joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
mov r11, rcx
add r8d, edx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x140019773
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
mov rax, rsi
imul rax, rax, 0xfffffffffffffff4
add rdi, rax
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
shl ecx, 8
add r9d, r10d
add ecx, eax
movzx eax, byte [r11 + 5]
add edx, r8d
shl ecx, 8
add r11, 0xc
add ecx, eax
movzx eax, byte [r11 - 2]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 - 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 - 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 - 0xa]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 - 9]
shl ecx, 8
mov r8d, edx
add ecx, eax
movzx eax, byte [r11 - 0xb]
rol r8d, 4
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 - 0xc]
shl ecx, 8
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
add ebx, ecx
ror r10d, 0xd
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
add r10d, ebx
rol r8d, 4
xor r8d, ecx
dec rsi
jne 0x140019690
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x1400197fc
lea rcx, sym.NsGpuCNMiner.exe_.t_bF._Ay7_Z__E9S6_euXX:_ghT:_5mi
mov eax, dword [rcx + rdi*4 + 0x1985c]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
xor edx, ebx
rol eax, 0xb
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
xor ecx, edx
rol eax, 4
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov eax, r8d
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x140020a90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov ecx, dword [0x140139d20]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edi, edi
test rax, rax
je 0x140020ae9
mov rax, qword [rax + 8]
test rax, rax
je 0x140020ae9
mov rcx, qword [rax]
test rcx, rcx
je 0x140020ae9
mov qword [rax], rdi
movzx eax, byte [rcx]
cmp rax, rbx
jb 0x140020ae4
mov byte [rcx + rbx], al
mov rax, rcx
add rsp, 0x28
pop rdi
pop rbx
ret
call fcn.140089328
lea rcx, [rbx + 1]
call fcn.1400893b4
cmp rbx, 0xff
ja 0x140020afe
movzx edi, bl
mov byte [rax + rbx], dil
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x140020b10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov ecx, dword [0x140139d20]
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140020b3d
mov r8, qword [rax + 8]
jmp 0x140020b40
xor r8d, r8d
cmp rdi, 0xff
ja 0x140020b64
test r8, r8
je 0x140020b64
cmp qword [r8], 0
jne 0x140020b64
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
mov qword [r8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.140089328

Function at 0x140020ec0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
xor r8d, r8d
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140139cf4], eax
test eax, eax
je 0x140020f1b
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, qword [rbx + 8]
lea rcx, [fcn.1400010a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x140021720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x14002176d
call fcn.140021820
mov dword [rsp + 0x28], ebx
call fcn.140070830
mov rcx, qword [rsp + 0x28]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400217f1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov ecx, dword [0x140139d20]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x38]
mov ecx, dword [0x140139d20]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r8, rsi
mov rcx, rdi
call fcn.140021b10
test rax, rax
je 0x1400217cd
cmp rbx, 0xffffffffffffffff
je 0x1400217bd
inc rbx
mov r8, rsi
mov rcx, rdi
call fcn.140021b10
test rax, rax
jne 0x1400217b4
mov rdx, qword [rsp + 0x48]
mov ecx, dword [0x140139d20]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400217ee
call fcn.140089328
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140022110
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1f0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x208], rbx
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov eax, 1
lock xadd dword [0x140132e30], eax
inc eax
cmp eax, 1
jne 0x14002216c
lea ecx, [rax + 1]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140132e34], eax
xor edi, edi
mov ecx, edi
lock xadd dword [0x140132e34], ecx
test ecx, ecx
je 0x140022182
call fcn.140001d40
nop
mov ecx, 0x38
call fcn.1400893b4
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400221a8
or r9, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rax
call fcn.140048c10
mov rdi, rax
mov qword [rbx + 8], rdi
mov rcx, qword [rdi + 0x30]
mov qword [rbx + 0x10], rcx
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140088760
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rdi
ret
Function at 0x140022330
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rdi, r9
mov rbp, rdx
mov r14, rcx
mov esi, r15d
cmp rcx, 0xffffffffffffffff
je 0x140022464
test r8b, r8b
je 0x1400223b8
test byte [rdx], 8
je 0x1400223b8
mov dword [rsp + 0x60], r15d
call fcn.140070830
or byte [rbp], 8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea r9, [rsp + 0x60]
mov edx, 0xffff
mov r8d, 0x80
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
call fcn.140070830
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x1400223b8
call fcn.140070830
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
test esi, esi
je 0x140022464
call fcn.140070830
cmp qword [rdi + 8], rax
jne 0x140022400
cmp dword [rdi], 0x2733
je 0x140022413
call fcn.140070830
cmp qword [rdi + 8], rax
jne 0x140022460
cmp dword [rdi], 0x4d5
jne 0x140022460
lea r8, [rsp + 0x60]
mov edx, 0x8004667e
mov rcx, r14
mov dword [rsp + 0x60], r15d
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rbp], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x30]
mov qword [rdi], rcx
mov qword [rdi + 8], rbx
test esi, esi
jne 0x14002247a
mov dword [rsp + 0x30], r15d
call fcn.140070830
mov rcx, qword [rsp + 0x30]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, esi
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400224a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov byte [rsp + 0x18], r8b
push rsi
sub rsp, 0x30
mov rsi, r9
mov rbp, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400224ee
mov dword [rsp + 0x20], 0x2719
call fcn.140070830
mov rcx, qword [rsp + 0x20]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
xor ecx, ecx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea r8, [rsp + 0x50]
mov edx, 0x8004667e
mov rcx, rbx
mov dword [rsp + 0x50], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x20]
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
js 0x1400224dc
mov dword [rsp + 0x20], 0
call fcn.140070830
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
or byte [rbp], 2
mov rbp, qword [rsp + 0x58]
mov al, 1
add rsp, 0x30
pop rsi
ret

Function at 0x140022570
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400225b3
mov dword [rsp + 0x20], 0x2719
call fcn.140070830
mov rcx, qword [rsp + 0x20]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
or eax, ebx
jmp 0x140022605
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x20]
mov qword [rdi], rcx
mov qword [rdi + 8], rbx
test esi, esi
jne 0x140022603
mov dword [rsp + 0x20], esi
call fcn.140070830
mov rcx, qword [rsp + 0x20]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140022790
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
xor ecx, ecx
mov rbx, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor ebp, ebp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x88]
lea r8d, [rbp + 1]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x88], ebp
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdi, qword [rsp + 0x90]
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x40]
mov qword [rdi], rcx
mov qword [rdi + 8], rbx
mov ecx, dword [rdi]
cmp ecx, 0x40
jne 0x14002282c
mov dword [rsp + 0x40], 0x2746
jmp 0x14002283c
cmp ecx, 0x4d2
jne 0x14002284d
mov dword [rsp + 0x40], 0x274d
call fcn.140070830
mov rcx, qword [rsp + 0x40]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
test esi, esi
je 0x140022861
or eax, 0xffffffff
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x40], ebp
call fcn.140070830
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov eax, dword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140022890
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebp, ecx
xor ecx, ecx
mov rsi, r9
mov ebx, r8d
mov edi, edx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov ecx, ebp
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASocketA]
mov rdi, rax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
cmp rdi, 0xffffffffffffffff
jne 0x140022902
or rax, rdi
jmp 0x140022948
cmp ebp, 0x17
jne 0x14002292c
lea r9, [rsp + 0x68]
lea edx, [rbp + 0x12]
lea r8d, [rbp + 4]
mov rcx, rdi
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], 0
call fcn.140070830
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140022960
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov rbp, r9
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1400229ae
mov dword [rsp + 0x20], 0x2719
call fcn.140070830
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
or eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r8, rbp
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r14d, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rsi, qword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x20]
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
test r14d, r14d
js 0x140022a23
mov dword [rsp + 0x20], 0
call fcn.140070830
mov rcx, qword [rsp + 0x20]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
cmp dword [rbp], 0
je 0x140022a20
or byte [rdi], 1
jmp 0x140022a23
and byte [rdi], 0xfc
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov eax, r14d
mov r14, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140022a40
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebp, ecx
xor ecx, ecx
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
test rsi, rsi
jne 0x140022aca
test rdi, rdi
jne 0x140022aca
test rbx, rbx
jne 0x140022aca
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x140022aef
mov eax, 0x10624dd3
imul dword [r8 + 4]
mov eax, dword [r8]
imul eax, eax, 0x3e8
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, eax
mov eax, 1
cmove ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x30], ebx
call fcn.140070830
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
xor eax, eax
jmp 0x140022b49
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x140022aef
cmp dword [r8], 0
jne 0x140022aef
mov eax, dword [r8 + 4]
dec eax
cmp eax, 0x3e6
ja 0x140022aef
mov dword [r8 + 4], 0x3e8
mov qword [rsp + 0x20], r8
mov r9, rbx
mov rdx, rsi
mov r8, rdi
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
call fcn.140070830
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdi, qword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x30]
mov qword [rdi], rcx
mov qword [rdi + 8], rbx
test esi, esi
js 0x140022b47
mov dword [rsp + 0x30], 0
call fcn.140070830
mov rcx, qword [rsp + 0x30]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140023910
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
call fcn.140070830
mov rcx, qword [rbx]
mov byte [rsp + 0x40], 2
mov qword [rsp + 0x28], rax
cmp rcx, 0xffffffffffffffff
je 0x14002394b
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140022330
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140023967
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.140022330
mov rcx, rbx
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x30
pop rbx
jmp fcn.140022fa0
cmp edx, 2
jne 0x140023fee
add rcx, 0x58
jmp 0x140023910
repz ret

Function at 0x140023990
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x60]
mov rbx, rcx
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 1
call fcn.140070830
mov rbx, qword [rbx + 8]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
lea r8d, [rax + 1]
mov rcx, rbx
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.140070830
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x140023a05
cmp eax, 0x4d2
jne 0x140023a0a
call fcn.140070830
test ebx, ebx
jne 0x140023a13
call fcn.140070830
add rsp, 0x50
pop rbx
ret

Function at 0x140023a20
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x14010b358]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rax, [rsp + 0x70]
xor ebp, ebp
mov rsi, rcx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0x400
mov dword [rsp + 0x58], ebp
call fcn.140070830
mov rcx, qword [rsi]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140022790
test eax, eax
setg dil
cmp eax, 0x400
jne 0x140023b42
mov qword [rsp + 0x498], rbx
nop dword [rax]
mov rbx, qword [rsi]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], ebp
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call fcn.140070830
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x140023af9
cmp eax, 0x4d2
jne 0x140023afe
call fcn.140070830
test ebx, ebx
jne 0x140023b11
call fcn.140070830
cmp dword [rsp + 0x40], 0x400
je 0x140023aa0
mov rbx, qword [rsp + 0x498]
movzx eax, dil
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140088760
lea r11, [rsp + 0x480]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
movzx eax, dil
jmp 0x140023b1d
Function at 0x140024aa0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 8]
mov r10, r9
mov r11, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x78], 0
je 0x140024ada
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
add rsp, 0x40
pop rdi
jmp fcn.140021a60
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140024b02
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
add rsp, 0x40
pop rdi
jmp fcn.140021a60
xor eax, eax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x70]
lea r9, [rsp + 0x50]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x274d
cmp eax, 0x4d2
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x58]
je 0x140024b81
cmp eax, 0x3e5
je 0x140024b81
mov r9d, dword [rsp + 0x50]
mov rcx, qword [rdi + 8]
mov r8d, eax
mov rdx, rsi
call fcn.140021a60
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 8]
mov rdx, rsi
call fcn.1400219c0
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140024ba0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov r10, r9
mov r11, r8
mov rbx, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x88], 0
je 0x140024bdd
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
add rsp, 0x50
pop rbx
jmp fcn.140021a60
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x140024c05
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, 0x2719
add rsp, 0x50
pop rbx
jmp fcn.140021a60
mov eax, dword [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x60], edx
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x90]
lea r9, [rsp + 0x60]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x140024c61
mov eax, 0x2746
jmp 0x140024c6e
mov ecx, 0x274d
cmp eax, 0x4d2
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x68]
je 0x140024c9d
cmp eax, 0x3e5
je 0x140024c9d
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rbx + 8]
mov r8d, eax
mov rdx, rdi
call fcn.140021a60
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.1400219c0
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbx
ret