joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400baf90
Capabilities:
Hash data using djb2

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
lea rcx, [rsp + 0x20]
call fcn.14002c670
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x1400bb002
xor ecx, ecx
call fcn.14000d6a0
xor bl, bl
jmp 0x1400bb089
lea rcx, [rsp + 0x20]
call fcn.140032750
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1400bb030
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400bb020
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x1400bb081
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400bb081
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x1400bb081
call fcn.1401754a0
mov rbx, rax
test rax, rax
je 0x1400bb081
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140175530
test al, al
jne 0x1400bb083
mov rcx, rbx
call fcn.140175500
mov rbx, rax
test rax, rax
jne 0x1400bb060
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x20]
call fcn.14002c7d0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401d42a0
add rsp, 0xc0
pop rbx
ret
Function at 0x1400bb0b0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x1400bb0ee
xor ecx, ecx
call fcn.14000d6a0
xor al, al
jmp 0x1400bb163
test rbx, rbx
je 0x1400bb0ea
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x20]
call fcn.14002c780
nop
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14002ceb0
cmp dword [rdi + 0x10], 0x6119a407
je 0x1400bb188
xor ecx, ecx
call fcn.14000d6a0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.14002c7d0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401d42a0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rdi + 0x18], 0
je 0x1400bb154
lea rcx, [rsp + 0x20]
call fcn.140032750
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1400bb1c0
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400bb1b0
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x1400bb14d
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400bb154
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x1400bb154
call fcn.1401754a0
mov rbx, rax
test rax, rax
je 0x1400bb154
nop dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140175530
test al, al
jne 0x1400bb226
mov rcx, rbx
call fcn.140175500
mov rbx, rax
test rax, rax
jne 0x1400bb200
jmp 0x1400bb154
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x1400bb232
dec eax
mov dword [rdi + 0x20], eax
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.140175570
mov bl, 1
jmp 0x1400bb156

Function at 0x1400bb2e0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x1400bb301
xor ecx, ecx
call fcn.14000d6a0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.140032750
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1400bb330
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400bb320
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x1400bb550
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rdi, rdx
mov rbx, rcx
je 0x1400bb57d
xor ecx, ecx
call fcn.14000d6a0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140032750
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1400bb5b0
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400bb5a0
xor edx, edx
mov r8, rdi
div dword [rbx + 0x14]
mov rcx, rbx
call fcn.1400badf0
test rax, rax
je 0x1400bb570
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401754d0

Function at 0x1400bb5e0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x1400bb61a
xor ecx, ecx
call fcn.14000d6a0
xor al, al
jmp 0x1400bb68d
mov rcx, rsi
call fcn.14003a460
test rdi, rdi
je 0x1400bb616
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14002c670
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x1400bb6a8
xor ecx, ecx
call fcn.14000d6a0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.14002c7d0
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401d42a0
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.140032750
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1400bb6d1
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400bb6c1
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x1400bb67e
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400bb67e
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x1400bb67e
call fcn.1401754a0
mov rbx, rax
test rax, rax
je 0x1400bb67e
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140175530
mov rcx, rbx
test al, al
jne 0x1400bb726
call fcn.140175500
mov rbx, rax
test rax, rax
jne 0x1400bb700
jmp 0x1400bb67e
call fcn.1401754d0
test rax, rax
je 0x1400bb67e
mov rdx, rax
mov rcx, rsi
call fcn.14002cb10
mov bl, 1
jmp 0x1400bb680
Function at 0x1400c2790
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r12, r8
mov rdi, rcx
mov qword [rsp + 0x28], rcx
cmp dword [rcx + 8], 0x62cb09e3
je 0x1400c27cb
xor al, al
jmp 0x1400c2985
xor esi, esi
mov r15d, esi
test rdx, rdx
cmovns r15, rdx
cmp byte [0x1402bb135], sil
je 0x1400c2804
cmp byte [rcx + 0xdc], sil
jne 0x1400c2804
cmp qword [rcx + 0xb8], rsi
jle 0x1400c2804
mov r8, r15
lea rdx, str.consumeProgress
mov rcx, r12
call fcn.14004f4c0
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x20], esi
movzx r14d, byte [rdi + 0xdc]
movzx ebx, r14b
test r14b, r14b
jne 0x1400c28bf
cmp qword [rdi + 0xb8], rsi
jle 0x1400c28bf
mov rbx, qword [rdi + 0xc0]
mov r8, qword [rdi + 0xb8]
mov rdx, rbx
mov rcx, rdi
call fcn.1400c2dd0
mov dword [rsp + 0x20], eax
lea rax, [rbx + r15]
mov qword [rdi + 0xc0], rax
movzx ebx, r14b
cmp rax, qword [rdi + 0xb8]
jle 0x1400c28bf
cmp byte [0x1402bb135], sil
je 0x1400c28b1
mov rax, qword [r12]
lea rdx, str.Amount_consumed_is_greater_than_the_total.
mov rcx, r12
call qword [rax + 0x28]
mov r8, qword [rdi + 0xc0]
lea rdx, str.m_consumed64
mov rcx, r12
call fcn.14004f4c0
mov r8, qword [rdi + 0xb8]
lea rdx, str.m_totalAmount64
mov rcx, r12
call fcn.14004f4c0
movzx ebx, byte [rdi + 0xdc]
mov rax, qword [rdi + 0xb8]
mov qword [rdi + 0xc0], rax
test bl, bl
jne 0x1400c28e0
mov r8, qword [rdi + 0xb8]
test r8, r8
jle 0x1400c28e0
mov rdx, qword [rdi + 0xc0]
mov rcx, rdi
call fcn.1400c2dd0
mov esi, eax
cmp qword [rdi + 0xa8], 0
je 0x1400c297e
test bl, bl
jne 0x1400c29a7
cmp esi, dword [rsp + 0x20]
jbe 0x1400c29a7
cmp esi, dword [rdi + 0xa0]
jbe 0x1400c29a7
call sub.KERNEL32.dll_GetTickCount
mov dword [rdi + 0xb4], eax
cmp byte [rdi + 0xde], bl
je 0x1400c2927
cmp esi, dword [rdi + 0xd4]
je 0x1400c2970
mov dword [rdi + 0xa0], esi
cmp byte [0x1402bb135], 0
je 0x1400c2949
mov r8d, esi
lea rdx, str.percentDoneCB
mov rcx, r12
call fcn.14004f530
nop
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x1400c2966
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400c2a06
cmp byte [rsp + 0x30], 0
je 0x1400c297e
mov byte [rdi + 0xb1], 1
movzx eax, byte [rdi + 0xb1]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401d42a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp byte [rdi + 0xdd], 0
jne 0x1400c297e
cmp dword [rdi + 0xd0], 0
je 0x1400c297e
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
mov ecx, eax
sub ecx, dword [rdi + 0xb4]
mov eax, dword [rdi + 0xd0]
mov r8d, 0x12c
test eax, eax
cmove eax, r8d
cmp ecx, eax
jbe 0x1400c297e
mov dword [rdi + 0xd8], edx
mov dword [rdi + 0xb4], edx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x1400c2a06
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
nop
jmp 0x1400c2970
Function at 0x1400c9380
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable._ckMd5.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x1400c9cc0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rbx
mov rbp, r8
mov dword [rcx + 0xc], 0xefcdab89
mov rdi, rdx
mov dword [rcx + 0x10], 0x98badcfe
mov rsi, rcx
mov dword [rcx + 0x14], 0x10325476
cmp dword [rdx + 0xc08], ebx
jbe 0x1400c9d2f
nop word [rax + rax]
mov r8d, dword [rdi + rbx*4 + 0x808]
mov rcx, rsi
mov rdx, qword [rdi + rbx*8 + 8]
call fcn.1400ca240
inc ebx
cmp ebx, dword [rdi + 0xc08]
jb 0x1400c9d10
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400ca0f0

Function at 0x1400c9d50
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
call fcn.1400ca240
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400ca0f0

Function at 0x1400c9da0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rsi, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, r8
mov dword [rcx + 0x10], 0x98badcfe
mov rdi, rdx
mov dword [rcx + 0x14], 0x10325476
mov rcx, rdx
call fcn.14003f010
mov rcx, rdi
mov ebx, eax
call fcn.14003ece0
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.1400ca240
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400ca0f0
Function at 0x1400c9e20
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1402b87c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rbp, rcx
mov rbx, qword [rsp + 0xd8]
xor edi, edi
mov qword [rcx + 0x18], rdi
mov r12, r9
mov dword [rcx + 8], 0x67452301
mov r15, r8
mov dword [rcx + 0xc], 0xefcdab89
mov r13, rdx
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
call fcn.140011960
mov rsi, rax
test rax, rax
je 0x1400ca050
mov rcx, r13
mov dword [rsp + 0x48], edi
mov byte [rsp + 0x30], 1
call fcn.1400e8860
test al, al
jne 0x1400ca036
nop word [rax + rax]
mov qword [rsp + 0x28], r12
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, r13
call fcn.1400e8ab0
test al, al
je 0x1400ca036
mov r9d, dword [rsp + 0x48]
test r9d, r9d
je 0x1400ca00e
test rbx, rbx
je 0x1400c9f0e
mov r8d, r9d
mov rdx, rsi
mov rcx, rbx
call fcn.14003ab10
mov r9d, dword [rsp + 0x48]
mov edi, r9d
test r9d, r9d
je 0x1400c9ff7
mov eax, dword [rbp + 0x18]
mov r8d, eax
shr r8d, 3
and r8d, 0x3f
lea ecx, [rax + r9*8]
lea eax, [r9*8]
mov dword [rbp + 0x18], ecx
cmp ecx, eax
jae 0x1400c9f3e
inc dword [rbp + 0x1c]
mov eax, edi
mov ebx, 0x40
shr eax, 0x1d
sub ebx, r8d
add dword [rbp + 0x1c], eax
cmp edi, ebx
jb 0x1400c9fc2
test ebx, ebx
je 0x1400c9f82
sub r8, rsi
mov edx, ebx
add r8, rbp
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx + 0x20], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400c9f70
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 8]
call fcn.1400c93f0
lea eax, [rbx + 0x3f]
cmp eax, edi
jae 0x1400c9fb8
nop word [rax + rax]
mov edx, ebx
lea rcx, [rbp + 8]
add rdx, rsi
call fcn.1400c93f0
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, edi
jb 0x1400c9fa0
mov r9d, dword [rsp + 0x48]
xor r8d, r8d
jmp 0x1400c9fc4
xor ebx, ebx
sub edi, ebx
je 0x1400c9ff2
mov eax, ebx
lea rdx, [rbx + rsi]
sub r8, rax
mov ecx, edi
sub r8, rsi
add r8, rbp
nop dword [rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx + 0x20], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400c9fe0
mov rbx, qword [rsp + 0x38]
test r15, r15
je 0x1400ca00e
mov edx, r9d
mov r8, r12
mov rcx, r15
call fcn.1400c2790
test al, al
jne 0x1400ca020
mov rcx, r13
call fcn.1400e8860
test al, al
je 0x1400c9ec0
jmp 0x1400ca036
mov rax, qword [r12]
lea rdx, str.Digest_MD5_aborted_by_application
mov rcx, r12
call qword [rax + 0x28]
mov byte [rsp + 0x30], 0
mov rcx, rsi
call fcn.1401d47d8
mov rdx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.1400ca0f0
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d42a0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ca070
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rsi, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, r8
mov dword [rcx + 0x10], 0x98badcfe
mov rdi, rdx
mov dword [rcx + 0x14], 0x10325476
mov rcx, rdx
call fcn.1400326e0
mov rcx, rdi
mov ebx, eax
call fcn.140032750
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.1400ca240
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400ca0f0

Function at 0x1400ca210
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x1400cbbb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x1400cbbe9
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x1400cbc1b
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x1400cbc35
xor ecx, ecx
call fcn.14000d6a0
cmp dword [rbx + 0xee8], 2
mov rdx, rdi
jne 0x1400cbd09
lea rcx, [rbx + 0x220]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140192260
cmp dword [rcx + 0xee8], 2
jne 0x1400cbbf0
add rcx, 0x220
call fcn.140192040
test rax, rax
je 0x1400cbbf0
mov rdx, rdi
mov rcx, rax
call fcn.140199390
test al, al
je 0x1400cbcde
test sil, sil
jne 0x1400cbc5f
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0x169], 0
je 0x1400cbc78
mov rax, qword [rdi]
lea rdx, str.Checking_SSH_channel...
mov rcx, rdi
call qword [rax + 0x30]
cmp qword [rbx + 0xed8], 0
je 0x1400cbc9d
mov eax, dword [rbx + 0xee0]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rbx + 0xee8], 2
jne 0x1400cbcc7
lea rcx, [rbx + 0x220]
call fcn.140192030
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0x169], 0
je 0x1400cbcf7
mov rax, qword [rdi]
lea rdx, str.SSH_tunnel_is_not_connected.
mov rcx, rdi
call qword [rax + 0x30]
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0xb48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401188d0
add rcx, 0x18
jmp fcn.140190680

Function at 0x1400cbe40
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x1400cbe54
mov rcx, rax
jmp fcn.14019bca0
cmp dword [rcx + 0xee8], 2
jne 0x1400cbe69
add rcx, 0x220
jmp fcn.140192110
add rcx, 0xb48
jmp fcn.140117d80
Function at 0x1400cbfb0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
mov esi, edx
mov rbx, rcx
jne 0x1400cbfe8
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x1400cc018
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x1400cc032
xor ecx, ecx
call fcn.14000d6a0
cmp dword [rbx + 0xee8], 2
jne 0x1400cc03f
lea rcx, [rbx + 0x220]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140192130
cmp dword [rcx + 0xee8], 2
jne 0x1400cbfef
add rcx, 0x220
call fcn.140192040
test rax, rax
je 0x1400cbfef
mov rcx, rax
call fcn.1401980b0
mov rcx, rax
jmp 0x1400cc046
lea rcx, [rbx + 0xb48]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140117f10
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x18]
mov rbx, r8
mov rcx, rdi
mov esi, edx
call fcn.14018ffc0
test rax, rax
jne 0x140192175
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.No_socket_connection.]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x28]
mov r8, rbx
mov edx, esi
mov rcx, rax
call fcn.140117f10
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140190320

Function at 0x1400cc060
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
mov esi, edx
mov rbx, rcx
jne 0x1400cc098
mov rax, qword [rcx + 0xed8]
test rax, rax
je 0x1400cc0c8
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x1400cc0e2
xor ecx, ecx
call fcn.14000d6a0
cmp dword [rbx + 0xee8], 2
jne 0x1400cc0ef
lea rcx, [rbx + 0x220]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401921a0
cmp dword [rcx + 0xee8], 2
jne 0x1400cc09f
add rcx, 0x220
call fcn.140192040
test rax, rax
je 0x1400cc09f
mov rcx, rax
call fcn.1401980b0
mov rcx, rax
jmp 0x1400cc0f6
lea rcx, [rbx + 0xb48]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140117f30
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x18]
mov rbx, r8
mov rcx, rdi
mov esi, edx
call fcn.14018ffc0
test rax, rax
jne 0x1401921e5
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.No_socket_connection.]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x28]
mov r8, rbx
mov edx, esi
mov rcx, rax
call fcn.140117f30
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140190320

Function at 0x1400cc9f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r8, rdx
add rcx, 0xffffffffffffff78
mov dl, 1
jmp fcn.1400cbbb0
Function at 0x1400cca10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov edi, r9d
mov rsi, qword [rsp + 0x88]
mov r12d, r8d
mov r15, rdx
mov byte [rbx], 0
cmp byte [rsi + 0x10], 0
jne 0x1400cca65
mov rcx, qword [rsp + 0x90]
mov rdx, qword [str.Internal_error:_Socket_IO_params_not_valid.__Contact_support_chilkatsoft.com]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor al, al
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
lea rbp, [rcx - 0x88]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r14
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x88], rbp
test r9d, r9d
jne 0x1400ccadc
mov rax, qword [rcx + 0xe50]
mov r8, r14
mov rdx, rsi
test rax, rax
je 0x1400ccaac
mov rcx, rax
call fcn.14019bca0
jmp 0x1400ccacf
cmp dword [rcx + 0xe60], 2
jne 0x1400ccac3
add rcx, 0x198
call fcn.140192110
jmp 0x1400ccacf
add rcx, 0xac0
call fcn.140117d80
test al, al
je 0x1400ccbb1
mov edi, 0x7530
mov rcx, r15
call fcn.14003f010
mov r9d, edi
mov qword [rsp + 0x28], r14
mov r8d, r12d
mov qword [rsp + 0x20], rsi
mov rdx, r15
mov rcx, rbp
mov r13d, eax
call fcn.1400cc4f0
movzx ebp, al
test al, al
je 0x1400ccbb1
mov rcx, r15
call fcn.14003f010
cmp eax, r13d
jbe 0x1400ccb2c
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + htons]
mov byte [rbx], al
mov al, 1
jmp 0x1400ccbb3
call sub.KERNEL32.dll_GetTickCount
mov r12d, eax
xor ebx, ebx
mov rcx, r15
call fcn.14003f010
cmp eax, r13d
jne 0x1400ccb84
cmp ebx, edi
jae 0x1400ccb84
mov r8d, dword [rsp + 0x70]
mov r9d, edi
mov rcx, qword [rsp + 0x88]
mov rdx, r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
call fcn.1400cc4f0
movzx ebp, al
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
cmp eax, r12d
jb 0x1400ccbb1
sub ebx, r12d
cmp ebx, edi
jae 0x1400ccb9d
test bpl, bpl
jne 0x1400ccb36
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + htons]
mov rcx, qword [rsp + 0x80]
mov byte [rcx], al
movzx eax, bpl
jmp 0x1400ccbb3
mov rax, qword [r14]
lea rdx, str.Timed_out......
mov rcx, r14
call qword [rax + 0x28]
mov byte [rsi + 0x28], 1
xor al, al
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret