joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011a160
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x14011a195
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.140119350
mov edx, eax
mov rcx, rsi
call rbx
mov rcx, rdi
call fcn.1401197b0
mov ebx, eax
mov rcx, rdi
call fcn.1401192d0
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14011a222
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011a195
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140119980
nop
mov rdx, rax
mov ecx, ebx
call fcn.14011a550
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14011a222
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011a21d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011a232
call fcn.1402ba9fc
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1402caabc
int3

Function at 0x14011a240
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0xb0
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x14011a286
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.140119350
mov edx, eax
mov rcx, rdi
call rbx
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x138]
nop
mov rcx, rsi
call fcn.1401197b0
mov ebx, eax
mov rcx, rsi
call fcn.1401192d0
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14011a354
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2734
je 0x14011a327
cmp eax, 0x2733
je 0x14011a327
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140119980
nop
mov rdx, rax
mov ecx, ebx
call fcn.14011a550
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14011a327
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011a322
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011a37c
call fcn.1402ba9fc
mov rax, qword [rdi]
mov r8d, 7
mov rdx, r14
mov rcx, rdi
call qword [rax + 0xc8]
test al, al
je 0x14011a382
mov rcx, rdi
call fcn.14011c1e0
test eax, eax
je 0x14011a354
mov ecx, eax
call fcn.14011a4e0
nop
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp qword [rax + 0x138]
call fcn.1402caabc
nop
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140119980
mov rbx, rax
lea rdx, str.connect_timed_out
lea rcx, [rsp + 0x20]
call fcn.140015470
nop
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140136e00
lea rdx, [0x140494138]
lea rcx, [rsp + 0x60]
call fcn.1402bd440
int3
Function at 0x14011a3d0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x14011a405
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.140119350
mov edx, eax
mov rcx, rdi
call rbx
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x138]
mov rcx, rsi
call fcn.1401197b0
mov ebx, eax
mov rcx, rsi
call fcn.1401192d0
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x14011a4a1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2734
je 0x14011a4a1
cmp eax, 0x2733
je 0x14011a4a1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140119980
nop
mov rdx, rax
mov ecx, ebx
call fcn.14011a550
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14011a4a1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011a49c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011a4b1
call fcn.1402ba9fc
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1402caabc
int3

Function at 0x14011b030
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14011b04b
add rsp, 0x28
jmp fcn.14011ad40
add rsp, 0x28
ret

Function at 0x14011b380
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [rcx]
mov ebp, r8d
mov rdi, rdx
xor esi, esi
mov rdx, r9
mov rbx, rcx
lea r8d, [rsi + 1]
call qword [rax + 0xc8]
test al, al
je 0x14011b44c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc0]
movsxd rdx, eax
cmp qword [rdi + 8], rdx
jae 0x14011b3e0
mov r8b, 1
mov rcx, rdi
call fcn.14011ba70
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011b464
mov r8d, dword [rdi + 8]
mov r9d, ebp
mov rdx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jns 0x14011b438
cmp byte [rbx + 0x28], 0
je 0x14011b415
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011b3e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14011b42a
cmp byte [rbx + 0x28], 0
jne 0x14011b482
jmp 0x14011b438
cmp eax, 0x274c
je 0x14011b482
mov ecx, eax
call fcn.14011a4e0
mov rdx, rsi
cmp rsi, qword [rdi + 8]
jae 0x14011b44c
mov r8b, 1
mov rcx, rdi
call fcn.14011ba70
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x20]
call fcn.1402bd440
int3
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140136e60
lea rdx, [0x140494138]
lea rcx, [rsp + 0x20]
call fcn.1402bd440
int3
Function at 0x14011b4a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rsi, rdx
mov ebp, r8d
mov edx, 1
mov rdi, rcx
call fcn.14011a040
xor r14d, r14d
nop word [rax + rax]
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011b58f
mov rdx, qword [rsi]
lea rax, [rsp + 0xc8]
mov r8, qword [rsi + 8]
lea r9, [rsp + 0xb0]
sub r8, rdx
mov qword [rsp + 0x30], r14
sar r8, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0xb0], r14d
mov dword [rsp + 0xc8], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x14011b52a
call fcn.14011ad40
cmp byte [rdi + 0x28], r14b
je 0x14011b547
cmp dword [rsp + 0xb0], r14d
jge 0x14011b574
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011b4d0
cmp dword [rsp + 0xb0], r14d
jge 0x14011b574
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14011b566
cmp byte [rdi + 0x28], r14b
jne 0x14011b5ad
jmp 0x14011b574
cmp eax, 0x274c
je 0x14011b5ad
mov ecx, eax
call fcn.14011a4e0
mov eax, dword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x40]
call fcn.1402bd440
int3
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140136e60
lea rdx, [0x140494138]
lea rcx, [rsp + 0x40]
call fcn.1402bd440
int3

Function at 0x14011b5d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov r14, rdx
mov esi, r9d
mov edx, 1
mov ebp, r8d
mov rbx, rcx
call fcn.14011a040
mov qword [rsp + 0x80], rdi
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011b679
mov r9d, esi
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x14011b658
cmp byte [rbx + 0x28], 0
je 0x14011b635
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011b603
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14011b64a
cmp byte [rbx + 0x28], 0
jne 0x14011b697
jmp 0x14011b658
cmp eax, 0x274c
je 0x14011b697
mov ecx, eax
call fcn.14011a4e0
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x80]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x20]
call fcn.1402bd440
int3
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140136e60
lea rdx, [0x140494138]
lea rcx, [rsp + 0x20]
call fcn.1402bd440
int3
Function at 0x14011b6c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
mov r14, r9
mov edx, 1
mov r15, r8
mov rdi, rcx
call fcn.14011a040
mov ebp, dword [rsp + 0xe0]
xor r12d, r12d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011b7d7
mov rax, qword [r14]
mov r9, qword [r15]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x40], r12
sub r8, rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r9
lea r9, [rsp + 0xc0]
sar r8, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc0], r12d
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x14011b764
call fcn.14011ad40
cmp byte [rdi + 0x28], r12b
je 0x14011b785
cmp dword [rsp + 0xc0], r12d
jge 0x14011b7b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011b700
cmp dword [rsp + 0xc0], r12d
jge 0x14011b7b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14011b7a4
cmp byte [rdi + 0x28], r12b
jne 0x14011b7f5
jmp 0x14011b7b2
cmp eax, 0x274c
je 0x14011b7f5
mov ecx, eax
call fcn.14011a4e0
mov eax, dword [rsp + 0xc0]
lea r11, [rsp + 0xa0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x58]
call fcn.1402bd440
int3
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140136e60
lea rdx, [0x140494138]
lea rcx, [rsp + 0x58]
call fcn.1402bd440
int3

Function at 0x14011b820
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x80
mov r14, rdx
mov rsi, r9
mov edx, 1
mov ebp, r8d
mov rbx, rcx
call fcn.14011a040
mov r15d, dword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
mov qword [rsp + 0xa0], rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011b902
mov rax, qword [r12]
mov r9d, r15d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rax, qword [rsi]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
jns 0x14011b8da
cmp byte [rbx + 0x28], 0
je 0x14011b8b7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011b870
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14011b8cc
cmp byte [rbx + 0x28], 0
jne 0x14011b920
jmp 0x14011b8da
cmp eax, 0x274c
je 0x14011b920
mov ecx, eax
call fcn.14011a4e0
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [rsp + 0xa0]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x30]
call fcn.1402bd440
int3
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140136e60
lea rdx, [0x140494138]
lea rcx, [rsp + 0x30]
call fcn.1402bd440
int3
Function at 0x14011bb30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x90
mov rsi, rdx
mov ebp, r8d
mov edx, 2
mov rdi, rcx
call fcn.14011a040
xor r14d, r14d
nop
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011bbf7
mov rdx, qword [rsi]
lea r9, [rsp + 0xa0]
mov r8, qword [rsi + 8]
sub r8, rdx
mov qword [rsp + 0x30], r14
sar r8, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14011bbaa
call fcn.14011ad40
cmp byte [rdi + 0x28], r14b
je 0x14011bbc7
cmp dword [rsp + 0xa0], r14d
jge 0x14011bbd6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011bb60
cmp dword [rsp + 0xa0], r14d
jge 0x14011bbd6
call fcn.14011ad40
mov eax, dword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x40]
call fcn.1402bd440
int3

Function at 0x14011bc20
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov r14, rdx
mov esi, r9d
mov edx, 2
mov ebp, r8d
mov rbx, rcx
call fcn.14011a040
mov qword [rsp + 0x80], rdi
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011bcab
mov r9d, esi
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x14011bc8a
cmp byte [rbx + 0x28], 0
je 0x14011bc85
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011bc53
call fcn.14011ad40
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x80]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x20]
call fcn.1402bd440
int3
Function at 0x14011bcd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov ebp, r9d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x14011bd17
mov rax, qword [rbx]
mov rcx, rsi
mov rdi, qword [rax + 0x150]
call fcn.140119350
mov edx, eax
mov rcx, rbx
call rdi
mov rcx, rsi
mov dword [rsp + 0x70], r15d
call fcn.1401197b0
mov rcx, rsi
mov edi, eax
call fcn.1401192d0
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8, qword [r14 + 8]
mov rcx, qword [rbx + 0x10]
sub r8, rdx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
sar r8, 4
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x14011bd6c
call fcn.14011ad40
mov edi, dword [rsp + 0x70]
cmp byte [rbx + 0x28], r15b
je 0x14011bd8b
test edi, edi
jns 0x14011bd94
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011bcf7
test edi, edi
jns 0x14011bd94
call fcn.14011ad40
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14011bdb0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15d, dword [rsp + 0x70]
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
nop dword [rax]
cmp qword [rbx + 0x10], 0xffffffffffffffff
jne 0x14011be00
mov rax, qword [rbx]
mov rcx, rsi
mov rdi, qword [rax + 0x150]
call fcn.140119350
mov edx, eax
mov rcx, rbx
call rdi
mov rcx, rsi
call fcn.1401197b0
mov rcx, rsi
mov edi, eax
call fcn.1401192d0
mov rcx, qword [rbx + 0x10]
mov r9d, r15d
mov r8d, ebp
mov dword [rsp + 0x28], edi
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp byte [rbx + 0x28], 0
mov edi, eax
je 0x14011be47
test eax, eax
jns 0x14011be52
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14011bde0
test edi, edi
jns 0x14011be50
call fcn.14011ad40
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14011be70
Capabilities:
Send data
Send data on socket

Disassembly:
mov byte [rsp + 0x10], dl
sub rsp, 0x78
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011bea7
mov r9d, 1
lea rdx, [rsp + 0x88]
mov r8d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14011bea2
call fcn.14011ad40
add rsp, 0x78
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x20]
call fcn.1402bd440
int3
Function at 0x14011bf60
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x88
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011bf94
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14011bf8c
call fcn.14011ad40
add rsp, 0x88
ret
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140114740
lea rdx, [0x140492468]
lea rcx, [rsp + 0x30]
call fcn.1402bd440
int3

Function at 0x140125e30
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x80
mov rax, rdx
mov rbx, rcx
cmp qword [rdx + 0x10], 0
je 0x140125edb
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x50], 4
cmp qword [rdx + 0x18], 0xf
jbe 0x140125e6e
mov rax, qword [rdx]
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140125edb
mov rax, qword [rsp + 0x98]
mov r8, qword [rax + 0x20]
lea rdx, [r8 + 8]
mov r8d, dword [r8 + 0x18]
lea rcx, [rsp + 0x28]
call fcn.140125680
nop
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140125600
nop
lea rcx, [rsp + 0x28]
call fcn.140125700
mov rax, rbx
add rsp, 0x80
pop rbx
ret
mov rcx, rbx
call fcn.1401256d0
mov rax, rbx
add rsp, 0x80
pop rbx
ret

Function at 0x1401274b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [r8 - 1]
mov r15, r9
sar rbp, 1
mov r13, r8
mov rdi, rdx
mov rsi, rcx
mov r14, rdx
mov rbx, rdx
cmp rdx, rbp
jge 0x140127526
nop word [rax + rax]
add rbx, rbx
lea rcx, [rsi + 0x10]
lea rcx, [rcx + rbx*8]
lea rdx, [rcx - 8]
call fcn.140118270
movzx eax, al
lea rcx, [rsi + rdi*8]
xor rax, 1
inc rax
add rbx, rax
lea rdx, [rsi + rbx*8]
call fcn.1401181a0
mov rdi, rbx
cmp rbx, rbp
jl 0x1401274f0
cmp rbx, rbp
jne 0x140127546
test r13b, 1
jne 0x140127546
lea rdx, [r13 - 1]
lea rdx, [rsi + rdx*8]
lea rcx, [rsi + rdi*8]
call fcn.1401181a0
lea rdi, [r13 - 1]
cmp r14, rdi
jge 0x14012757e
nop dword [rax + rax]
lea rbx, [rdi - 1]
mov rdx, r15
sar rbx, 1
lea rbp, [rsi + rbx*8]
mov rcx, rbp
call fcn.140118270
test al, al
je 0x14012757e
lea rcx, [rsi + rdi*8]
mov rdx, rbp
call fcn.1401181a0
mov rdi, rbx
cmp r14, rbx
jl 0x140127550
lea rcx, [rsi + rdi*8]
mov rdx, r15
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1401181a0
Function at 0x140127e40
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
cmp qword [rdx + 0x18], 0xf
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov rdi, rcx
mov dword [rsp + 0x28], r8d
mov rbx, rdx
mov rcx, rdx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
jbe 0x140127e74
mov rcx, qword [rdx]
lea r9, [rsp + 0x78]
xor edx, edx
lea r8, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x140127eb0
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140127ae0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x60
pop rdi
ret
mov rdx, rbx
mov ecx, eax
call fcn.140127d10
int3

Function at 0x140128980
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140128a73
lea rdx, str.NtCancelIoFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
lea rdx, str.NtCreateFile
mov qword [0x1404aff70], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
lea rdx, str.NtCreateKeyedEvent
mov qword [0x1404aff78], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
lea rdx, str.NtDeviceIoControlFile
mov qword [0x1404aff80], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
lea rdx, str.NtReleaseKeyedEvent
mov qword [0x1404aff88], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
lea rdx, str.NtWaitForKeyedEvent
mov qword [0x1404aff90], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
lea rdx, str.RtlNtStatusToDosError
mov qword [0x1404aff98], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140128a73
mov qword [0x1404affa0], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x14012a2c0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14012a2ef
mov ecx, eax
call fcn.1401288d0
mov eax, 0xffffffff
add rsp, 0x1c8
ret
xor eax, eax
add rsp, 0x1c8
ret