxd rbx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [0x140272f88]
mov word [rsp + 0x4a], dx
test rax, rax
je 0x140047304
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov ecx, ebx
call rax
mov ebx, eax
jmp 0x140047449
cmp qword [0x140272f38], 0
mov qword [rsp + 0x40], rdi
je 0x140047360
mov rax, qword gs:[0x58]
mov edx, 0x23d4
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x140047360
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rdi, rbx
mov rbx, qword [rax + rbx*8]
call fcn.14002ec90
test dword [rbx + 0x68], 0x10000000
jne 0x140047363
mov ebx, 1
jmp 0x140047365
mov rdi, rbx
xor ebx, ebx
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
test ebx, ebx
mov rbx, qword [rax + rdi*8]
jne 0x1400473d2
call fcn.14002ec90
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x1400473a4
cmp dword [rbx + 0xc], 2
jne 0x1400473a4
cmp word [rbx + 0x6c], 0
jne 0x1400473ef
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140172320
mov rbx, rax
jmp 0x140047444
call fcn.14002ec90
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x140047419
cmp dword [rbx + 0xc], 2
jne 0x140047419
cmp word [rbx + 0x6c], 0
je 0x140047419
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x14004740e
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_shutdown
or ebx, 0xffffffff
jmp 0x140047444
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140172320
mov ebx, eax
mov rdi, qword [rsp + 0x40]
test ebx, ebx
je 0x140047465
lea r8, str.SO_LINGER
mov ecx, 0x580003
lea rdx, str.failed_setsockopt__s_:__m
call fcn.140028ca0
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140047470
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x10], edx
push rsi
sub rsp, 0x30
movsxd rbp, ecx
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rsi, [rbp*8]
lea rcx, [0x140272f60]
mov rbx, qword [rsi + rax]
call fcn.14002ec90
test byte [rbx + 0x68], 1
jne 0x1400474c9
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [0x140272f88]
mov qword [rsp + 0x40], rdi
or edi, 0xffffffff
test rax, rax
je 0x1400474fa
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea edx, [rdi + 7]
mov ecx, ebp
lea r8d, [rdi + 2]
call rax
jmp 0x1400475db
cmp qword [0x140272f38], 0
je 0x14004754e
mov rax, qword gs:[0x58]
mov edx, 0x23d4
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x14004754e
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rsi + rax]
call fcn.14002ec90
test dword [rbx + 0x68], 0x10000000
jne 0x14004754e
mov ebx, 1
jmp 0x140047550
xor ebx, ebx
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
test ebx, ebx
mov rbx, qword [rsi + rax]
call fcn.14002ec90
cmp qword [rbx + 0x40], 0
je 0x1400475b2
cmp dword [rbx + 0xc], 2
jne 0x1400475b2
cmp word [rbx + 0x6c], 0
je 0x1400475b2
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400475a8
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_shutdown
mov eax, edi
jmp 0x1400475db
movsxd rcx, dword [rbx + 0x70]
lea r9, [rsp + 0x48]
mov r8d, 1
mov dword [rsp + 0x20], 4
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140172320
test eax, eax
je 0x14004761d
mov rax, qword [0x140272f38]
mov ecx, 3
test rax, rax
mov edx, 7
cmovne ecx, edx
jne 0x140047619
cmp ecx, 5
jbe 0x140047605
cmp dword [0x140273480], ecx
jl 0x140047619
or ecx, 0x580000
lea rdx, str.failed_setsockopt_TCP_NODELAY_:__m
call fcn.140028ca0
mov edi, eax
mov eax, edi
jmp 0x14004761f
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140047640
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x140272f60]
mov dword [rsp + 0x30], edx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rbx, [rbx*8]
lea rcx, [0x140272f60]
mov rdi, qword [rbx + rax]
call fcn.14002ec90
mov eax, dword [rdi + 0x68]
test al, 1
je 0x140047737
test esi, esi
jne 0x1400476d3
test al, al
jns 0x1400476d3
movsxd rcx, dword [rdi + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
movsxd rcx, eax
call fcn.140172320
test rax, rax
je 0x1400476d3
lea rdx, str.WSAEventSelect:__m
mov ecx, 0x580003
call fcn.140028ca0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rbx + rax]
call fcn.14002ec90
movsxd rcx, dword [rbx + 0x70]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd rcx, eax
call fcn.140172320
test eax, eax
je 0x140047737
lea rdx, str.failed_ioctl_FIOBIO_:__m
mov ecx, 0x580003
call fcn.140028ca0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
and dword [rdi + 0x68], 0xffffff7f
mov rbx, qword [rsp + 0x38]
neg esi
mov rsi, qword [rsp + 0x40]
sbb eax, eax
and eax, 0x80
or dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140048e00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x140272f60]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rax + rbx*8]
call fcn.14002ec90
cmp dword [rbx + 0xc], 2
jne 0x140048f70
cmp esi, 0x10
jae 0x140048e82
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048e69
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x140048e9c
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x140048f70
cmp word [rbx + 0x6c], 0
je 0x140048f70
mov rcx, rbx
call fcn.14004a9f0
test eax, eax
jne 0x140048e6f
mov eax, dword [rdi + 4]
test eax, eax
je 0x140048f0e
cmp eax, dword [rbx + 0x9c]
je 0x140048f0e
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048ef5
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x140048f53
movzx eax, word [rdi + 2]
test ax, ax
je 0x140048f53
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140048ff0
cmp dword [0x14027305c], 0
je 0x140048f8e
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.14002f180
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140172320
cmp dword [0x14027305c], 0
mov rdi, rax
je 0x140048fb7
call fcn.14002f620
test edi, edi
jne 0x140048fdd
cmp dword [rbx + 0xc], 2
jne 0x140048fdd
cmp word [rbx + 0x94], di
jne 0x140048fdd
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140048ff0
test eax, eax
jne 0x140048e6f
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140172320
test rax, rax
je 0x14004902a
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140048ff0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x140272f60]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rax + rbx*8]
call fcn.14002ec90
cmp dword [rbx + 0xc], 2
jne 0x140048f70
cmp esi, 0x10
jae 0x140048e82
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048e69
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x140048e9c
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x140048f70
cmp word [rbx + 0x6c], 0
je 0x140048f70
mov rcx, rbx
call fcn.14004a9f0
test eax, eax
jne 0x140048e6f
mov eax, dword [rdi + 4]
test eax, eax
je 0x140048f0e
cmp eax, dword [rbx + 0x9c]
je 0x140048f0e
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048ef5
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x140048f53
movzx eax, word [rdi + 2]
test ax, ax
je 0x140048f53
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140048ff0
cmp dword [0x14027305c], 0
je 0x140048f8e
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.14002f180
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140172320
cmp dword [0x14027305c], 0
mov rdi, rax
je 0x140048fb7
call fcn.14002f620
test edi, edi
jne 0x140048fdd
cmp dword [rbx + 0xc], 2
jne 0x140048fdd
cmp word [rbx + 0x94], di
jne 0x140048fdd
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140048ff0
test eax, eax
jne 0x140048e6f
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140172320
test rax, rax
je 0x14004902a
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400498d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x68]
or rdi, 0xffffffffffffffff
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
bt eax, 0x1a
jae 0x140049925
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x14004991a
call fcn.140176664
mov dword [rax], 0x2746
jmp 0x140049ad2
cmp word [rcx + 0x6c], 0
je 0x1400499e5
mov rcx, qword [rcx + 0x80]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.14004e940
movsxd rax, dword [rsp + 0x50]
mov r9d, r14d
movsxd rcx, dword [rbx + 0x70]
cmp rsi, rax
mov rdx, qword [rsp + 0x28]
cmovb rax, rsi
mov r8d, eax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140172320
mov rsi, rax
test eax, eax
jns 0x140049ad2
mov rcx, qword gs:[0x58]
mov eax, 0x2fe0
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x14004999e
call fcn.140176664
cmp dword [rax], 0x2738
jne 0x140049ad2
mov rcx, qword [rbx + 0x80]
mov edx, esi
call fcn.14004e9b0
cmp dword [rsp + 0x70], 0
jne 0x1400499dd
mov rcx, qword [rbx + 0x80]
mov r8d, esi
mov rdx, rbp
call fcn.1400450c0
mov rcx, qword [rbx + 0x80]
call fcn.14004ea10
movsxd rax, esi
jmp 0x140049ad5
test eax, 0x4080
jne 0x140049a27
bt eax, 0xa
jb 0x1400499ff
call fcn.1400454a0
test eax, eax
jne 0x1400498fb
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jae 0x140049a27
nop dword [rax + rax]
mov edx, 1
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jb 0x140049a10
bt eax, 0xe
jae 0x140049a97
mov rcx, qword [rbx + 0x80]
call fcn.14004ebc0
test eax, eax
je 0x140049a75
cmp dword [rsp + 0x70], 0
mov edi, eax
jne 0x140049a75
mov rcx, qword [rbx + 0x80]
mov rdx, rbp
cdqe
cmp rax, rsi
cmovb rsi, rax
mov r8d, esi
call fcn.1400450c0
test byte [rbx + 0x68], 0x20
mov edi, eax
jne 0x140049a7b
mov rcx, qword [rbx + 0x80]
call fcn.14004ea10
test byte [rbx + 0x68], 0x20
je 0x140049a8b
mov rcx, qword [rbx + 0x80]
call fcn.14004ebc0
test eax, eax
jne 0x140049a92
and dword [rbx + 0x68], 0xffffbfff
movsxd rax, edi
jmp 0x140049ad5
test al, al
mov edx, 0x2fe0
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
jns 0x140049ac2
test rax, rax
jne 0x140049aba
call fcn.140176664
mov dword [rax], 0x2733
jmp 0x140049ad2
test rax, rax
jne 0x140049acc
call fcn.140176664
mov dword [rax], 0x2714
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140049fe0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rdi
sub rsp, 0x70
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov r13d, r9d
mov qword [rax - 0x38], r15
call fcn.14004e8a0
mov r10, qword [rsp + 0xb0]
mov rdi, rax
movzx ebx, word [rsi + 0x94]
mov ebp, 0x1c
mov r12d, dword [rsi + 0x9c]
mov dword [rsp + 0x90], reloc.WS2_32.dll_recv
movzx eax, word [r10 + 2]
mov r15d, dword [r10 + 4]
mov word [rsp + 0xb0], ax
test bx, bx
jne 0x14004a0ef
xor eax, eax
mov qword [rsp + 0x58], r14
movsxd r14, dword [rsi + 0x90]
lea r8d, [rbp - 0xc]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov eax, 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rcx, r14
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], ebx
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140172320
test rax, rax
je 0x14004a0b2
lea rdx, str.bind_failed__m
mov ecx, 0x580003
call fcn.140028ca0
jmp 0x14004a0ea
lea r8, [rsp + 0x30]
mov rcx, r14
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140172320
test rax, rax
je 0x14004a0e5
lea rdx, str.getsockname_failed__m
mov ecx, 0x580003
call fcn.140028ca0
jmp 0x14004a0ea
movzx ebx, word [rsp + 0x42]
mov r14, qword [rsp + 0x58]
mov r8d, dword [rsp + 0xa0]
mov rcx, rdi
mov rdx, qword [rsp + 0x98]
mov word [rsi + 0x94], bx
call fcn.14004e790
movzx r8d, word [rsp + 0xb0]
mov r9d, r12d
movzx edx, bx
mov dword [rsp + 0x20], r15d
mov rcx, rdi
call fcn.1400508a0
mov r9b, reloc.WS2_32.dll_recvfrom
mov r8d, r15d
mov edx, r12d
mov rcx, rdi
call fcn.1400507a0
cmp word [rsi + 0x6c], 0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x68]
je 0x14004a165
mov edx, dword [rsi + 0x68]
mov rcx, rdi
and edx, 0x200000
shl edx, 4
call fcn.14004e820
mov ebp, 0x20
lea r8, [rsp + 0x90]
mov rcx, rdi
lea rdx, [rsp + 0x38]
call fcn.14004e8f0
movsxd r8, dword [rsp + 0x90]
mov r9d, r13d
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140049bf0
mov r13, qword [rsp + 0x60]
mov ebx, eax
mov rsi, qword [rsp + 0xa8]
test eax, eax
jle 0x14004a1a7
sub ebx, ebp
mov rcx, rdi
call fcn.14004e760
movsxd rax, ebx
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
Function at 0x14004a1c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rbx, ecx
mov rsi, r8
lea rcx, [0x140272f60]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea r14, [rbx*8]
lea rcx, [0x140272f60]
mov rbx, qword [r14 + rax]
call fcn.14002ec90
cmp qword [rbx + 0x40], 0
je 0x14004a27b
cmp dword [rbx + 0xc], 2
jne 0x14004a27b
cmp word [rbx + 0x6c], 0
je 0x14004a27b
cmp dword [rsi], 0x10
jae 0x14004a24c
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x14004a241
call fcn.140176664
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
jmp 0x14004a2c2
mov dword [rsi], reloc.WS2_32.dll_recv
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov eax, 2
mov word [rdi], ax
mov eax, dword [rbx + 0x9c]
mov dword [rdi + 4], eax
movzx eax, word [rbx + 0x94]
mov word [rdi + 2], ax
xor eax, eax
jmp 0x14004a2c2
lea rcx, [0x140272f60]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [r14 + rax]
call fcn.14002ec90
cmp qword [rbx + 0x40], 0
jne 0x14004a2b7
movsxd rcx, dword [rbx + 0x70]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x14004a2ba
or eax, 0xffffffff
movsxd rcx, eax
call fcn.140172320
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14004a320
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x140272f60]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140272fe0]
lea rcx, [0x140272f60]
mov rbx, qword [rax + rbx*8]
call fcn.14002ec90
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x14004a447
test al, 1
je 0x14004a3b7
cmp qword [rbx + 0x40], 0
je 0x14004a386
cmp dword [rbx + 0xc], 2
jne 0x14004a386
cmp word [rbx + 0x6c], 0
jne 0x14004a3b7
mov rax, qword [rsp + 0x68]
mov r9d, edi
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
movsxd rcx, eax
call fcn.140172320
jmp 0x14004a432
test eax, 0x80000004
jne 0x14004a3f8
cmp qword [rbx + 0x40], 0
je 0x14004a3d2
cmp dword [rbx + 0xc], 2
jne 0x14004a3d2
cmp word [rbx + 0x6c], 0
jne 0x14004a3f8
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x76d
lea rdx, str.vsock_recvfrom
mov ecx, 0x580202
call fcn.140028ed0
cdqe
jmp 0x14004a432
cmp dword [rbx + 0xc], 0
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x14004a419
mov dword [rsp + 0x20], 0
call fcn.1400498d0
jmp 0x14004a432
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140049af0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.recvfrom_from_non_packet_socket
mov ecx, 0x580000
call fcn.140029170
int3