joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f310
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbx, edx
mov r15, r8
mov edx, 0x3d
movsxd rbp, r9d
mov rsi, rcx
call fcn.140174a7c
mov r14, rbx
test rax, rax
jne 0x14003f34a
lea rax, [rbx + rsi]
movzx ebx, word [rax - 3]
lea rcx, [rsi + 3]
movzx edi, byte [rax - 1]
sub rax, 3
sub rax, rsi
mov rdx, rsi
mov r8, rax
call fcn.140174ce0
mov word [rsi], bx
lea r11, [r14 + rsi]
mov byte [rsi + 2], dil
lea rbx, [r15 + rbp]
cmp byte [rsi], 0
mov r9, r15
je 0x14003f450
lea r10, [r15 + 3]
lea rdi, [0x140263c20]
nop
cmp rsi, r11
jae 0x14003f450
movzx eax, byte [rsi]
cmp al, 0x3d
je 0x14003f3ad
movzx eax, al
cmp byte [rax + rdi], 0xff
je 0x14003f450
xor r8d, r8d
xor eax, eax
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rsi + rcx], al
jne 0x14003f3b6
cmp rcx, 4
jb 0x14003f473
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rdx + rsi]
shl eax, 6
cmp cl, 0x3d
jne 0x14003f3e1
inc r8d
jmp 0x14003f3f3
test r8d, r8d
jne 0x14003f473
movzx ecx, cl
movsx ecx, byte [rcx + rdi]
add eax, ecx
inc rdx
cmp rdx, 4
jl 0x14003f3d0
cmp r8d, 2
ja 0x14003f473
cmp eax, 0xffffffff
je 0x14003f473
mov ecx, r8d
add rcx, rbx
cmp r10, rcx
ja 0x14003f473
mov ecx, eax
inc r10
shr ecx, 0x10
mov byte [r9], cl
inc r9
cmp r8d, 2
jae 0x14003f434
mov ecx, eax
shr ecx, 8
mov byte [r9], cl
inc r9
inc r10
cmp r8d, 1
jae 0x14003f443
mov byte [r9], al
inc r9
inc r10
add rsi, 4
cmp byte [rsi], 0
jne 0x14003f390
mov byte [r9], 0
sub r9d, r15d
mov eax, r9d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
or eax, 0xffffffff
jmp 0x14003f45a
Function at 0x14003f510
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd r11, edx
mov rbp, r8
add r11, rcx
mov r10, r8
cmp rcx, r11
jae 0x14003f60b
movsxd rax, r9d
lea rsi, [r8 - 4]
add rsi, rax
lea r9, [rcx + 2]
lea r8, [rcx + 1]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8, r11
jb 0x14003f55e
xor dil, dil
jmp 0x14003f562
movzx edi, byte [r8]
cmp r9, r11
jb 0x14003f56b
xor bl, bl
jmp 0x14003f56f
movzx ebx, byte [r9]
cmp r10, rsi
jae 0x14003f632
movzx eax, byte [rcx]
shr rax, 2
movzx eax, byte [rax + r14]
mov byte [r10], al
movsx rdx, byte [rcx]
inc rcx
and edx, 3
movzx eax, dil
shr rax, 4
lea rdi, [r10 + 3]
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + r14]
mov byte [r10 + 1], al
mov byte [rdi], 0x3d
mov byte [r10 + 2], 0x3d
mov byte [r10 + 4], 0
cmp rcx, r11
je 0x14003f62c
movsx rdx, byte [rcx]
inc rcx
and edx, 0xf
movzx eax, bl
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + r14]
mov byte [r10 + 2], al
lea r10, [rdi + 1]
cmp rcx, r11
je 0x14003f60b
movsx rax, byte [rcx]
add r8, 3
and eax, 0x3f
inc rcx
add r9, 3
movzx eax, byte [rax + r14]
mov byte [rdi], al
cmp rcx, r11
jb 0x14003f554
mov byte [r10], 0
sub r10d, ebp
mov eax, r10d
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
add r10, 4
jmp 0x14003f60b
or eax, 0xffffffff
jmp 0x14003f615
Function at 0x14003ff60
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rcx
mov edi, r8d
mov esi, edx
lea rcx, [rsp + 0x68]
sub rcx, 8
lea r8, [0x140046710]
lea rdx, [rsp + 0x88]
call fcn.140028f10
mov qword [rsp + 0x88], rax
call fcn.140171770
mov r9d, dword [0x1402794ec]
lea rdx, str..pipehola__d__d
mov rcx, qword [rsp + 0x88]
mov r8d, eax
call fcn.14002a130
mov rcx, qword [rsp + 0x88]
mov eax, 7
inc dword [0x1402794ec]
mov r8d, 1
mov qword [rsp + 0x38], 0
test edi, edi
mov dword [rsp + 0x30], 0xffffffff
mov edx, 0x40000003
mov rcx, qword [rcx]
cmovne r8d, eax
mov dword [rsp + 0x28], 0x1000
mov r9d, 0xff
mov dword [rsp + 0x20], 0x1000
call fcn.1400537a0
mov rbp, rax
test eax, eax
je 0x14004010d
mov qword [rsp + 0x70], rbx
xor edx, edx
movsxd rbx, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rcx, qword [rsp + 0x88]
mov edx, 0x40000000
mov eax, 0xc0000000
mov qword [rsp + 0x30], 0
cmp esi, 1
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, qword [rcx]
cmove edx, eax
xor r9d, r9d
xor r8d, r8d
call fcn.140053720
mov rsi, rax
test eax, eax
je 0x14004011f
mov eax, edi
mov rcx, rbx
neg eax
sbb edx, edx
xor r9d, r9d
and edx, 2
xor r8d, r8d
mov dword [rsp + 0x80], edx
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
movsxd rcx, eax
call fcn.140171070
test rax, rax
je 0x140040131
mov eax, 0x44
test edi, edi
mov ebx, 0x24
mov ecx, esi
cmovne ebx, eax
lea rax, [rsp + 0x40]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.14003f680
mov dword [r14 + 4], eax
mov r9d, ebx
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, ebp
call fcn.14003f680
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov dword [r14], eax
xor eax, eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
lea rdx, str.CreateNamedPipe_failed:__m
mov ecx, 0x4b0000
call fcn.14002d720
int3
lea rdx, str.CreateFile_failed:__m
mov ecx, 0x4b0000
call fcn.14002d720
int3
lea rdx, str.SetNamedPipeHandleState_failed:__m
mov ecx, 0x4b0000
call fcn.14002d720
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14003ff60
Function at 0x140040150
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [0x14027e030], 0
mov r14d, r9d
mov rdi, r8
movsxd rsi, ecx
mov r15, rdx
je 0x1400401e6
mov rax, qword gs:[0x58]
mov ecx, 0x22cc
mov r10, qword [rax]
cmp dword [rcx + r10], 0
jne 0x1400401e6
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbp, rsi
mov rbx, qword [rax + rsi*8]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x1400401e9
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov ecx, esi
call fcn.140040330
jmp 0x1400402fa
mov rbp, rsi
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbp*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140040313
cmp qword [rbx + 0x40], 0
je 0x14004024d
cmp dword [rbx + 0xc], 2
jne 0x14004024d
cmp word [rbx + 0x6c], 0
je 0x14004024d
xor eax, eax
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140047d90
jmp 0x1400402fa
test eax, 0x80000004
je 0x140040270
xor eax, eax
mov r9d, r14d
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdx, r15
mov rcx, rbx
call fcn.140047b70
jmp 0x1400402fa
test al, 1
je 0x1400402d6
movsxd rcx, dword [rbx + 0x70]
mov r9d, r14d
mov r8d, edi
mov rdx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140171070
mov rbx, rax
test eax, eax
jns 0x1400402d1
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x1400402b5
call fcn.1401760e4
cmp dword [rax], 0x2738
jne 0x1400402d1
mov r8, rdi
lea rdx, str.buf_to_small___d__for_packet_recv
mov ecx, 0x4b0003
call fcn.14002d250
movsxd rax, ebx
jmp 0x1400402fa
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x75c
lea rdx, str.vsock_recv
mov ecx, 0x4b0202
call fcn.14002d480
cdqe
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lea rdx, str.recv_from_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d720
int3
Function at 0x1400433d0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rdi
push r14
sub rsp, 0x2c0
mov r14, r8
lea rcx, [rsp + 0x2d8]
mov rbx, rdx
lea r8, [0x140046710]
sub rcx, 8
lea rdx, [rsp + 0x30]
mov rdi, r9
call fcn.140028f10
xor edx, edx
mov qword [rsp + 0x30], rax
lea rcx, str.read
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x68], rcx
lea rcx, str.write
mov qword [rsp + 0x70], rcx
lea rcx, str.except
mov qword [rsp + 0x78], rcx
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x140043600
mov qword [rsp + 0x2e0], rbp
mov rax, rbx
mov qword [rsp + 0x2b8], rsi
mov ebp, edx
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
mov qword [rsp + 0x2a0], r15
cmp dword [rax], 0
mov esi, edx
jbe 0x1400435c1
mov r15, qword [rsp + rbp + 0x48]
lea r12, [rsp + 0x90]
cmp rax, rdi
lea r13, [rsp + 0x90]
lea rcx, [rsp + 0x90]
cmovne r12, rdx
cmp rax, r14
lea r14, [rax + 8]
cmovne r13, rdx
cmp rax, rbx
cmovne rcx, rdx
mov qword [rsp + 0x40], rcx
nop word [rax + rax]
movsxd rdi, dword [r14]
lea rax, [rsp + 0x38]
mov rdx, rcx
mov qword [rsp + 0x98], rdi
mov ecx, 1
mov qword [rsp + 0x20], rax
mov r9, r12
mov dword [rsp + 0x90], 1
mov r8, r13
call qword [sym.imp.WS2_32.dll_select]
movsxd rcx, eax
call fcn.140171070
test eax, eax
jns 0x140043593
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov edx, dword [0x14027dfd0]
xor eax, eax
mov r8, qword [0x14027e020]
xor ebx, ebx
test edx, edx
jle 0x140043558
mov rcx, qword [r8 + rax*8]
test rcx, rcx
je 0x140043558
cmp dword [rcx + 0x70], edi
je 0x140043558
inc ebx
inc rax
cmp ebx, edx
jl 0x140043541
cmp ebx, edx
je 0x140043563
cmp qword [r8 + rax*8], 0
jne 0x140043566
or ebx, 0xffffffff
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_LeaveCriticalSection
mov r8, qword [rsp + rbp + 0x68]
lea rdx, str._s__d__osfd_d_vfd_d_
mov rcx, qword [rsp + 0x30]
mov r9d, esi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140029d80
mov rcx, qword [rsp + 0x40]
inc esi
add r14, 8
cmp esi, dword [r15]
jb 0x1400434e0
mov rbx, qword [rsp + 0x2e8]
xor edx, edx
mov rdi, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2f0]
mov rax, qword [rsp + rbp + 0x50]
add rbp, 8
test rax, rax
jne 0x140043494
mov rax, qword [rsp + 0x30]
mov r15, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2e0]
lea rdx, [0x1401ab620]
mov rcx, rax
call fcn.14002a810
mov r8, qword [rsp + 0x30]
lea rdx, str.vsock_select__:_a_member_of_fd_set_was_invalid:__s
mov ecx, 0x4b0000
mov r8, qword [r8]
call fcn.14002d720
int3
Function at 0x140043730
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword gs:[0x58]
mov rbx, rcx
mov esi, 0x2f80
add rsi, qword [rax]
mov rax, qword [rsi]
test rax, rax
jne 0x14004375c
call fcn.1401760e4
mov r14d, dword [rax]
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, qword [rbx + 0x80]
or dword [rbx + 0x68], 0x400
call fcn.140059fe0
mov rcx, qword [rbx + 0x80]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x70]
call fcn.140059f10
mov rcx, rbx
call fcn.140048d80
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x1400416d0]
mov r9, qword [rbx + 0x138]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rcx, eax
call fcn.140171070
xor edi, edi
mov rbp, rax
test eax, eax
jne 0x1400438e7
mov rax, qword [rsi]
test rax, rax
jne 0x140043808
call fcn.1401760e4
mov ecx, dword [rax]
mov edx, 4
mov dword [rsp + 0x28], reloc.WS2_32.dll_setsockopt
mov r9d, 0xe8
mov dword [rsp + 0x20], 6
lea r8d, [rdx - 3]
call fcn.14003f9a0
test eax, eax
je 0x14004390a
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dfe8]
mov rcx, qword [rbx + 0xf0]
jne 0x14004385b
mov qword [0x14027dfe8], rcx
jmp 0x140043870
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x14027dfe8]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x14004388c
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x14004389f
test rcx, rcx
je 0x14004389f
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xf0], rdi
mov qword [rbx + 0xf8], rdi
call sub.KERNEL32.dll_LeaveCriticalSection
or dword [rbx + 0x68], 0x4100000
mov rcx, rbx
call fcn.140048e20
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x1400438e7
mov rcx, rbx
call fcn.140040d80
mov rax, qword [rsi]
test rax, rax
jne 0x1400438f4
call fcn.1401760e4
test ebp, ebp
mov dword [rax], r14d
sete dil
mov eax, edi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x4b0000
call fcn.14002d720
int3
Function at 0x140043920
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
mov rax, qword [rbx + 0x138]
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x138]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
or dword [rbx + 0x68], 0x400
mov rcx, rbx
call fcn.140048d80
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x1400416d0]
mov r9, qword [rbx + 0x138]
lea rdx, [rbx + 0x164]
mov r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
movsxd rdi, eax
mov rcx, rdi
call fcn.140171070
test rax, rax
jne 0x1400439e3
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x1400439bf
call fcn.1401760e4
mov ecx, dword [rax]
mov edx, 3
mov dword [rsp + 0x20], 6
lea r9d, [rdx + 0x6a]
lea r8d, [r9 + 0x7b]
call fcn.14003f9a0
test eax, eax
je 0x140043aa9
test edi, edi
jne 0x140043a9e
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dfe8]
mov rcx, qword [rbx + 0xf0]
jne 0x140043a10
mov qword [0x14027dfe8], rcx
jmp 0x140043a25
mov rax, qword [rbx + 0xf8]
mov qword [rax + 0xf0], rcx
mov rcx, qword [0x14027dfe8]
mov rdx, qword [rbx + 0xf0]
test rdx, rdx
je 0x140043a41
mov rax, qword [rbx + 0xf8]
mov qword [rdx + 0xf8], rax
jmp 0x140043a54
test rcx, rcx
je 0x140043a54
mov rax, qword [rbx + 0xf8]
mov qword [rcx + 0xf8], rax
xor eax, eax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xf8], rax
call sub.KERNEL32.dll_LeaveCriticalSection
and dword [rbx + 0x68], 0xfffffbff
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140043a8f
mov rcx, rbx
call fcn.140040d80
or dword [rbx + 0x68], 0x100000
mov rcx, rbx
call fcn.140048e20
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cant_read_from_handle:__m
mov ecx, 0x4b0000
call fcn.14002d720
int3
Function at 0x1400442b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
test dword [rcx + 0x68], 0x2000
mov rbx, rcx
je 0x1400442cd
call sub.ntdll.dll_NtTestAlert
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 0x88]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rbp
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
call fcn.14005a380
cmp dword [rsp + 0x50], 0
je 0x14004448e
mov rax, qword [rbx + 0x140]
or dword [rbx + 0x68], 0x2000
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x140]
mov qword [rax + 0x18], rbx
lock inc dword [rbx + 0x120]
mov rcx, rbx
call fcn.140048f40
movsxd rcx, dword [rbx + 0x70]
lea rax, [0x140041800]
mov r9, qword [rbx + 0x140]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
movsxd rcx, eax
call fcn.140171070
mov ebp, 0x2f80
mov rsi, rax
test eax, eax
jne 0x140044460
mov rcx, qword gs:[0x58]
mov edi, ebp
add rdi, qword [rcx]
mov rax, qword [rdi]
test rax, rax
jne 0x140044390
call fcn.1401760e4
cmp dword [rax], 0xe8
jne 0x1400444b1
mov rax, qword [rdi]
test rax, rax
jne 0x1400443a9
call fcn.1401760e4
cmp dword [rax], 0xe8
jne 0x140044460
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
cmp rbx, qword [0x14027dff0]
mov rcx, qword [rbx + 0xe0]
jne 0x1400443da
mov qword [0x14027dff0], rcx
jmp 0x1400443ef
mov rax, qword [rbx + 0xe8]
mov qword [rax + 0xe0], rcx
mov rcx, qword [0x14027dff0]
mov rdx, qword [rbx + 0xe0]
test rdx, rdx
je 0x14004440b
mov rax, qword [rbx + 0xe8]
mov qword [rdx + 0xe8], rax
jmp 0x14004441e
test rcx, rcx
je 0x14004441e
mov rax, qword [rbx + 0xe8]
mov qword [rcx + 0xe8], rax
xor eax, eax
lea rcx, [0x14027dfa0]
mov qword [rbx + 0xe0], rax
mov qword [rbx + 0xe8], rax
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
btr eax, 0xd
bts eax, 0x1a
mov dword [rbx + 0x68], eax
or eax, 0xffffffff
lock xadd dword [rbx + 0x120], eax
cmp eax, 1
jne 0x140044460
mov rcx, rbx
call fcn.140040d80
cmp dword [rsp + 0x50], 0
je 0x14004448e
test esi, esi
jne 0x14004449c
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rbp + rcx]
test rax, rax
jne 0x140044486
call fcn.1401760e4
cmp dword [rax], 0xe8
jne 0x14004449c
mov eax, dword [rbx + 0x68]
test al, 0x10
jne 0x14004449c
btr eax, 0xd
mov dword [rbx + 0x68], eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret
lea rdx, str.WriteFileEx_failed:__m
mov ecx, 0x4b0000
call fcn.14002d720
int3
Function at 0x140045550
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov word [rsp + 0x48], dx
mov eax, 0x10624dd3
imul r8d
movsxd rbx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [0x14027dfc8]
mov word [rsp + 0x4a], dx
test rax, rax
je 0x1400455a4
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov ecx, ebx
call rax
mov ebx, eax
jmp 0x1400456e9
cmp qword [0x14027e030], 0
mov qword [rsp + 0x40], rdi
je 0x140045600
mov rax, qword gs:[0x58]
mov edx, 0x22cc
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x140045600
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rdi, rbx
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x140045603
mov ebx, 1
jmp 0x140045605
mov rdi, rbx
xor ebx, ebx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
test ebx, ebx
mov rbx, qword [rax + rdi*8]
jne 0x140045672
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x140045644
cmp dword [rbx + 0xc], 2
jne 0x140045644
cmp word [rbx + 0x6c], 0
jne 0x14004568f
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171070
mov rbx, rax
jmp 0x1400456e4
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x1400456b9
cmp dword [rbx + 0xc], 2
jne 0x1400456b9
cmp word [rbx + 0x6c], 0
je 0x1400456b9
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400456ae
call fcn.1401760e4
mov dword [rax], reloc.WS2_32.dll_shutdown
or ebx, 0xffffffff
jmp 0x1400456e4
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171070
mov ebx, eax
mov rdi, qword [rsp + 0x40]
test ebx, ebx
je 0x140045705
lea r8, str.SO_LINGER
mov ecx, 0x4b0003
lea rdx, str.failed_setsockopt__s_:__m
call fcn.14002d250
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140045710
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x10], edx
push rsi
sub rsp, 0x30
movsxd rbp, ecx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rsi, [rbp*8]
lea rcx, [0x14027dfa0]
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
test byte [rbx + 0x68], 1
jne 0x140045769
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [0x14027dfc8]
mov qword [rsp + 0x40], rdi
or edi, 0xffffffff
test rax, rax
je 0x14004579a
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea edx, [rdi + 7]
mov ecx, ebp
lea r8d, [rdi + 2]
call rax
jmp 0x14004587b
cmp qword [0x14027e030], 0
je 0x1400457ee
mov rax, qword gs:[0x58]
mov edx, 0x22cc
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x1400457ee
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x1400457ee
mov ebx, 1
jmp 0x1400457f0
xor ebx, ebx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
test ebx, ebx
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
je 0x140045852
cmp dword [rbx + 0xc], 2
jne 0x140045852
cmp word [rbx + 0x6c], 0
je 0x140045852
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140045848
call fcn.1401760e4
mov dword [rax], reloc.WS2_32.dll_shutdown
mov eax, edi
jmp 0x14004587b
movsxd rcx, dword [rbx + 0x70]
lea r9, [rsp + 0x48]
mov r8d, 1
mov dword [rsp + 0x20], 4
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171070
test eax, eax
je 0x1400458bd
mov rax, qword [0x14027e030]
mov ecx, 3
test rax, rax
mov edx, 7
cmovne ecx, edx
jne 0x1400458b9
cmp ecx, 5
jbe 0x1400458a5
cmp dword [0x14027e44c], ecx
jl 0x1400458b9
or ecx, 0x4b0000
lea rdx, str.failed_setsockopt_TCP_NODELAY_:__m
call fcn.14002d250
mov edi, eax
mov eax, edi
jmp 0x1400458bf
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x1400458e0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x14027dfa0]
mov dword [rsp + 0x30], edx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rbx, [rbx*8]
lea rcx, [0x14027dfa0]
mov rdi, qword [rbx + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rdi + 0x68]
test al, 1
je 0x1400459d7
test esi, esi
jne 0x140045973
test al, al
jns 0x140045973
movsxd rcx, dword [rdi + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
movsxd rcx, eax
call fcn.140171070
test rax, rax
je 0x140045973
lea rdx, str.WSAEventSelect:__m
mov ecx, 0x4b0003
call fcn.14002d250
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rbx + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
movsxd rcx, dword [rbx + 0x70]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd rcx, eax
call fcn.140171070
test eax, eax
je 0x1400459d7
lea rdx, str.failed_ioctl_FIOBIO_:__m
mov ecx, 0x4b0003
call fcn.14002d250
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
and dword [rdi + 0x68], 0xffffff7f
mov rbx, qword [rsp + 0x38]
neg esi
mov rsi, qword [rsp + 0x40]
sbb eax, eax
and eax, 0x80
or dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x20
pop rdi
ret