joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007a20
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rcx
xor ebx, ebx
xor ecx, ecx
mov ebp, r9d
mov r14d, r8d
mov rdi, rdx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
call fcn.14019a0f4
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.140199ddc
lea r8, str._a___d__b__Y__H:_M:_S_GMT
lea edx, [rbx + 0x40]
lea rcx, [rsp + 0x50]
mov r9, rax
call fcn.140199dc0
lea r8, [rsp + 0x50]
lea rdx, str.Date
mov rcx, rsi
call fcn.140008840
cmp qword [rsi + 8], rbx
je 0x140007ae3
mov r8, qword [rsi + 0x10]
cmp ebp, 2
jne 0x140007ab5
add r8, 3
jmp 0x140007abe
cmp ebp, 1
jne 0x140007abe
add r8, 2
lea rdx, [0x140227a74]
lea rcx, [rsp + 0x50]
call fcn.140197aa8
lea r8, [rsp + 0x50]
lea rdx, str.Content_Length
mov rcx, rsi
call fcn.140008840
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, r14d
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call fcn.1400082f0
mov rbp, qword [rsp + 0x40]
test rbp, rbp
je 0x140007b21
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.140007e30
mov rcx, rbp
call fcn.140026568
lea rdx, str.Connection
mov rcx, rsi
call fcn.140008a30
test rax, rax
je 0x140007b93
lea rdx, str.close
nop dword [rax]
movzx ecx, byte [rax + rbx]
inc rbx
cmp cl, byte [rdx + rbx - 1]
jne 0x140007b93
cmp rbx, 6
jne 0x140007b40
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007b93
lea edx, [rbx - 5]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x140007b70
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14019ac00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140007bc0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r15, r9
mov r13, r8
mov r12, rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov r14d, dword [rsp + 0x420]
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x50], rax
xor esi, esi
xor ecx, ecx
call fcn.14019a0f4
add rax, 0xa
mov qword [rsp + 0x48], rax
cmp qword [r13], rsi
jne 0x140007c46
mov dword [r15], 0x2000
mov ecx, 0x2000
call fcn.140026560
mov qword [r13], rax
xor r14d, r14d
mov eax, dword [r15]
cmp r14d, eax
jl 0x140007c86
mov rbx, qword [r13]
add eax, 0x2000
movsxd rcx, eax
call fcn.140026560
mov qword [r13], rax
movsxd r8, dword [r15]
mov rdx, rbx
mov rcx, rax
call fcn.1401989f0
mov rcx, rbx
call fcn.140026568
mov r14d, dword [r15]
lea eax, [r14 + 0x2000]
mov dword [r15], eax
movsxd rcx, r14d
mov rdi, qword [r13]
add rdi, rcx
mov r8d, dword [r15]
sub r8d, r14d
xor r9d, r9d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
mov rax, qword [rsp + 0x50]
mov dword [rax], r8d
cmp ebx, 0xffffffff
jne 0x140007d1d
mov ecx, r8d
sub ecx, 0x2728
je 0x140007cd6
sub ecx, 0xb
je 0x140007cd6
cmp ecx, 0x14
jne 0x140007d5d
xor ecx, ecx
call fcn.14019a0f4
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x60], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea ecx, [r9 + 0x40]
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x20], 0
je 0x140007d47
cmp ebx, 0xffffffff
je 0x140007d50
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
lea rcx, str.GetFromSocket
call fcn.14000bd10
cmp ebx, 0xffffffff
jne 0x140007df8
test esi, esi
jle 0x140007df8
jmp 0x140007c86
lea rdx, str.HTTP::GetFromSocket_recv_returns__d
lea rcx, [rsp + 0x270]
call fcn.140197aa8
or edx, 0xffffffff
mov rcx, qword [0x14027d2e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d1c0], 0
je 0x140007deb
call fcn.1400093c0
lea rcx, [0x140227eec]
lea rdx, [0x140227ef0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d1c0]
call fcn.140197a78
mov rdi, rax
test rax, rax
je 0x140007deb
lea rcx, [rsp + 0x2b0]
call fcn.14000c3a0
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x2b0]
lea rdx, str._n_s__s_n
mov rcx, rdi
call fcn.14019c35c
mov rcx, rdi
call fcn.14019c0f4
mov rcx, qword [0x14027d2e8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
jmp 0x140007dff
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400093c0
Capabilities:
Move file

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp byte [0x14027d1c0], 0
je 0x1400094f9
cmp dword [0x14027d0a0], 0
je 0x1400094f9
mov qword [rsp + 0x240], rbx
call fcn.140009320
test al, al
je 0x1400094f5
mov r8d, dword [reloc.WS2_32.dll_accept]
lea rdx, str._04d
lea rcx, [rsp + 0x130]
call fcn.140197aa8
or rcx, 0xffffffffffffffff
lea rbx, [0x14027d1c0]
mov rax, rcx
inc rax
cmp byte [rbx + rax], 0
jne 0x140009431
lea rdx, [rsp + 0x130]
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140009442
add rax, rcx
cmp rax, 0x104
ja 0x1400094f5
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rcx + rbx]
lea rcx, [rcx + 1]
mov byte [rsp + rcx + 0x1f], al
test al, al
jne 0x140009460
lea rdx, [rsp + 0x20]
dec rdx
nop dword [rax + rax]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x140009480
lea rcx, [rsp + 0x130]
xor r8d, r8d
nop word [rax + rax]
movzx eax, byte [rcx + r8]
lea r8, [r8 + 1]
mov byte [rdx + r8 - 1], al
test al, al
jne 0x1400094a0
lea rcx, [rsp + 0x20]
call fcn.14019d7d4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14019d68c
test eax, eax
jne 0x1400094d3
inc dword [reloc.WS2_32.dll_accept]
mov al, 1
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x248
ret
xor al, al
jmp 0x1400094d5
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x248
ret
Function at 0x14000a610
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x198
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
movzx eax, word [rsp + 0x1d0]
mov r11, r8
xor r8d, r8d
mov rbx, rcx
mov dword [rcx], r8d
mov ecx, 2
mov dword [rsp + 0x34], r9d
mov r10, rdx
mov word [rsp + 0x32], ax
mov word [rsp + 0x30], cx
lea r9, [rsp + 0x38]
nop dword [rax]
inc r8d
mov byte [r9], 0
lea r9, [r9 + 1]
movsxd rax, r8d
cmp rax, 8
jb 0x14000a660
xor r9d, r9d
lea rax, [rsp + 0x30]
mov rdx, r11
lea r8d, [r9 + 8]
mov rcx, r10
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14000a74c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Broadcast_Send_sendto_returns__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.140197aa8
mov rcx, qword [0x14027d2e8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d1c0], 0
je 0x14000a73d
call fcn.1400093c0
lea rcx, [0x140227eec]
lea rdx, [0x140227ef0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d1c0]
call fcn.140197a78
mov rbx, rax
test rax, rax
je 0x14000a73d
lea rcx, [rsp + 0x80]
call fcn.14000c3a0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, str._n_s__s_n
mov rcx, rbx
call fcn.14019c35c
mov rcx, rbx
call fcn.14019c0f4
mov rcx, qword [0x14027d2e8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000a78e
cmp dword [0x14027d0a0], 0
je 0x14000a790
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsp + 0x34]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, str.Bcast_sent_to__s_port__d
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov r8, rax
call fcn.140197aa8
lea rcx, [rsp + 0x40]
call fcn.14000c2d0
mov eax, edi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x198
pop rdi
pop rbx
ret
Function at 0x14000c470
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
xor edi, edi
call fcn.14019ad10
test rbx, rbx
je 0x14000c54f
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x14027d350], eax
cmp eax, 0xffffffff
je 0x14000c4cc
lea rax, [0x14027d350]
jmp 0x14000c52e
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x14000c4e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000c524
lea edx, [rax + 0x2e]
lea rcx, [rsp + 0x20]
call fcn.140198f58
test rax, rax
je 0x14000c52b
lea rcx, [rsp + 0x20]
mov byte [rax], dil
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x14000c52b
mov rax, qword [rax + 0x18]
mov rdi, qword [rax]
mov rax, rdi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14019ac00
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x14000c4ef
xor eax, eax
jmp 0x14000c52e
Function at 0x14000c570
Capabilities:
Connect socket
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebx, ebx
mov ebp, 2
or rdi, 0xffffffffffffffff
mov rsi, rdx
mov r14, rcx
mov dword [rcx], ebx
mov word [rsp + 0x28], bp
test r8w, r8w
je 0x14000c5ba
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c5dc
lea rcx, str.TrilliumDirector
xor edx, edx
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
jne 0x14000c5d8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c5dc
movzx eax, word [rax + 0x18]
mov rcx, rsi
mov word [rsp + 0x2a], ax
call fcn.14000c470
test rax, rax
je 0x14000c68d
mov eax, dword [rax]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], eax
nop dword [rax]
inc ebx
mov byte [rcx], 0
lea rcx, [rcx + 1]
movsxd rax, ebx
cmp rax, 8
jb 0x14000c600
cmp dword [0x14027d0a0], 0
je 0x14000c654
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsp + 0x2c]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, str.Connecting_to__s_port__d
lea rcx, [rsp + 0x40]
mov r9d, ebx
mov r8, rax
call fcn.140197aa8
lea rcx, [rsp + 0x40]
call fcn.14000c2d0
xor r8d, r8d
mov ecx, ebp
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c68d
lea rdx, [rsp + 0x28]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14000c68d
mov rax, rdi
jmp 0x14000c787
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [r14], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.ConnectToSocket_returns__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.140197aa8
mov rcx, qword [0x14027d2e8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d1c0], 0
je 0x14000c735
call fcn.1400093c0
lea rcx, [0x140227eec]
lea rdx, [0x140227ef0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d1c0]
call fcn.140197a78
mov rbx, rax
test rax, rax
je 0x14000c735
lea rcx, [rsp + 0x80]
call fcn.14000c3a0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, str._n_s__s_n
mov rcx, rbx
call fcn.14019c35c
mov rcx, rbx
call fcn.14019c0f4
mov rcx, qword [0x14027d2e8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c783
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop word [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000c760
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000c7b0
Capabilities:
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebx, ebx
mov rsi, rdx
mov ebp, r8d
mov r14, rcx
mov dword [rcx], ebx
mov r15d, 2
lea edx, [rbx + 1]
xor r8d, r8d
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000c8e5
lea r8, [rsp + 0x28]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x28], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movzx ecx, word [rsi]
mov word [rsp + 0x30], r15w
test ebp, ebp
je 0x14000c833
mov word [rsp + 0x32], cx
jmp 0x14000c867
test cx, cx
je 0x14000c840
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c862
lea rcx, str.TrilliumDirector
xor edx, edx
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
jne 0x14000c85e
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000c862
movzx eax, word [rax + 0x18]
mov word [rsp + 0x32], ax
mov dword [rsp + 0x34], ebx
mov rax, rbx
nop
inc ebx
mov byte [rsp + rax + 0x38], 0
movsxd rax, ebx
mov dword [rsp + 0x24], ebx
cmp rax, 8
jb 0x14000c870
lea rdx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
mov dword [rsp + 0x24], eax
cmp eax, 0xffffffff
je 0x14000c8e5
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
mov edx, 0x7fffffff
mov rcx, rdi
mov word [rsi], ax
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x14000c8e5
mov rax, rdi
jmp 0x14000c9d7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [r14], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.ListenOnSocket_returns__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.140197aa8
mov rcx, qword [0x14027d2e8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x14027d1c0], 0
je 0x14000c97f
call fcn.1400093c0
lea rcx, [0x140227eec]
lea rdx, [0x140227ef0]
test al, al
cmovne rdx, rcx
lea rcx, [0x14027d1c0]
call fcn.140197a78
mov rbx, rax
test rax, rax
je 0x14000c97f
lea rcx, [rsp + 0x80]
call fcn.14000c3a0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
lea rdx, str._n_s__s_n
mov rcx, rbx
call fcn.14019c35c
mov rcx, rbx
call fcn.14019c0f4
mov rcx, qword [0x14027d2e8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9d3
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000c9b0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14019ac00
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ca00
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ebp, 2
mov rsi, rcx
xor ebx, ebx
mov dword [rcx], ebx
mov ecx, ebp
xor r8d, r8d
mov edx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000cb00
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
mov rcx, rax
mov dword [rsp + 0x38], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x34]
lea r8d, [rbx + 0x20]
mov edx, 0xffff
mov rcx, rdi
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea rcx, str.TrilliumDirector
xor edx, edx
mov word [rsp + 0x40], bp
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
jne 0x14000cab4
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
jmp 0x14000cab8
movzx eax, word [rax + 0x18]
mov word [rsp + 0x42], ax
mov dword [rsp + 0x44], ebx
lea rcx, [rsp + 0x48]
nop word [rax + rax]
inc ebx
mov byte [rcx], 0
lea rcx, [rcx + 1]
movsxd rax, ebx
cmp rax, 8
jb 0x14000cad0
lea rdx, [rsp + 0x40]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x14000cb00
mov rax, rdi
jmp 0x14000cb77
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsi], eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.GetBroadcastSocket_returns__d
lea rcx, [rsp + 0x50]
mov r8d, eax
call fcn.140197aa8
lea rcx, [rsp + 0x50]
call fcn.14000c2d0
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000cb73
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rdi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000cb50
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14019ac00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000cba0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [rcx - 1]
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14000cbe3
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
nop
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000cbc0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
add rsp, 0x20
pop rbx
ret
Function at 0x14000cbf0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000cc53
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14000cc48
shr ax, 8
test al, al
jne 0x14000cc48
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x276c
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x1d8
ret
Function at 0x14000d430
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r8d, cx
mov esi, edx
lea rcx, [rsp + 0x34]
xor edx, edx
xor edi, edi
call fcn.14000c570
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d474
mov eax, dword [rsp + 0x34]
jmp 0x14000d545
mov ecx, reloc.WS2_32.dll_ntohl
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [rsp + 0x38], eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_listen
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x38], eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov ecx, eax
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov byte [rsp + 0x44], 1
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htonl]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], eax
lea rax, str.Srv___Srv
mov r9d, esi
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
mov byte [rsp + 0x45], dil
mov qword [rsp + 0x20], rax
call fcn.140009e40
cmp eax, 0xffffffff
jne 0x14000d500
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test rbx, rbx
je 0x14000d543
mov edx, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax]
nop word [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000d520
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14019ac00
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000eb80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1402698e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0xf8]
mov rsi, rcx
mov rcx, qword [r9]
mov r12, rdx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], r15
mov rbx, r9
xor ebp, ebp
call fcn.14000d600
mov rdi, qword [rsp + 0x38]
cmp eax, 0xfffffffe
je 0x14000ed1a
cmp eax, 0xffffffff
je 0x14000ecb8
test eax, eax
je 0x14000ed03
test rdi, rdi
je 0x14000ed91
movzx r8d, byte [rdi + 0xc]
mov ecx, r8d
dec ecx
je 0x14000ec8e
sub ecx, 3
je 0x14000ec76
sub ecx, 2
je 0x14000ec5b
dec ecx
je 0x14000ec4e
cmp ecx, 2
je 0x14000ec3c
lea rdx, str.ProcessLoop_encountered_unexpected_request__2.2x
lea rcx, [rsp + 0x40]
call fcn.140197aa8
lea rcx, [rsp + 0x40]
call fcn.14000c2d0
jmp 0x14000ed84
mov rcx, qword [rbx]
mov rdx, rdi
call fcn.14000f020
mov ebp, eax
jmp 0x14000ed84
mov rcx, qword [rbx]
call fcn.14000a280
jmp 0x14000ed84
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rbx]
mov r9, rdi
mov rcx, rsi
call fcn.14000f110
jmp 0x14000ed84
mov r9, qword [rbx]
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call fcn.14000ef30
jmp 0x14000ed84
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcessId
cmp ebx, eax
je 0x14000ecae
lea rdx, str.Shutdown_request_has_been_received_from_an_external_process
xor ecx, ecx
call qword [rsi + 0x28]
mov ebp, 0xfffffffe
jmp 0x14000ed84
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rsi, qword [rbx]
mov ebp, eax
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ed03
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_shutdown]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rsi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000ece0
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [r14]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14000ed74
mov rax, qword [r15]
mov rdx, qword [rbx]
mov rcx, r15
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x14000ed84
mov rcx, qword [r14]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [rbx]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ed74
mov edx, 1
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_shutdown]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rcx, rsi
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x14000ed51
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test rdi, rdi
je 0x14000ed91
mov rcx, rdi
call fcn.140198554
mov eax, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14019ac00
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret