joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a05
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x1400173d0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], send
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
jmp 0x140017441
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x30], eax
jl 0x1400174e0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x3c], 0
jmp 0x14001746b
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x3c], eax
jge 0x1400174a3
xor r9d, r9d
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x1400174a1
jmp 0x1400174a3
jmp 0x140017461
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x3c], eax
jne 0x1400174b7
mov eax, 0xffffffff
jmp 0x14001756b
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x140017431
cmp dword [rsp + 0x30], 0
jle 0x140017554
mov dword [rsp + 0x40], 0
jmp 0x1400174fb
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x40], eax
jge 0x140017533
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x140017531
jmp 0x140017533
jmp 0x1400174f1
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x40], eax
jne 0x140017544
mov eax, 0xffffffff
jmp 0x14001756b
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x34], eax
jne 0x140017566
mov eax, dword [rsp + 0x34]
jmp 0x14001756b
mov eax, 0xffffffff
add rsp, 0x50
pop rdi
ret
Function at 0x140001aa0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400182f0
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rdi, rsp
mov ecx, 0x28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x30], 0x598
mov rax, qword [rsp + 0xb0]
cmp dword [rax + 0x21c], 0
jne 0x140018351
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x23c], ecx
jmp 0x140018388
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x30]
cmp dword [rax + 0x21c], ecx
jbe 0x14001836c
xor eax, eax
jmp 0x1400185c5
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb0]
mov ecx, dword [rcx + 0x21c]
mov dword [rax + 0x23c], ecx
mov rax, qword [rsp + 0xb0]
mov dword [rax + 0x8c], 0
mov rcx, qword [rsp + 0xb0]
call fcn.14000140b
mov rax, qword [rsp + 0xb0]
add rax, 0x48
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 5
mov edx, 1
mov rcx, rax
call fcn.14000104b
mov dword [rsp + 0x34], 0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001109
lea rcx, [0x1400c78a0]
call fcn.14000158c
mov rcx, qword [rsp + 0xb0]
mov qword [rcx + 0x68], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
jne 0x140018427
lea rcx, [0x1400c78a0]
call fcn.14000158c
mov rcx, qword [rsp + 0xb0]
mov qword [rcx + 0x68], rax
mov dword [rsp + 0x84], 0x40000
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x84]
mov r8d, 0x1001
mov edx, 0xffff
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x84], 0x40000
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x84]
mov r8d, 0x1002
mov edx, 0xffff
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_setsockopt]
movzx r8d, word [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.140001465
test eax, eax
je 0x14001854a
mov rax, qword [rsp + 0xb0]
add rax, 0x80
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xb0]
lea r8, [0x14000127b]
xor edx, edx
xor ecx, ecx
call fcn.14002cb60
mov rcx, qword [rsp + 0xb0]
mov qword [rcx + 0x78], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x78], 0
je 0x140018529
mov dword [rsp + 0x34], 1
mov rax, qword [rsp + 0xb0]
add rax, 0x40
mov rcx, rax
call fcn.1400014dd
jmp 0x140018548
mov r9d, 0x65f
lea r8, [0x1400a5248]
mov edx, 8
mov rcx, qword [rsp + 0xb0]
call fcn.140001afa
jmp 0x14001856c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, str.CUdpSocket::Start
mov edx, 0xb
mov rcx, qword [rsp + 0xb0]
call fcn.140001afa
cmp dword [rsp + 0x34], 0
jne 0x1400185c1
mov rax, qword [rsp + 0xb0]
add rax, 0x48
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 5
xor edx, edx
mov rcx, rax
call fcn.14000104b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0xb0]
call fcn.140001573
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x34]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400a56d0]
call fcn.1400290a0
mov rax, rdi
add rsp, 0xa0
pop rdi
ret
Function at 0x140001adc
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140018ee0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140018f3e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2733
jne 0x140018f3e
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x68]
lea rcx, str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.1400012d5
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x140001ae1
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140016530
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
add rsp, 0x20
pop rdi
ret
Function at 0x140001b13
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140019760
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rdi, rsp
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x98], 0xfffffffffffffffe
xor eax, eax
cmp eax, 1
je 0x140019962
mov rcx, qword [rsp + 0xc0]
call fcn.140001311
mov rcx, qword [rsp + 0xc0]
add rcx, 0xb8
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.1400010f5
nop
lea rcx, [rsp + 0x38]
call fcn.140001460
movzx eax, al
test eax, eax
je 0x140019947
lea rcx, [rsp + 0x38]
call fcn.14000109b
mov rcx, rax
call fcn.1400010ff
mov dword [rsp + 0xa0], eax
lea rcx, [rsp + 0x38]
call fcn.14000109b
mov rcx, rax
call fcn.14000179e
xor r9d, r9d
mov ecx, dword [rsp + 0xa0]
mov r8d, ecx
mov rdx, rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jle 0x14001987f
mov rax, qword [rsp + 0xc0]
add rax, 0x1b8
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001884
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x218]
sub eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xc0]
mov dword [rcx + 0x218], eax
lea rcx, [rsp + 0x68]
call fcn.140001406
jmp 0x140019945
cmp dword [rsp + 0x54], 0xffffffff
jne 0x140019945
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x2733
jne 0x1400198fb
mov rax, qword [rsp + 0xc0]
add rax, 0x1b8
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140001884
nop
lea rcx, [rsp + 0x38]
call fcn.1400013f2
mov rcx, qword [rsp + 0xc0]
add rcx, 0x1e0
mov rdx, rax
call fcn.14000128a
nop
lea rcx, [rsp + 0x88]
call fcn.140001406
nop
lea rcx, [rsp + 0x38]
call fcn.140001519
jmp 0x140019962
mov rax, qword [rsp + 0xc0]
add rax, 0x48
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x74]
mov r8d, 3
mov edx, 1
mov rcx, rax
call fcn.14000104b
mov dword [rsp + 0x94], 0
lea rcx, [rsp + 0x38]
call fcn.140001519
mov eax, dword [rsp + 0x94]
jmp 0x140019967
jmp 0x140019953
lea rcx, [rsp + 0x38]
call fcn.140001519
jmp 0x140019962
lea rcx, [rsp + 0x38]
call fcn.140001519
jmp 0x140019790
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400290a0
mov rax, rdi
add rsp, 0xb0
pop rdi
ret
Function at 0x140016530
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140016530
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rsp
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
add rsp, 0x20
pop rdi
ret

Function at 0x140016670
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140016670
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1f0
mov rdi, rsp
mov ecx, 0x7c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x200]
mov qword [rsp + 0x1e0], 0xfffffffffffffffe
mov rax, qword [0x1400c53c0]
xor rax, rsp
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x200]
call fcn.140001050
mov rax, qword [rsp + 0x200]
lea rcx, vtable.CTcpSocket.0
mov qword [rax], rcx
mov rax, qword [rsp + 0x200]
add rax, 0x40
mov rcx, rax
call fcn.140001195
nop
mov rax, qword [rsp + 0x200]
add rax, 0x60
mov rcx, rax
call fcn.140001195
nop
mov rax, qword [rsp + 0x200]
add rax, 0x80
mov rcx, rax
call fcn.140001195
nop
lea rdx, str.CTcpSocket::CTcpSocket
lea rcx, [0x1400a43e4]
call fcn.1400018d9
lea rdx, [rsp + 0x30]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rsp + 0x200]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x200]
add rax, 0x20
xor ecx, ecx
xchg dword [rax], ecx
mov rax, qword [rsp + 0x200]
mov qword [rax + 0xb0], 0xffffffffffffffff
mov rax, qword [rsp + 0x200]
mov qword [rax + 0xa0], 0
mov rax, qword [rsp + 0x200]
mov qword [rax + 0xa8], 0
mov rax, qword [rsp + 0x200]
mov dword [rax + 0x1c], 0
mov rax, qword [rsp + 0x200]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400a4730]
call fcn.1400290a0
mov rax, rdi
mov rcx, qword [rsp + 0x1e8]
xor rcx, rsp
call fcn.14002a4b0
add rsp, 0x1f0
pop rdi
ret

Function at 0x140016910
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140016910
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
lea rdx, str.CTcpSocket::Disconnect
lea rcx, [0x1400a43f4]
call fcn.1400018d9
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x20], 0
jne 0x140016951
jmp 0x1400169dc
mov eax, 1
mov word [rsp + 0x34], ax
xor eax, eax
mov word [rsp + 0x36], ax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 0x80
mov edx, 0xffff
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov rax, qword [rsp + 0x60]
add rax, 0x20
xor ecx, ecx
xchg dword [rax], ecx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rsp + 0x60]
mov qword [rax + 0xb0], 0xffffffffffffffff
mov rcx, rsp
lea rdx, [0x1400a47e0]
call fcn.1400290a0
add rsp, 0x50
pop rdi
ret
Function at 0x1400173d0
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x1400173d0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov rdi, rsp
mov ecx, shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], send
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x30], eax
jmp 0x140017441
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x30], eax
jl 0x1400174e0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x3c], 0
jmp 0x14001746b
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x3c], eax
jge 0x1400174a3
xor r9d, r9d
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x1400174a1
jmp 0x1400174a3
jmp 0x140017461
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x3c], eax
jne 0x1400174b7
mov eax, 0xffffffff
jmp 0x14001756b
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
jmp 0x140017431
cmp dword [rsp + 0x30], 0
jle 0x140017554
mov dword [rsp + 0x40], 0
jmp 0x1400174fb
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x40], eax
jge 0x140017533
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x140017531
jmp 0x140017533
jmp 0x1400174f1
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x40], eax
jne 0x140017544
mov eax, 0xffffffff
jmp 0x14001756b
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x34], eax
jne 0x140017566
mov eax, dword [rsp + 0x34]
jmp 0x14001756b
mov eax, 0xffffffff
add rsp, 0x50
pop rdi
ret
Function at 0x1400182f0
Capabilities:
Create thread
Set socket configuration

Disassembly:
jmp 0x1400182f0
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rdi, rsp
mov ecx, 0x28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x30], 0x598
mov rax, qword [rsp + 0xb0]
cmp dword [rax + 0x21c], 0
jne 0x140018351
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x23c], ecx
jmp 0x140018388
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rsp + 0x30]
cmp dword [rax + 0x21c], ecx
jbe 0x14001836c
xor eax, eax
jmp 0x1400185c5
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb0]
mov ecx, dword [rcx + 0x21c]
mov dword [rax + 0x23c], ecx
mov rax, qword [rsp + 0xb0]
mov dword [rax + 0x8c], 0
mov rcx, qword [rsp + 0xb0]
call fcn.14000140b
mov rax, qword [rsp + 0xb0]
add rax, 0x48
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 5
mov edx, 1
mov rcx, rax
call fcn.14000104b
mov dword [rsp + 0x34], 0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140001109
lea rcx, [0x1400c78a0]
call fcn.14000158c
mov rcx, qword [rsp + 0xb0]
mov qword [rcx + 0x68], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
jne 0x140018427
lea rcx, [0x1400c78a0]
call fcn.14000158c
mov rcx, qword [rsp + 0xb0]
mov qword [rcx + 0x68], rax
mov dword [rsp + 0x84], 0x40000
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x84]
mov r8d, 0x1001
mov edx, 0xffff
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x84], 0x40000
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x84]
mov r8d, 0x1002
mov edx, 0xffff
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_setsockopt]
movzx r8d, word [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.140001465
test eax, eax
je 0x14001854a
mov rax, qword [rsp + 0xb0]
add rax, 0x80
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xb0]
lea r8, [0x14000127b]
xor edx, edx
xor ecx, ecx
call fcn.14002cb60
mov rcx, qword [rsp + 0xb0]
mov qword [rcx + 0x78], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x78], 0
je 0x140018529
mov dword [rsp + 0x34], 1
mov rax, qword [rsp + 0xb0]
add rax, 0x40
mov rcx, rax
call fcn.1400014dd
jmp 0x140018548
mov r9d, 0x65f
lea r8, [0x1400a5248]
mov edx, 8
mov rcx, qword [rsp + 0xb0]
call fcn.140001afa
jmp 0x14001856c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, str.CUdpSocket::Start
mov edx, 0xb
mov rcx, qword [rsp + 0xb0]
call fcn.140001afa
cmp dword [rsp + 0x34], 0
jne 0x1400185c1
mov rax, qword [rsp + 0xb0]
add rax, 0x48
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 5
xor edx, edx
mov rcx, rax
call fcn.14000104b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0xb0]
call fcn.140001573
mov ecx, dword [rsp + 0x94]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x34]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400a56d0]
call fcn.1400290a0
mov rax, rdi
add rsp, 0xa0
pop rdi
ret
Function at 0x140018ee0
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140018ee0
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rsp
mov ecx, recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140018f3e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x2733
jne 0x140018f3e
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x68]
lea rcx, str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.1400012d5
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x140019590
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x140019590
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rsp
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x50]
xor eax, eax
cmp eax, 1
je 0x140019744
xor r9d, r9d
mov r8d, 0x598
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0xa0]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jle 0x1400196d8
cmp dword [rsp + 0x30], 0x10
jne 0x140019643
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [0x1400a5238]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0xa0]
call fcn.14002d1c0
test eax, eax
jne 0x140019643
mov rax, qword [rsp + 0x50]
add rax, 0x48
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 5
mov edx, 1
mov rcx, rax
call fcn.14000104b
xor eax, eax
jmp 0x140019749
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x50]
add rax, 0x268
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 0x244]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x50]
mov r9, qword [rcx + 0x250]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0xa0]
mov rcx, rax
call fcn.140001613
cmp eax, 2
jne 0x1400196d6
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x68]
lea rcx, str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.1400012d5
mov ecx, 0x4c7
call fcn.1400011d6
mov rcx, qword [rsp + 0x50]
add rcx, 0x48
mov dword [rsp + 0x20], 1
mov r9d, eax
mov r8d, 4
mov edx, 1
call fcn.14000104b
xor eax, eax
jmp 0x140019749
jmp 0x14001973f
cmp dword [rsp + 0x30], 0xffffffff
jne 0x14001973f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x2733
jne 0x1400196f7
jmp 0x140019744
cmp dword [rsp + 0x34], 0x2744
je 0x14001970b
cmp dword [rsp + 0x34], 0x2746
jne 0x140019712
jmp 0x1400195ae
mov rax, qword [rsp + 0x50]
add rax, 0x48
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x34]
mov r8d, 4
mov edx, 1
mov rcx, rax
call fcn.14000104b
xor eax, eax
jmp 0x140019749
jmp 0x1400195ae
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x140019760
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140019760
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov rdi, rsp
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x98], 0xfffffffffffffffe
xor eax, eax
cmp eax, 1
je 0x140019962
mov rcx, qword [rsp + 0xc0]
call fcn.140001311
mov rcx, qword [rsp + 0xc0]
add rcx, 0xb8
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.1400010f5
nop
lea rcx, [rsp + 0x38]
call fcn.140001460
movzx eax, al
test eax, eax
je 0x140019947
lea rcx, [rsp + 0x38]
call fcn.14000109b
mov rcx, rax
call fcn.1400010ff
mov dword [rsp + 0xa0], eax
lea rcx, [rsp + 0x38]
call fcn.14000109b
mov rcx, rax
call fcn.14000179e
xor r9d, r9d
mov ecx, dword [rsp + 0xa0]
mov r8d, ecx
mov rdx, rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jle 0x14001987f
mov rax, qword [rsp + 0xc0]
add rax, 0x1b8
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140001884
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x218]
sub eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0xc0]
mov dword [rcx + 0x218], eax
lea rcx, [rsp + 0x68]
call fcn.140001406
jmp 0x140019945
cmp dword [rsp + 0x54], 0xffffffff
jne 0x140019945
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x2733
jne 0x1400198fb
mov rax, qword [rsp + 0xc0]
add rax, 0x1b8
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140001884
nop
lea rcx, [rsp + 0x38]
call fcn.1400013f2
mov rcx, qword [rsp + 0xc0]
add rcx, 0x1e0
mov rdx, rax
call fcn.14000128a
nop
lea rcx, [rsp + 0x88]
call fcn.140001406
nop
lea rcx, [rsp + 0x38]
call fcn.140001519
jmp 0x140019962
mov rax, qword [rsp + 0xc0]
add rax, 0x48
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0x74]
mov r8d, 3
mov edx, 1
mov rcx, rax
call fcn.14000104b
mov dword [rsp + 0x94], 0
lea rcx, [rsp + 0x38]
call fcn.140001519
mov eax, dword [rsp + 0x94]
jmp 0x140019967
jmp 0x140019953
lea rcx, [rsp + 0x38]
call fcn.140001519
jmp 0x140019962
lea rcx, [rsp + 0x38]
call fcn.140001519
jmp 0x140019790
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_closesocket
call fcn.1400290a0
mov rax, rdi
add rsp, 0xb0
pop rdi
ret