joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140107630
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.14010a0b0
jmp fcn.14010c200

Function at 0x140107650
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x1401077e0
sub edx, 0x40
je 0x1401076f2
sub edx, 0x20
je 0x1401077a0
sub edx, 0x80
je 0x140107730
cmp edx, 0x80
jne 0x140107807
mov rax, qword [0x1402bd8a0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1402bd8a8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1402bd8b0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1402bd8b8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402bd8c0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1402bd8c8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1402bd8d0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1402bd8d8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x1402bd5e0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1402bd5e8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1402bd5f0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1402bd5f8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402bd600]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1402bd608]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1402bd610]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1402bd618]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x140109610
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.1401d455c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14010981c
mov rcx, rax
call fcn.14002be30
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.140011910
mov byte [0x1402b5fd0], al
call fcn.140109120
test edi, edi
jle 0x140109817
mov ecx, edi
sub ecx, 0xa0
je 0x1401097f0
sub ecx, 0x40
je 0x1401097b0
sub ecx, 0x20
je 0x140109770
sub ecx, 0x80
je 0x140109700
cmp ecx, 0x80
jne 0x140109817
mov rax, qword [0x1402bd8a0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1402bd8a8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1402bd8b0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1402bd8b8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1402bd8c0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1402bd8c8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1402bd8d0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1402bd8d8]
jmp 0x140109754
mov rax, qword [0x1402bd5e0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1402bd5e8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1402bd5f0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1402bd5f8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1402bd600]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1402bd608]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1402bd610]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1402bd618]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x140109817
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x140109813
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x140109813
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x14010981f
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140109850
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.140109610
Function at 0x14010faf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14010fb28
xor al, al
jmp 0x14010fc00
lea rcx, [rsp + 0x20]
call fcn.14010f030
test edi, edi
je 0x14010fb4e
test rbx, rbx
je 0x14010fb4e
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401103e0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x14010fb9d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14010fbb0
lea rcx, [rsp + 0x30]
call fcn.14010f130
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable._ckSha3.0
mov qword [rsp + 0x20], rax
call fcn.14002bf40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d42a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14010fc70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14010fca8
xor al, al
jmp 0x14010fd77
lea rcx, [rsp + 0x20]
call fcn.14010f030
test edi, edi
je 0x14010fcce
test rbx, rbx
je 0x14010fcce
mov r9b, select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401103e0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x14010fd1d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, setsockopt
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14010fd30
lea rcx, [rsp + 0x30]
call fcn.14010f130
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.14002bf40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d42a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14010fde0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14010fe18
xor al, al
jmp 0x14010fef0
lea rcx, [rsp + 0x20]
call fcn.14010f030
test edi, edi
je 0x14010fe3e
test rbx, rbx
je 0x14010fe3e
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401103e0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x14010fe8d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, ntohs
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14010fea0
lea rcx, [rsp + 0x30]
call fcn.14010f130
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.14002bf40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d42a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14010ff60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x14010ff98
xor al, al
jmp 0x140110079
lea rcx, [rsp + 0x20]
call fcn.14010f030
test edi, edi
je 0x14010ffbe
test rbx, rbx
je 0x14010ffbe
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.1401103e0
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x14011000d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140110020
lea rcx, [rsp + 0x30]
call fcn.14010f130
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.14002bf40
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d42a0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140110310
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x140110385
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x140110370
test r8b, r8b
je 0x1401103a5
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140110391
mov rcx, rdi
call fcn.14010f130
test sil, sil
je 0x1401103d0
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1401103c0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1401103e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x40], rbp
movzx ecx, byte [rcx + 0x1a0]
mov esi, r8d
mov qword [rsp + 0x50], r14
mov rdi, rdx
movzx r14d, r9b
test cl, cl
je 0x1401104a7
movzx eax, r14b
movzx r9d, sil
shl al, 3
sub al, cl
movzx r8d, al
cmp r8d, esi
cmovbe r9d, r8d
xor dl, dl
lea r8, [rbx + rcx]
test r9b, r9b
je 0x140110447
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + r8 + 0xd8], al
cmp dl, r9b
jb 0x140110431
add byte [rbx + 0x1a0], dl
movzx ecx, byte [rbx + 0x1a0]
movzx eax, dl
add rdi, rax
movzx eax, dl
sub esi, eax
mov eax, r14d
shl eax, 3
cmp ecx, eax
jne 0x1401104a7
test r14b, r14b
je 0x140110494
lea rcx, [rbx + 0x10]
mov rdx, r14
nop word [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140110480
mov rcx, rbx
add rcx, 0x10
call fcn.14010f130
mov byte [rbx + 0x1a0], 0
mov ebp, r14d
shl ebp, 3
cmp esi, ebp
jb 0x14011050e
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov r12d, ebp
nop
test r14b, r14b
je 0x1401104f2
mov r8, rdi
lea rax, [rbx + 0x10]
sub r8, rbx
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + rax - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401104e0
lea rcx, [rbx + 0x10]
call fcn.14010f130
sub esi, ebp
add rdi, r12
cmp esi, ebp
jae 0x1401104c0
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test esi, esi
je 0x140110537
nop
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + rbx + 0xd8], al
movzx eax, dl
cmp eax, esi
jb 0x140110520
add byte [rbx + 0x1a0], dl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140113050
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x14011305c
mov al, 1
ret
jmp fcn.1400ca6a0

Function at 0x140114690
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x2a0], 2
je fcn.1401155f0
jmp fcn.140115700
Function at 0x140114eb0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x140114edf
xor al, al
jmp 0x140114f70
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x140114f50
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x140114f55
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d42a0
add rsp, 0x80
pop rbx
ret

Function at 0x1401153f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x140115491
mov r8d, dword [rcx + 0xdc]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14011548c
and r8d, 0xfffff000
mov dword [rcx + 0xdc], r8d
cmp byte [rdx + 0x169], 0
je 0x140115465
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_RCVBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xdc]
lea rdx, str.recvBufSize
mov rcx, rsi
call fcn.14004f530
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xdc]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401154a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x140115541
mov r8d, dword [rcx + 0xd8]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14011553c
and r8d, 0xfffff000
mov dword [rcx + 0xd8], r8d
cmp byte [rdx + 0x169], 0
je 0x140115515
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_SNDBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd8]
lea rdx, str.sendBufSize
mov rcx, rsi
call fcn.14004f530
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xd8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401155f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea r8, str.ck_getsockname_ipv4
mov rdx, r9
lea rcx, [rsp + 0x38]
call fcn.14004ed30
nop
mov rcx, rsi
call fcn.14003a460
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x1401156bf
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x14011569b
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov rcx, rsi
call fcn.140036100
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x1401156d1
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.140117f50
jmp 0x1401156cf
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.14004ee50
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d42a0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140115700
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea r8, str.ck_getsockname_ipv6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.14004ed30
nop
mov rcx, rsi
call fcn.14003a460
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x1401157cf
mov dword [rsp + 0x20], 0x1c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x1401157ab
mov rcx, rsi
call fcn.14003a460
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140116ec0
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x1401157e1
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname_ipv6
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.140117f50
jmp 0x1401157df
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.14004ee50
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401d42a0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140117d80
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.1401d4b90
sub rsp, rax
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140076ef0
mov rdx, rbx
mov rcx, rdi
call fcn.140077070
test al, al
je 0x140117ded
mov byte [rdi + 0x29], 1
mov rax, qword [rbx]
lea rdx, str.Wait_for_data_on_socket_aborted_by_app
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x140117eaf
cmp qword [rsi + 0x298], 0xffffffffffffffff
jne 0x140117e12
mov rax, qword [rbx]
lea rdx, str.Cannot_wait_for_socket_data:_not_connected__invalid_socket_
mov rcx, rbx
call qword [rax + 0x28]
mov byte [rdi + 0x2a], 1
xor al, al
jmp 0x140117eaf
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
call fcn.14002be60
lea r15, vtable.ckFdSet.0
mov qword [rsp + 0x40], r15
mov ebx, 0x3004bc8d
mov dword [rsp + 0x50], ebx
mov dword [rbp + 0xfe0], ebx
mov dword [rsp + 0x58], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf60], xmm0
movups xmmword [rbp + 0xf70], xmm0
movups xmmword [rbp + 0xf80], xmm0
movups xmmword [rbp + 0xf90], xmm0
movups xmmword [rbp + 0xfa0], xmm0
movups xmmword [rbp + 0xfb0], xmm0
movups xmmword [rbp + 0xfc0], xmm0
movups xmmword [rbp + 0xfd0], xmm0
movsxd r9, dword [rsi + 0x298]
test r9d, r9d
jns 0x140117ed5
mov byte [rdi + 0x2a], 1
xor bl, bl
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x50], r14d
mov dword [rbp + 0xfe0], r14d
lea rcx, [rsp + 0x40]
call fcn.14002bf40
movzx eax, bl
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.1401d42a0
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + r14*8 + 0x60], r9
inc dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x140117e8f
jne 0x140117f07
mov byte [rdi + 0x28], 1
jmp 0x140117e8f
mov bl, 1
jmp 0x140117e91

Function at 0x140117f10
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xdc]
je 0x140117f2a
mov dword [rcx + 0xdc], edx
test edx, edx
je 0x140117f2a
mov rdx, r8
jmp fcn.1401153f0
ret

Function at 0x140117f30
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd8]
je 0x140117f4a
mov dword [rcx + 0xd8], edx
test edx, edx
je 0x140117f4a
mov rdx, r8
jmp fcn.1401154a0
ret