joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18016e840
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
xor ebp, ebp
mov esi, r9d
mov r14, r8
mov rbx, rcx
test rdx, rdx
je 0x18016e861
mov rbp, qword [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movabs r8, 0x100000001b3
add rbx, 0x4c0
mov r10d, eax
movzx edx, al
movabs rax, 0xcbf29ce484222325
xor rdx, rax
mov dword [rsp + 0x60], r10d
movzx ecx, byte [rsp + 0x61]
movzx eax, byte [rsp + 0x62]
imul rdx, r8
xor rdx, rcx
imul rdx, r8
xor rdx, rax
movzx eax, byte [rsp + 0x63]
imul rdx, r8
xor rdx, rax
imul rdx, r8
mov r8, qword [rbx + 0x28]
mov rcx, rdx
shr rcx, 0x20
xor rcx, rdx
and rcx, r8
cmp qword [rbx + 0x30], rcx
ja 0x18016e8dc
shr r8, 1
or rax, 0xffffffffffffffff
sub rax, r8
add rcx, rax
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [rdx + rcx*8]
mov rax, qword [rdx + rax*8]
lea r11, [rdx + rcx*8]
cmp r9, r8
jne 0x18016e902
mov rcx, r8
jmp 0x18016e909
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x18016e928
cmp r10d, dword [rax + 0x10]
je 0x18016e919
mov rax, qword [rax]
jmp 0x18016e8f8
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
jmp 0x18016e92b
mov rax, r8
mov qword [rsp + 0x70], rdi
cmp rax, r8
jne 0x18016e9a4
mov rdi, qword [r8]
lea rax, [rsp + 0x60]
mov r8, qword [rdi + 8]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.18016fd20
movabs rcx, 0x7fffffffffffffe
mov rdx, rax
mov rax, qword [rbx + 8]
sub rcx, rax
cmp rcx, 1
jb 0x18016e9fd
inc rax
mov rcx, rbx
mov qword [rbx + 8], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov r9, qword [rbx]
lea rdx, [rsp + 0x30]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.18016faa0
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 8]
cmp esi, 0x18
jl 0x18016e9c8
mov r9, qword [rdx]
mov r8d, esi
mov rcx, rbp
mov rdx, r14
mov dword [rsp + 0x20], eax
call fcn.18016f520
jmp 0x18016e9ea
cmp esi, 0xc
jne 0x18016e9da
mov rdx, r14
mov rcx, rbp
call fcn.18016f3c0
jmp 0x18016e9ea
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 2
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.18017929c
int3
Function at 0x18016f1d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movzx r9d, byte [r8]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
mov rdx, qword [rbx + 0x28]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r10, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, r9
shr rcx, 0x20
xor rcx, r9
and rcx, rdx
cmp qword [rbx + 0x30], rcx
ja 0x18016f245
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rax, rcx
add rax, rax
add rcx, rcx
mov r9, qword [r8 + rcx*8]
mov rax, qword [r8 + rax*8]
lea r8, [r8 + rcx*8]
cmp r9, rdx
jne 0x18016f26b
mov rcx, rdx
jmp 0x18016f272
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x18016f2aa
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x18016f284
mov rax, qword [rax]
jmp 0x18016f261
mov ecx, dword [rax + 0x10]
mov qword [rsp + 8], rdx
cmp dword [r10], ecx
jne 0x18016f296
mov qword [rsp + 8], rax
lea rax, [rsp + 8]
mov rax, qword [rax]
mov qword [r11], rax
mov rax, r11
mov rbx, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 0x10]
mov qword [r11], rdx
mov rax, r11
ret
Function at 0x18016faa0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, r8
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 1]
mov rsi, rdx
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x28]
mov r8, r9
shr r8, 0x20
xor r8, r9
and r8, rcx
cmp qword [r10 + 0x30], r8
ja 0x18016fb22
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov rcx, qword [r10 + 0x10]
mov rbx, qword [r10]
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x18016fb86
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x18016fb86
mov ecx, dword [r11]
mov rbx, qword [rbx + 8]
cmp dword [rbx + 0x10], ecx
je 0x18016fb56
cmp rbx, rax
jne 0x18016fb46
jmp 0x18016fb86
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 8]
mov rcx, rdi
call sym.HPSocket4C_U.dll_SYS_Free
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x18016fc16
mov rax, qword [rdi]
cmp rbx, rax
je 0x18016fbbb
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10]
jne 0x18016fbd8
mov qword [rdx], rdi
mov rax, qword [r10 + 0x10]
mov qword [r8 + rax + 8], rdi
jmp 0x18016fc04
cmp rax, rbx
jne 0x18016fbe2
mov qword [rdx], rdi
jmp 0x18016fc04
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x18016fc04
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.18016fc30
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18016fd50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx]
movzx ebx, r8w
mov rbp, rdx
mov rdi, rcx
call qword [rax + 0x150]
test eax, eax
je 0x18016ff65
mov rcx, rdi
call fcn.180170010
test eax, eax
je 0x18016ff65
mov rax, qword [rdi]
mov rcx, rdi
mov qword [rsp + 0x60], rsi
call qword [rax + 0x158]
mov r9, qword [rsp + 0x80]
xor eax, eax
mov qword [rsp + 0x32], rax
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov word [rsp + 0x4a], ax
lea rax, [rsp + 0x30]
xor esi, esi
movzx r8d, bx
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rdi + 0x18], 1
mov qword [rdi + 0x1c], 5
mov dword [rdi + 0x24], 1
mov word [rsp + 0x30], si
call fcn.180170160
test eax, eax
je 0x18016ff0e
cmp word [rsp + 0x30], 2
mov rcx, qword [rdi + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
lea rdx, [rsp + 0x30]
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x18016feff
mov eax, 1
lock xadd qword [0x18026e3b8], rax
inc rax
jne 0x18016fe48
mov eax, 1
lock xadd qword [0x18026e3b8], rax
inc rax
xor ecx, ecx
mov qword [rdi + 0x38], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rdi]
mov rdx, qword [rdi + 0x28]
mov rcx, rdi
call qword [rax + 0x118]
cmp eax, 2
je 0x18016fee6
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1801702f0
test eax, eax
je 0x18016fed7
lea rax, [rdi + 0x68]
lea r8, [0x1801703e0]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call fcn.18017b9a4
mov qword [rdi + 0x60], rax
test rax, rax
je 0x18016fec9
mov rcx, qword [rdi + 8]
mov esi, 1
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rdi + 0x6c], 8
mov ecx, 0x65f
jmp 0x18016ff1d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rdi + 0x6c], ntohs
jmp 0x18016ff1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
mov dword [rdi + 0x6c], 5
test eax, eax
cmove eax, ecx
jmp 0x18016ff1b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rdi + 0x6c], 4
jmp 0x18016ff1b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rdi + 0x6c], 3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rdi + 0x18], esi
mov qword [rdi + 0x1c], 5
mov dword [rdi + 0x24], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rdi]
mov rcx, rdi
mov ebx, eax
call qword [rdx + reloc.WS2_32.dll_htonl]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x1801702f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x58], 0
mov rbx, rcx
jne 0x180170324
mov eax, dword [rcx + 0x54]
mov r9d, dword [rcx + 0x50]
lea r8, [rcx + 0x88]
mov rcx, qword [rcx + 0x28]
mov dword [rsp + 0x20], eax
call fcn.18015e500
test eax, eax
jne 0x180170353
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x28]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x20
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801703cf
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
mov qword [rsp + 0x48], rdi
xor edi, edi
lea r8d, [rdi + 0x23]
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x1801703c2
mov dword [rbx + 0x70], 1
xor ecx, ecx
mov dword [rbx + 0x74], 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x120]
cmp eax, 2
jne 0x1801703bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
test eax, eax
cmove eax, ecx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov edi, 1
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov ecx, 0x80004005
call fcn.180127e80
int3

Function at 0x1801706f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x24c]
mov rbx, rcx
test eax, eax
jne 0x1801707d0
lea rsi, [rcx + 0xa4]
mov ebp, reloc.WS2_32.dll_recv
cmp word [rsi], 2
mov r8d, dword [rbx + 0x44]
mov rdx, qword [rbx + 0xc0]
mov rcx, qword [rbx + 0x28]
mov eax, 0x1c
cmove eax, ebp
xor r9d, r9d
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
js 0x1801707ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9, qword [rbx]
mov rdx, qword [rbx + 0xc0]
mov r8d, edi
mov rcx, rbx
call qword [r9 + 0x140]
cmp eax, 2
jne 0x1801707b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
test eax, eax
cmove eax, ecx
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 4
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], 1
xor eax, eax
jmp 0x1801707d5
cmp eax, 0xffffffff
je 0x1801707c3
mov eax, dword [rbx + 0x24c]
test eax, eax
je 0x180170721
jmp 0x1801707d0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180170792
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180170880
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rcx
call fcn.180170aa0
mov rdi, rax
lea rbx, [rsi + 0xe8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180170a52
lea r15, [rsi + 0x88]
mov r12d, reloc.WS2_32.dll_recv
nop word [rax + rax]
mov eax, 0x1c
cmp word [r15], 2
cmove eax, r12d
mov r8d, dword [rdi + 0x30]
sub r8d, dword [rdi + 0x28]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.WS2_32.dll_sendto]
mov ebp, eax
test eax, eax
js 0x180170962
lea rcx, [rsi + 0x1e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, 1
cmp ebp, ecx
cmovg ecx, ebp
sub dword [rsi + 0x248], ecx
lea rcx, [rsi + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov r8d, ebp
mov rdx, qword [rdi + 0x28]
mov rcx, rsi
call qword [rax + 0x130]
mov rbx, qword [rsp + 0x38]
jmp 0x180170967
cmp eax, 0xffffffff
je 0x1801709b2
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.180126a20
test eax, eax
jne 0x180170988
mov rcx, qword [rdi]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call fcn.180170aa0
mov rdi, rax
lea rbx, [rsi + 0xe8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1801708e0
jmp 0x180170a52
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180170a15
lea rcx, [rsi + 0x1e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 0x218]
test rax, rax
je 0x1801709e9
mov qword [rax + 0x10], rdi
mov rax, qword [rsi + 0x218]
mov qword [rdi + 8], rax
jmp 0x1801709f8
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rax
mov qword [rsi + 0x220], rdi
mov qword [rsi + 0x218], rdi
inc dword [rsi + 0x210]
lea rcx, [rsi + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x180170a78
mov dword [rsi + 0x18], 1
mov dword [rsi + 0x1c], 3
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], 1
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.180126a20
test eax, eax
jne 0x180170a4e
mov rcx, qword [rdi]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x180170a7d
test rdi, rdi
je 0x180170a78
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.180126a20
test eax, eax
jne 0x180170a78
mov rcx, qword [rdi]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180171790
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rdx
mov rbx, rcx
test r8d, r8d
je 0x180171810
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x28]
lea r8d, [rdi + 0x30]
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x1801717fe
cmp word [rsi], 2
mov rcx, qword [rbx + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
mov rdx, rsi
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1801717f9
cmp eax, 0xffffffff
jne 0x1801717fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1801717fe
mov edi, 1
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp word [rdx], 2
mov rcx, qword [rcx + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1801717fe
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
mov r8d, 0x23
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x1801717fe
mov dword [rbx + 0x68], 1
xor ecx, ecx
mov dword [rbx + 0x6c], 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x108]
cmp eax, 2
jne 0x18017189c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
test eax, eax
cmove eax, ecx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1801717f9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1801717f9
test eax, eax
je 0x1801717f9
mov ecx, 0x80004005
call fcn.180127e80
int3

Function at 0x180171c50
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x210]
mov eax, dword [rcx + 0x50]
inc dword [rcx + 0x210]
mov rbx, rcx
cmp edx, eax
jb 0x180171c86
xor eax, eax
mov dword [rcx + 0x18], 1
mov qword [rcx + 0x1c], 5
mov dword [rcx + 0x24], eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x180171cce
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x180171cce
test eax, eax
je 0x180171cce
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 5
xor eax, eax
mov dword [rbx + 0x24], 1
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180171e90
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rdx + 0x14]
mov rbx, rcx
test eax, eax
je 0x180171ec0
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x18], 1
mov dword [rcx + 0x1c], 2
xor eax, eax
mov dword [rcx + 0x24], 1
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x28]
mov r8d, 0x23
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x180171eff
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 2
mov dword [rbx + 0x24], 1
mov dword [rbx + 0x20], eax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x68], 1
xor ecx, ecx
mov dword [rbx + 0x6c], 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x108]
cmp eax, 2
je 0x180171f59
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x180171f4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x180171f4e
test eax, eax
jne 0x180171f83
mov eax, 1
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
mov dword [rbx + 0x1c], 5
test eax, eax
cmove eax, ecx
xor ecx, ecx
mov dword [rbx + 0x18], ecx
mov dword [rbx + 0x24], ecx
mov dword [rbx + 0x20], eax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x80004005
call fcn.180127e80
int3

Function at 0x180171f90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x20c]
mov rbx, rcx
test eax, eax
jne 0x1801720ba
xor esi, esi
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx + 0x44]
mov rdx, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jle 0x18017206a
mov dword [rbx + 0x210], esi
cmp eax, 0x10
jne 0x18017200d
mov rax, qword [rbx + 0x80]
mov rcx, qword [rax]
cmp rcx, qword [0x180220d20]
jne 0x18017200d
mov rcx, qword [rax + 8]
cmp rcx, qword [0x180220d28]
je 0x180172089
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbx]
mov rdx, qword [rbx + 0x80]
mov r8d, edi
mov rcx, rbx
call qword [rax + 0x128]
cmp eax, 2
jne 0x180172079
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x4c7
test eax, eax
cmove eax, ecx
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 4
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 0xffffffff
je 0x1801720ad
test eax, eax
jne 0x180172079
mov dword [rbx + 0x210], esi
mov eax, dword [rbx + 0x20c]
test eax, eax
je 0x180171fc0
jmp 0x1801720ba
mov dword [rbx + 0x18], 1
mov qword [rbx + 0x1c], 5
mov dword [rbx + 0x24], esi
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180172040
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1801720d0
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, rcx
call fcn.180169190
mov rdi, rax
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180172272
nop dword [rax + rax]
mov r8d, dword [rdi + 0x30]
sub r8d, dword [rdi + 0x28]
xor r9d, r9d
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test eax, eax
jle 0x180172182
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [rsi + 0x208], ebp
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9, qword [rsi]
mov r8d, ebp
mov rdx, qword [rdi + 0x28]
mov rcx, rsi
call qword [r9 + 0x118]
mov rbx, qword [rsp + 0x28]
jmp 0x180172187
cmp eax, 0xffffffff
je 0x1801721d2
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.180126a20
test eax, eax
jne 0x1801721a8
mov rcx, qword [rdi]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call fcn.180169190
mov rdi, rax
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x180172120
jmp 0x180172272
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180172235
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 0x1d8]
test rax, rax
je 0x180172209
mov qword [rax + 0x10], rdi
mov rax, qword [rsi + 0x1d8]
mov qword [rdi + 8], rax
jmp 0x180172218
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], rax
mov qword [rsi + 0x1e0], rdi
mov qword [rsi + 0x1d8], rdi
inc dword [rsi + 0x1d0]
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x180172298
mov dword [rsi + 0x18], 1
mov dword [rsi + 0x1c], 3
mov dword [rsi + 0x20], eax
mov dword [rsi + 0x24], 1
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.180126a20
test eax, eax
jne 0x18017226e
mov rcx, qword [rdi]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x18017229d
test rdi, rdi
je 0x180172298
lea rcx, [rbx + 0x30]
mov rdx, rdi
call fcn.180126a20
test eax, eax
jne 0x180172298
mov rcx, qword [rdi]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1801722c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbx
mov edi, eax
call fcn.1801686c0
test eax, eax
jne 0x1801722ec
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, edi
mov rcx, rbx
call fcn.180169510
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x90]
xor edi, edi
test eax, eax
je 0x180172328
cmp dword [rbx + 0x24], edi
je 0x180172325
mov rcx, qword [rbx + 0x28]
lea r8d, [rdi + 0x10]
lea rdx, [0x180220d20]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbx + 0x68], edi
cmp dword [rbx + 0x18], edi
je 0x180172340
mov rax, qword [rbx]
mov r8d, dword [rbx + 0x20]
mov edx, dword [rbx + 0x1c]
mov rcx, rbx
call qword [rax + 0x130]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x180172353
call qword [sym.imp.WS2_32.dll_WSACloseEvent]
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x18017237a
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x28], 0xffffffffffffffff
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x180]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret