joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800aedc8
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x180115d10
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x26
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x18027a640]
xor rax, rbp
mov qword [rbp + 0x148], rax
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov dword [rbp + 0x34], reloc.WSOCK32.dll_recv
mov rcx, qword [rbp + 0x170]
call fcn.1800b4520
cdqe
lea rcx, [rbp + 0x34]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 8]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x178]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.1800ace6a
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jne 0x180115db2
mov eax, 0xffffffff
jmp 0x180115ddf
cmp dword [rbp + 0x54], 0xffffffff
jne 0x180115ddc
call fcn.1800b3d55
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 0x2733
je 0x180115dcf
cmp dword [rbp + 0x74], 0
jne 0x180115dd5
xor eax, eax
jmp 0x180115ddf
mov eax, 0xffffffff
jmp 0x180115ddf
mov eax, dword [rbp + 0x54]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WSOCK32.dll_bind
call fcn.1800b29eb
mov rax, rdi
mov rcx, qword [rbp + 0x148]
xor rcx, rbp
call fcn.1800afed5
lea rsp, [rbp + 0x158]
pop rdi
pop rbp
ret

Function at 0x1800af1e7
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1801856ec
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x180185779
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x180185779
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180185779
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x180185760
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x18018575a
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x180185762
add rdx, 0x28
jmp 0x18018573f
xor edx, edx
test rdx, rdx
jne 0x18018576b
xor al, al
jmp 0x18018577f
cmp dword [rdx + 0x24], 0
jge 0x180185775
xor al, al
jmp 0x18018577f
mov al, 1
jmp 0x18018577f
xor al, al
jmp 0x18018577f
add rsp, 0x18
ret
Function at 0x1800af264
Capabilities:
Clear file content

Disassembly:
jmp 0x1801e006c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r14d, 1
mov r8d, r14d
xor edx, edx
mov ebp, ecx
call fcn.1800ad4c3
xor edx, edx
lea r8d, [r14 + 1]
mov ecx, ebp
mov r15, rax
call fcn.1800ad4c3
mov rsi, rbx
sub rsi, rax
cmp r15, 0xffffffffffffffff
je 0x1801e01a3
cmp rax, 0xffffffffffffffff
je 0x1801e01a3
xor edi, edi
test rsi, rsi
jle 0x1801e015f
mov r12d, 0x1000
mov edx, r14d
mov ecx, r12d
call fcn.1800b3486
mov rbx, rax
test rax, rax
jne 0x1801e00f9
call fcn.1800aeeb3
mov dword [rax], reloc.WSOCK32.dll_ioctlsocket
jmp 0x1801e0142
mov edx, 0x8000
mov ecx, ebp
call fcn.1800b1c1c
mov r14d, eax
jmp 0x1801e0114
cdqe
sub rsi, rax
test rsi, rsi
jle 0x1801e0153
mov r8d, esi
cmp rsi, r12
mov rdx, rbx
mov ecx, ebp
cmovge r8d, r12d
call fcn.1800b2c2a
cmp eax, 0xffffffff
jne 0x1801e010a
call fcn.1800b12f8
cmp dword [rax], 5
jne 0x1801e0142
call fcn.1800aeeb3
mov dword [rax], reloc.WSOCK32.dll_listen
call fcn.1800aeeb3
mov edi, dword [rax]
mov rcx, rbx
call fcn.1800ac375
jmp 0x1801e01aa
mov edx, r14d
mov ecx, ebp
call fcn.1800b1c1c
jmp 0x1801e0149
jns 0x1801e01aa
xor r8d, r8d
mov rdx, rbx
mov ecx, ebp
call fcn.1800ad4c3
cmp rax, 0xffffffffffffffff
je 0x1801e01a3
mov ecx, ebp
call fcn.1800b4683
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1801e01aa
call fcn.1800aeeb3
mov dword [rax], reloc.WSOCK32.dll_listen
call fcn.1800b12f8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
call fcn.1800aeeb3
mov edi, dword [rax]
xor r8d, r8d
mov rdx, r15
mov ecx, ebp
call fcn.1800ad4c3
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800af9c1
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18019bad0
mov rax, rcx
neg rcx
test rax, 7
je 0x18019baed
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x18019bb48
test al, 7
jne 0x18019bae0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x18019bb01
mov rdx, qword [rax - 8]
test dl, dl
je 0x18019bb72
test dh, dh
je 0x18019bb6c
shr rdx, 0x10
test dl, dl
je 0x18019bb66
test dh, dh
je 0x18019bb60
shr rdx, 0x10
test dl, dl
je 0x18019bb5a
test dh, dh
je 0x18019bb54
shr edx, 0x10
test dl, dl
je 0x18019bb4e
test dh, dh
jne 0x18019bb01
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret
Function at 0x1800afa66
Capabilities:
Query environment variable

Disassembly:
jmp 0x1801fdf90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x1801fe017
mov rbp, rax
cmp word [rax], si
je 0x1801fdfd9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1801fdfc0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1801fdfbc
sub rbp, rbx
add rbp, 2
sar rbp, 1
add rbp, rbp
mov rcx, rbp
call fcn.1800ac087
mov rdi, rax
test rax, rax
je 0x1801fe007
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.1800afefd
mov rsi, rdi
xor ecx, ecx
call fcn.1800ac375
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800aff07
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
jmp 0x1801162f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x18027a640]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov rdx, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x150]
call fcn.1800b456b
nop
mov rax, qword [rbp + 0x150]
lea rcx, vtable.CUdpServer.0
mov qword [rax], rcx
mov rcx, qword [rbp + 0x158]
call fcn.1800b32d3
mov rcx, qword [rbp + 0x150]
add rcx, 0x20
mov rdx, rax
call fcn.1800adc9d
nop
mov rax, qword [rbp + 0x150]
mov byte [rax + 0x58], 0
xor r8d, r8d
mov edx, 2
mov ecx, 2
call fcn.1800ae459
mov rcx, qword [rbp + 0x150]
mov dword [rcx + 0x18], eax
mov dword [rbp + 4], 1
mov rax, qword [rbp + 0x150]
movsxd rax, dword [rax + 0x18]
mov dword [rsp + 0x20], 4
lea r9, [rbp + 4]
mov r8d, 4
mov edx, 0xffff
mov rcx, rax
call fcn.1800b2cc0
mov rax, qword [rbp + 0x150]
movsxd rax, dword [rax + 0x18]
mov dword [rsp + 0x20], 4
lea r9, [rbp + 4]
mov r8d, 0x20
mov edx, 0xffff
mov rcx, rax
call fcn.1800b2cc0
mov r8d, reloc.WSOCK32.dll_recv
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.1800b203b
mov eax, 2
mov word [rbp + 0x28], ax
xor ecx, ecx
call fcn.1800b1f0f
mov dword [rbp + 0x2c], eax
mov rax, qword [rbp + 0x150]
add rax, 0x20
mov rcx, rax
call fcn.1800b1e1f
movzx ecx, ax
call fcn.1800b3463
mov word [rbp + 0x2a], ax
mov rax, qword [rbp + 0x150]
movsxd rax, dword [rax + 0x18]
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp + 0x28]
mov rcx, rax
call fcn.1800adc75
test eax, eax
je 0x1801164b0
mov eax, dword [0x180279134]
add eax, 0x18
lea r9, str.D:WorksQDPQDPV2.1.3_apex_sourcebaseudpnetworkUdpServer.cpp
mov r8d, eax
lea rdx, str.bind_fail
lea rcx, str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.1800afda9
mov ecx, 1
call fcn.1800b4bbf
mov rcx, rax
call fcn.1800b28d8
mov qword [rbp + 0x58], 0
mov rax, qword [rbp + 0x58]
mov byte [rax], 0
mov rax, qword [rbp + 0x150]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WSOCK32.dll_bind
call fcn.1800b29eb
mov rax, rdi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.1800afed5
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1800b0227
Capabilities:
Connect socket

Disassembly:
jmp 0x180183dd2
jmp qword [sym.imp.WSOCK32.dll_connect]

Function at 0x1800b02c7
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x18019abb4
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180240f88]
mov ecx, 2
lea r8, [0x180240f80]
lea rdx, str.FlsGetValue
call fcn.18019a684
mov ecx, ebx
test rax, rax
je 0x18019abee
add rsp, 0x20
pop rbx
jmp qword [0x1802fb020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1800b04b6
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x180115e50
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov rcx, qword [rbp + 0x120]
call fcn.1800b4520
cdqe
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp + 0x128]
mov rdx, qword [rbp + 0x130]
mov rcx, rax
call fcn.1800b2347
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x180115ec7
mov eax, 0xffffffff
jmp 0x180115eee
cmp dword [rbp + 4], 0xffffffff
jne 0x180115eeb
call fcn.1800b3d55
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x2733
jne 0x180115ee4
xor eax, eax
jmp 0x180115eee
mov eax, 0xffffffff
jmp 0x180115eee
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1800b065a
Capabilities:
Query environment variable

Disassembly:
jmp 0x1801fde4c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x1801fdf1e
mov rsi, rax
cmp word [rax], r14w
je 0x1801fde9f
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1801fde87
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x1801fde83
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.1800b2117
movsxd rbp, eax
test eax, eax
je 0x1801fdf1e
mov rcx, rbp
call fcn.1800ac087
mov rdi, rax
test rax, rax
je 0x1801fdf11
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1800b2117
test eax, eax
je 0x1801fdf11
mov rsi, rdi
mov rdi, r14
jmp 0x1801fdf14
mov rsi, r14
mov rcx, rdi
call fcn.1800ac375
jmp 0x1801fdf21
mov rsi, r14
test rbx, rbx
je 0x1801fdf2f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800b0673
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x18019ab04
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x180240f48]
xor ecx, ecx
lea r8, [0x180240f40]
lea rdx, str.FlsAlloc
call fcn.18019a684
test rax, rax
je 0x18019ab3d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1802fb020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1800b0777
Capabilities:
Get geographical location

Disassembly:
jmp 0x1801e2ea0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x180243b08]
mov rbp, rcx
lea r8, [0x180243b00]
lea rdx, str.GetLocaleInfoEx
mov ecx, reloc.WSOCK32.dll_inet_ntoa
call fcn.1801e22ac
mov rcx, rbp
test rax, rax
je 0x1801e2ef6
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [0x1802fb020]
jmp 0x1801e2f0d
xor edx, edx
call fcn.1800af2af
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800b0795
Capabilities:
Terminate process

Disassembly:
jmp 0x180184d98
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1800b08a3
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x1801146a0
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov rcx, qword [rbp + 0x120]
call fcn.1800b4520
cdqe
xor r9d, r9d
mov r8d, dword [rbp + 0x128]
mov rdx, qword [rbp + 0x130]
mov rcx, rax
call fcn.1800b458e
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1801146ff
mov eax, 0xffffffff
jmp 0x180114726
cmp dword [rbp + 4], 0xffffffff
jne 0x180114723
call fcn.1800b3d55
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x2733
jne 0x18011471c
xor eax, eax
jmp 0x180114726
mov eax, 0xffffffff
jmp 0x180114726
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1800b0b5f
Capabilities:
Parse pe header

Disassembly:
jmp 0x1801be428
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1801be17c
Function at 0x1800b1c94
Capabilities:
Set socket configuration

Disassembly:
jmp 0x180116060
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x218]
mov rax, qword [0x18027a640]
xor rax, rbp
mov qword [rbp + 0x1b0], rax
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
xor r8d, r8d
mov edx, 2
mov ecx, 2
call fcn.1800ae459
mov dword [rbp + 0x34], eax
mov dword [rbp + 0x54], 1
movsxd rax, dword [rbp + 0x34]
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x54]
mov r8d, 4
mov edx, 0xffff
mov rcx, rax
call fcn.1800b2cc0
movsxd rax, dword [rbp + 0x34]
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x54]
mov r8d, 0x20
mov edx, 0xffff
mov rcx, rax
call fcn.1800b2cc0
mov r8d, reloc.WSOCK32.dll_recv
xor edx, edx
lea rcx, [rbp + 8]
call fcn.1800b203b
mov eax, 2
mov word [rbp + 8], ax
xor ecx, ecx
call fcn.1800b1f0f
mov dword [rbp + 0xc], eax
mov rcx, qword [rbp + 0x1e8]
call fcn.1800b1e1f
inc eax
movzx ecx, ax
call fcn.1800b3463
mov word [rbp + 0xa], ax
movsxd rax, dword [rbp + 0x34]
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.1800adc75
test eax, eax
je 0x1801161af
mov eax, dword [0x180279130]
add eax, 0x14
lea r9, str.D:WorksQDPQDPV2.1.3_apex_sourcebaseudpnetworkUdpClient.cpp
mov r8d, eax
lea rdx, str.bind_fail_n
lea rcx, str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.1800afda9
mov ecx, 1
call fcn.1800b4bbf
mov rcx, rax
call fcn.1800b28d8
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0x78]
mov byte [rax], 0
mov ecx, 0x30
call fcn.1800ac550
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x198], 0
je 0x18011620d
mov rcx, qword [rbp + 0x1e8]
call fcn.1800b1e1f
mov dword [rbp + 0x1a4], eax
mov rcx, qword [rbp + 0x1e8]
call fcn.1800ac17c
mov ecx, dword [rbp + 0x1a4]
movzx r9d, cx
mov r8, rax
mov edx, dword [rbp + 0x34]
mov rcx, qword [rbp + 0x198]
call fcn.1800b2b85
mov qword [rbp + 0x1a8], rax
jmp 0x180116218
mov qword [rbp + 0x1a8], 0
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WSOCK32.dll_bind
call fcn.1800b29eb
mov rax, rdi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rbp
call fcn.1800afed5
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x1800b24eb
Capabilities:
Terminate process

Disassembly:
jmp 0x18019b9ec
sub rsp, 0x28
mov ecx, reloc.WSOCK32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18019ba06
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
lea ecx, [r8 + 1]
call fcn.1800b3841
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1800b268a
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1801e2cb4
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180243a40]
mov ecx, 5
lea r8, [0x180243a38]
lea rdx, str.FlsGetValue
call fcn.1801e22ac
mov ecx, ebx
test rax, rax
je 0x1801e2cee
add rsp, 0x20
pop rbx
jmp qword [0x1802fb020]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1800b2b26
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x180113df0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
mov rax, qword [0x18027a640]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov rax, qword [rbp + 0x2c0]
lea rcx, vtable.CSocketInit.0
mov qword [rax], rcx
xor eax, eax
mov word [rbp + 0x10], ax
mov eax, 2
mov word [rbp + 0x12], ax
lea rdx, [0x180222804]
lea rcx, [rbp + 0x20]
call fcn.1800aeab2
lea rdx, [0x180222804]
lea rcx, [rbp + 0x121]
call fcn.1800aeab2
mov eax, 0x64
mov word [rbp + 0x14], ax
mov qword [rbp + 0x18], 0
lea rax, [0x180222804]
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x10]
mov cx, 2
call fcn.1800b0b32
lea rdx, [rbp + 0x10]
mov cx, 2
call fcn.1800b0b32
test eax, eax
je 0x180113f03
mov eax, dword [reloc.WSOCK32.dll_ioctlsocket]
add eax, 0xc
lea r9, str.D:WorksQDPQDPV2.1.3_apex_sourcebase_networkSocketInit.cpp
mov r8d, eax
lea rdx, str.Can_not_init_socket
lea rcx, str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.1800afda9
mov ecx, 1
call fcn.1800b4bbf
mov rcx, rax
call fcn.1800b28d8
mov qword [rbp + 0x1c8], 0
mov rax, qword [rbp + 0x1c8]
mov byte [rax], 0
mov rax, qword [rbp + 0x2c0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WSOCK32.dll_accept
call fcn.1800b29eb
mov rax, rdi
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.1800afed5
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret
Function at 0x1800b2b85
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1801158b0
mov word [rsp + 0x20], r9w
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov r8d, dword [rbp + 0x1c8]
mov edx, 1
mov rcx, qword [rbp + 0x1c0]
call fcn.1800b1d5c
nop
mov rax, qword [rbp + 0x1c0]
lea rcx, vtable.CUdpChannel.0
mov qword [rax], rcx
mov dword [rbp + 4], 1
movsxd rax, dword [rbp + 0x1c8]
lea r8, [rbp + 4]
mov edx, 0x8004667e
mov rcx, rax
call fcn.1800b33aa
test eax, eax
jge 0x180115999
call fcn.1800b3d55
cmp eax, 4
jne 0x180115950
jmp 0x180115921
mov eax, dword [reloc.WSOCK32.dll_listen]
add eax, 0x16
lea r9, str.D:WorksQDPQDPV2.1.3_apex_sourcebaseudpnetworkUdpChannel.cpp
mov r8d, eax
lea rdx, str.Can_not_set_FIONBIO_n
lea rcx, str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.1800afda9
mov ecx, 1
call fcn.1800b4bbf
mov rcx, rax
call fcn.1800b28d8
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x28]
mov byte [rax], 0
jmp 0x18011599b
jmp 0x18011599d
jmp 0x180115921
mov dword [rbp + 0x44], 0x100000
mov dword [rbp + 0x64], 4
movsxd rax, dword [rbp + 0x1c8]
mov ecx, dword [rbp + 0x64]
mov dword [rsp + 0x20], ecx
lea r9, [rbp + 0x44]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, rax
call fcn.1800b2cc0
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
je 0x180115a2c
mov eax, dword [reloc.WSOCK32.dll_listen]
add eax, 0x21
lea r9, str.D:WorksQDPQDPV2.1.3_apex_sourcebaseudpnetworkUdpChannel.cpp
mov r8d, eax
lea rdx, str.Can_not_setsockopt_revbuf_n
lea rcx, str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.1800afda9
mov ecx, 1
call fcn.1800b4bbf
mov rcx, rax
call fcn.1800b28d8
mov qword [rbp + 0xa8], 0
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0
mov ecx, reloc.WSOCK32.dll_recv
call fcn.1800ac550
mov qword [rbp + 0x188], rax
mov rax, qword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x188]
mov qword [rax + 0x28], rcx
mov r8d, reloc.WSOCK32.dll_recv
xor edx, edx
mov rax, qword [rbp + 0x1c0]
mov rcx, qword [rax + 0x28]
call fcn.1800b203b
mov rax, qword [rbp + 0x1c0]
mov rax, qword [rax + 0x28]
mov ecx, 2
mov word [rax], cx
movzx ecx, word [rbp + 0x1d8]
call fcn.1800b3463
mov rcx, qword [rbp + 0x1c0]
mov rcx, qword [rcx + 0x28]
mov word [rcx + 2], ax
mov rcx, qword [rbp + 0x1d0]
call fcn.1800af77d
mov rcx, qword [rbp + 0x1c0]
mov rcx, qword [rcx + 0x28]
mov dword [rcx + 4], eax
mov rax, qword [rbp + 0x1c0]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WSOCK32.dll_bind
call fcn.1800b29eb
mov rax, rdi
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x1800b3120
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1801e2d0c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x180243a50]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x180243a48]
call fcn.1801e22ac
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1801e2d4c
call qword [0x1802fb020]
jmp 0x1801e2d52
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800b33c3
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
jmp 0x180114050
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x18027a640]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov r8d, dword [rbp + 0x198]
xor edx, edx
mov rcx, qword [rbp + 0x190]
call fcn.1800b1d5c
nop
mov rax, qword [rbp + 0x190]
lea rcx, vtable.CTcpChannel.0
mov qword [rax], rcx
mov rax, qword [rbp + 0x190]
movzx ecx, byte [rbp + 0x1a0]
mov byte [rax + 0x30], cl
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x30]
test eax, eax
jne 0x180114196
mov dword [rbp + 4], 1
movsxd rax, dword [rbp + 0x198]
lea r8, [rbp + 4]
mov edx, 0x8004667e
mov rcx, rax
call fcn.1800b33aa
test eax, eax
jge 0x180114165
call fcn.1800b3d55
cmp eax, 4
jne 0x18011411c
jmp 0x1801140ed
mov eax, dword [0x180279114]
add eax, 0x19
lea r9, str.D:WorksQDPQDPV2.1.3_apex_sourcebase_tcpnetworkTcpChannel.cpp
mov r8d, eax
lea rdx, str.Can_not_set_FIONBIO_n
lea rcx, str.RuntimeError:_s_in_line__d_of_file__s_n
call fcn.1800afda9
mov ecx, 1
call fcn.1800b4bbf
mov rcx, rax
call fcn.1800b28d8
mov qword [rbp + 0x28], 0
mov rax, qword [rbp + 0x28]
mov byte [rax], 0
jmp 0x180114167
jmp 0x180114169
jmp 0x1801140ed
mov dword [rbp + 0x44], 1
movsxd rax, dword [rbp + 0x198]
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x44]
mov r8d, 1
mov edx, 6
mov rcx, rax
call fcn.1800b2cc0
mov rax, qword [rbp + 0x190]
mov dword [rax + 0x28], 0
mov dword [rbp + 0x94], reloc.WSOCK32.dll_recv
mov rcx, qword [rbp + 0x190]
call fcn.1800b4520
cdqe
lea r8, [rbp + 0x94]
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1800ae576
test eax, eax
jne 0x1801141f0
mov rax, qword [rbp + 0x190]
add rax, 0x28
mov r8d, 4
lea rdx, [rbp + 0x6c]
mov rcx, rax
call fcn.1800afefd
mov rcx, qword [rbp + 0x190]
call fcn.1800b4520
cdqe
lea r8, [rbp + 0x94]
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.1800ac4e7
test eax, eax
jne 0x180114233
mov rax, qword [rbp + 0x190]
add rax, 0x2c
mov r8d, 4
lea rdx, [rbp + 0x6c]
mov rcx, rax
call fcn.1800afefd
nop
mov rax, qword [rbp + 0x190]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WSOCK32.dll_connect
call fcn.1800b29eb
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1800afed5
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret