joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041990
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400419b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400419b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x141e5db28
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141e5dcaf
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141e5db59
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e5db3f
add dl, dl
jne 0x141e5db66
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e5dbc6
xor eax, eax
add dl, dl
jne 0x141e5db75
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141e5dc7d
add dl, dl
jne 0x141e5db86
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5db93
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5dba0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5dbad
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141e5dbba
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141e5db4e
mov eax, 1
add dl, dl
jne 0x141e5dbd6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141e5dbe3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e5dbcb
sub eax, ebx
mov ebx, 1
jne 0x141e5dc1c
mov ecx, 1
add dl, dl
jne 0x141e5dbfe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e5dc0b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e5dbf3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e5db4e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141e5dc38
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141e5dc45
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141e5dc2d
cmp eax, 0x7d00
jae 0x141e5dc6b
cmp eax, 0x500
jb 0x141e5dc66
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e5db4e
cmp eax, 0x7f
ja 0x141e5dc6e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141e5db4e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141e5dca2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141e5db4e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400010b0
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov rsi, rcx
cmp dword [0x1400c3408], 0xa
jl 0x1400010e2
mov eax, dword [0x1400c340c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400010e2
nop word cs:[rax + rax]
jmp 0x1400010e0
mov eax, 0x1a0
call fcn.14008c4b0
sub rsp, rax
mov rdx, rsp
mov byte [rsi], 0
sub rsp, 0x20
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
add rsp, 0x20
mov ecx, dword [0x1400c340c]
mov edx, dword [0x1400c3408]
cmp edx, 0xa
jl 0x140001191
lea r8d, [rcx + 1]
imul r8d, ecx
and r8d, 1
je 0x140001191
mov rdi, qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax]
mov eax, 0x1a0
call fcn.14008c4b0
sub rsp, rax
mov rdx, rsp
mov byte [rsi], 0
sub rsp, 0x20
mov cx, 2
call rdi
add rsp, 0x20
mov eax, 0x1a0
call fcn.14008c4b0
sub rsp, rax
mov rdx, rsp
mov byte [rsi], 0
sub rsp, 0x20
mov cx, 2
call rdi
add rsp, 0x20
mov ecx, dword [0x1400c340c]
mov edx, dword [0x1400c3408]
cmp edx, 0xa
jl 0x140001191
lea r8d, [rcx + 1]
imul r8d, ecx
and r8d, 1
jne 0x140001130
test eax, eax
je 0x14000119c
cmp edx, 0xa
jge 0x1400011b0
jmp 0x1400011c2
mov byte [rsi], 1
mov ecx, dword [0x1400c340c]
mov edx, dword [0x1400c3408]
cmp edx, 0xa
jl 0x1400011c2
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
je 0x1400011c2
nop dword [rax + rax]
jmp 0x1400011c0
mov rax, rsi
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004110
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push rbp
push rsi
push rax
mov rbp, rsp
cmp dword [0x1400c3530], 0xa
jl 0x140004130
mov eax, dword [0x1400c3534]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x14000416b
mov eax, 0x30
call fcn.14008c4b0
sub rsp, rax
mov rsi, rsp
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
cmp dword [0x1400c3530], 0xa
jl 0x14000418b
mov eax, dword [0x1400c3534]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000418b
mov eax, 0x30
call fcn.14008c4b0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
jmp 0x140004130
cmp dword [rsi + 0x20], 3
jbe 0x14000419a
mov al, 1
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400041b0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x10
lea rbp, [rsp + 0x10]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov edx, dword [0x1400c3538]
mov ecx, dword [0x1400c353c]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140004277
test eax, eax
je 0x140004277
mov eax, 0x100
call fcn.14008c4b0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rsi
call fcn.14000b3d0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14000b500
add rsp, 0x20
cmp dword [0x1400c3428], 0xa
jl 0x140004262
mov eax, dword [0x1400c342c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140004262
nop word cs:[rax + rax]
jmp 0x140004260
mov edx, dword [0x1400c3538]
mov ecx, dword [0x1400c353c]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140004286
test eax, eax
jne 0x140004312
jmp 0x140004286
mov eax, 0x100
call fcn.14008c4b0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rsi
call fcn.14000b3d0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14000b500
add rsp, 0x20
cmp dword [0x1400c3428], 0xa
jl 0x1400042f0
mov eax, dword [0x1400c342c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140004390
cmp dword [0x1400c353c], 0xa
jl 0x140004392
mov eax, dword [0x1400c3538]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140004392
mov eax, 0x100
call fcn.14008c4b0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rsi
call fcn.14000b3d0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rsp, 0x20
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14000b500
add rsp, 0x20
cmp dword [0x1400c3428], 0xa
jl 0x140004286
mov eax, dword [0x1400c342c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140004286
jmp 0x140004380
jmp 0x140004390
mov rax, rsi
mov rsp, rbp
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004520
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
sub rsp, 0x20
lea rsi, [rbp - 0x30]
mov rcx, rsi
call fcn.1400041b0
add rsp, 0x20
cmp dword [0x1400c3540], 0xa
lea rax, [rbp - 0x58]
mov qword [rbp - 8], rax
jge 0x14000466e
mov qword [rbp - 0x10], rsi
sub rsp, 0x20
lea rdx, str.C:_A_Za_z0_9__
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.140004780
add rsp, 0x20
mov rsi, qword [rbp - 0x10]
jmp 0x1400045bb
mov rdx, qword [rax + 0x10]
add rdx, rcx
sub rsp, 0x30
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
xor r8d, r8d
mov r9, qword [rbp - 8]
mov rsi, rax
call fcn.140050160
add rsp, 0x30
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x1400045c8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
add rdx, rcx
sub rsp, 0x30
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
xor r8d, r8d
mov r9, qword [rbp - 8]
call fcn.140050160
add rsp, 0x30
cmp dword [0x1400c3544], 0xa
jl 0x1400046e0
mov ecx, dword [0x1400c3548]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x1400046e0
mov rax, qword [rbp - 0x10]
cmp qword [rax + 0x18], 0x10
mov rcx, rax
jb 0x140004590
mov rcx, qword [rax]
jmp 0x140004590
mov eax, 0x20
call fcn.14008c4b0
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.14008c4b0
sub rsp, rax
mov qword [rbp - 8], rsp
sub rsp, 0x20
mov rcx, rsi
call fcn.1400041b0
add rsp, 0x20
cmp dword [0x1400c3540], 0xa
jl 0x14000455c
mov eax, dword [0x1400c354c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000455c
mov eax, 0x20
call fcn.14008c4b0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.1400041b0
add rsp, 0x20
mov eax, 0x20
call fcn.14008c4b0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.1400041b0
add rsp, 0x20
cmp dword [0x1400c3540], 0xa
jl 0x140004630
mov eax, dword [0x1400c354c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140004683
jmp 0x140004630
test al, al
mov rsi, qword [rbp - 0x10]
jne 0x14000470a
sub rsp, 0x20
mov rcx, qword [rbp - 8]
call fcn.140004880
mov rcx, rsi
call fcn.140001f00
add rsp, 0x20
mov al, 1
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400265a0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov ebx, edx
mov rsi, rcx
cmp dword [0x1400c3ff8], 0xa
jl 0x1400265f3
mov eax, dword [0x1400c3ffc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400265f3
movzx edi, bl
mov eax, reloc.WS2_32.dll_recv
call fcn.14008c4b0
sub rsp, rax
mov r8, rsp
mov dword [r8], edi
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x20
mov eax, reloc.WS2_32.dll_recv
call fcn.14008c4b0
sub rsp, rax
mov r8, rsp
movzx edi, bl
mov dword [r8], edi
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x20
cmp dword [0x1400c3ff8], 0xa
jl 0x140026639
mov eax, dword [0x1400c3ffc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400265ca
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026960
Capabilities:
Get socket status

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edx, dword [0x1400c4008]
mov ecx, dword [0x1400c400c]
mov rbx, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140026999
cmp dword [rax], 4
jne 0x140026aac
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1400269de
test eax, eax
je 0x1400269de
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
mov edx, dword [0x1400c4008]
mov ecx, dword [0x1400c400c]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x1400269f0
test eax, eax
jne 0x140026a2a
nop word [rax + rax]
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
mov edi, eax
cmp dword [0x1400c400c], 0xa
jl 0x140026a50
mov eax, dword [0x1400c4008]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140026a50
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
jmp 0x1400269f0
test edi, edi
jns 0x140026aac
nop word cs:[rax + rax]
call r14
mov edx, dword [0x1400c4008]
mov ecx, dword [0x1400c400c]
cmp ecx, 0xa
jl 0x140026990
lea r8d, [rdx + 1]
imul r8d, edx
and r8d, 1
je 0x140026990
call r14
call r14
cmp dword [0x1400c400c], 0xa
jl 0x140026a60
mov eax, dword [0x1400c4008]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140026a8a
jmp 0x140026a60
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140028720
Capabilities:
Get socket status

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edx, dword [0x1400c4098]
mov r8d, dword [0x1400c409c]
mov rbx, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop word [rax + rax]
mov eax, dword [0x1400c40a0]
mov ecx, dword [0x1400c40a4]
cmp r8d, 0xa
jl 0x140028780
lea r8d, [rdx + 1]
imul r8d, edx
and r8d, 1
jne 0x140028815
nop word cs:[rax + rax]
cmp ecx, 0xa
jl 0x140028790
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400287ca
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov edi, eax
mov eax, dword [0x1400c40a0]
mov ecx, dword [0x1400c40a4]
cmp ecx, 0xa
jl 0x1400287f0
lea edx, [rax + 1]
imul edx, eax
and edx, 1
je 0x1400287f0
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
jmp 0x140028790
cmp dword [0x1400c409c], 0xa
jl 0x140028930
mov edx, dword [0x1400c4098]
lea r8d, [rdx + 1]
imul r8d, edx
and r8d, 1
je 0x140028930
lea edx, [rax + 1]
imul edx, eax
and edx, 1
jmp 0x140028880
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov edx, dword [0x1400c40a0]
mov ecx, dword [0x1400c40a4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140028890
test eax, eax
je 0x140028890
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
jmp 0x140028820
cmp ecx, 0xa
jl 0x140028820
test edx, edx
jne 0x14002885a
jmp 0x140028820
cmp ecx, 0xa
jl 0x1400288a0
test eax, eax
jne 0x1400288da
nop dword [rax]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov eax, dword [0x1400c40a0]
mov ecx, dword [0x1400c40a4]
lea edx, [rax + 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jl 0x140028900
test edx, edx
je 0x140028900
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
jmp 0x1400288a0
cmp dword [0x1400c409c], 0xa
jl 0x140028780
mov r8d, dword [0x1400c4098]
lea r9d, [r8 + 1]
imul r9d, r8d
and r9d, 1
jne 0x140028880
jmp 0x140028780
test edi, edi
jns 0x14002894d
call r14
cmp dword [rax], 4
mov edx, dword [0x1400c4098]
mov r8d, dword [0x1400c409c]
je 0x140028750
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140028ac0
Capabilities:
Get socket status

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140028afb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
mov edi, eax
cmp dword [0x1400c40b0], 0xa
jl 0x140028b32
mov eax, dword [0x1400c40b4]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140028ae0
cmp dword [0x1400c40b8], 0xa
jl 0x140028bac
mov eax, dword [0x1400c40bc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140028bac
nop dword [rax]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
mov ecx, dword [0x1400c40b4]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400c40b0], 0xa
jl 0x140028afb
test eax, eax
je 0x140028afb
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
jmp 0x140028b50
test edi, edi
jns 0x140028bdb
call r14
cmp dword [0x1400c40b8], 0xa
jl 0x140028bd2
mov ecx, dword [0x1400c40bc]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140028bd2
call r14
jmp 0x140028bb0
cmp dword [rax], 4
je 0x140028afb
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140028de0
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [sym.imp.WS2_32.dll_send]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140028e10
cmp dword [rax], 4
jne 0x140028e96
nop word cs:[rax + rax]
mov rax, qword [rsi + 0x18]
mov r9d, dword [rax]
mov rax, qword [rsi + 0x10]
mov r8d, dword [rax]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call rbx
mov edi, eax
cmp dword [0x1400c40c8], 0xa
jl 0x140028e68
mov eax, dword [0x1400c40cc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140028e68
mov rax, qword [rsi + 0x18]
mov r9d, dword [rax]
mov rax, qword [rsi + 0x10]
mov r8d, dword [rax]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call rbx
jmp 0x140028e10
test edi, edi
jns 0x140028e96
nop dword [rax]
call r14
cmp dword [0x1400c40c8], 0xa
jl 0x140028dfc
mov ecx, dword [0x1400c40cc]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140028dfc
call r14
jmp 0x140028e70
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140028eb0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
mov r14, r9
mov rsi, r8
mov edi, edx
mov rbx, rcx
movzx eax, word [rcx]
cmp eax, 0x17
je 0x140028f4a
cmp eax, 2
jne 0x140028fda
movzx ecx, word [rbx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov edx, dword [0x1400c40d0]
mov eax, dword [0x1400c40d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140028f6f
test ecx, ecx
je 0x140028f6f
mov r15, qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, word [rbx + 2]
call r15
movzx eax, ax
mov dword [r14], eax
movzx ecx, word [rbx + 2]
call r15
movzx eax, ax
mov dword [r14], eax
mov edx, dword [0x1400c40d0]
mov eax, dword [0x1400c40d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140028f6f
test ecx, ecx
jne 0x140028f10
jmp 0x140028f6f
movzx ecx, word [rbx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov edx, dword [0x1400c40d0]
mov eax, dword [0x1400c40d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140028fcf
test ecx, ecx
je 0x140028fcf
lea r14, [rsp + 0x47]
mov r8d, 0x401
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, edi
mov r8, r14
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov edx, dword [0x1400c40d0]
mov eax, dword [0x1400c40d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140028fe1
test ecx, ecx
jne 0x140029043
jmp 0x140028fe1
xor ebp, ebp
jmp 0x14002909b
lea r14, [rsp + 0x47]
mov r8d, 0x401
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, edi
mov r8, r14
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
sete bpl
cmp dword [0x1400c40d4], 0xa
jl 0x14002908a
mov ecx, dword [0x1400c40d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x14002908a
lea r14, [rsp + 0x47]
mov r8d, 0x401
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, edi
mov r8, r14
mov r9d, 0x401
call qword [sym.imp.WS2_32.dll_getnameinfo]
jmp 0x140028fe1
test eax, eax
jne 0x14002909b
lea rdx, [rsp + 0x47]
mov rcx, rsi
call fcn.1400290b0
mov eax, ebp
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002df00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
cmp dword [0x1400c4310], 0xa
jl 0x14002df75
nop dword [rax + rax]
mov eax, dword [0x1400c4314]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14002df75
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140028600
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140028600
add rsp, 0x20
cmp dword [0x1400c4310], 0xa
jge 0x14002df20
jmp 0x14002df75
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140028600
add rsp, 0x20
mov eax, reloc.WS2_32.dll_recv
call fcn.14008c4b0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140028600
add rsp, 0x20
cmp dword [0x1400c4310], 0xa
jl 0x14002dfb4
mov ecx, dword [0x1400c4314]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x14002df60
test rax, rax
je 0x14002e164
jns 0x14002dfd9
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
add rsp, 0x20
cmp dword [rax], 9
jne 0x14002dfd9
xor eax, eax
jmp 0x14002e166
mov ecx, dword [0x1400c4060]
mov edx, dword [0x1400c4064]
mov r14, qword [sym.imp.WS2_32.dll_recv]
mov r15, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop word cs:[rax + rax]
cmp edx, 0xa
jl 0x14002e010
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
jne 0x14002e04b
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9d, 2
call r14
add rsp, 0x20
mov ebx, eax
mov ecx, dword [0x1400c4060]
mov edx, dword [0x1400c4064]
cmp edx, 0xa
jl 0x14002e070
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
je 0x14002e070
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9d, 2
call r14
add rsp, 0x20
jmp 0x14002e010
test ebx, ebx
jns 0x14002e094
sub rsp, 0x20
call r15
add rsp, 0x20
cmp dword [rax], 4
mov ecx, dword [0x1400c4060]
mov edx, dword [0x1400c4064]
je 0x14002e000
cmp dword [0x1400c4310], 0xa
jl 0x14002e15d
mov eax, dword [0x1400c4314]
lea r8d, [rax + 1]
imul r8d, eax
and r8d, 1
je 0x14002e15d
nop dword [rax]
cmp edx, 0xa
jl 0x14002e0d0
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
jne 0x14002e10c
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9d, 2
call r14
add rsp, 0x20
mov ecx, dword [0x1400c4060]
mov edx, dword [0x1400c4064]
cmp edx, 0xa
jl 0x14002e130
lea r8d, [rcx + 1]
imul r8d, ecx
and r8d, 1
je 0x14002e130
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
mov r8d, 1
mov r9d, 2
call r14
add rsp, 0x20
jmp 0x14002e0d0
test eax, eax
jns 0x14002e000
sub rsp, 0x20
call r15
add rsp, 0x20
cmp dword [rax], 4
mov ecx, dword [0x1400c4060]
mov edx, dword [0x1400c4064]
je 0x14002e0c0
jmp 0x14002e000
test ebx, ebx
setg al
jmp 0x14002e166
mov al, 1
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret