joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9740
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rcx
call fcn.1400b8cb0
cmp dword [rbx + 0xd0], 0
mov eax, reloc.WS2_32.dll_socket
mov edi, 2
cmovne edi, eax
lea edx, [rax - 0x16]
lea r8d, [rax - 0x11]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov qword [rbx + 0x1d8], rax
je 0x1400b9921
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 1
mov rcx, rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rdx, qword [0x14020e0e8]
mov rcx, qword [rbx + 0x1d8]
mov rdx, qword [rdx + 0x20]
mov r9d, 0x28
mov r8d, 0x402
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rcx, qword [rbx + 0x1d8]
xor eax, eax
cmp edi, 0x17
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
jne 0x1400b9819
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov word [rsp + 0x38], di
lea r8d, [rax + 0x1c]
lea rdx, [rsp + 0x38]
jmp 0x1400b982b
mov word [rsp + 0x38], 2
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400b990a
mov rcx, qword [rbx + 0x1d8]
mov edx, 0x7fffffff
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400b98f3
mov rcx, qword [rbx + 0x1d8]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x30], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400b98dc
movzx eax, word [rsp + 0x60]
cmp ax, 0x17
je 0x1400b988a
cmp ax, 2
jne 0x1400b98c5
movzx eax, word [rsp + 0x62]
test eax, eax
je 0x1400b98c5
movzx ecx, ax
call qword [sym.imp.WS2_32.dll_ntohs]
lea rdx, str.229_Entering_Extended_Passive_Mode___d__r_n
mov rcx, rbx
movzx r8d, ax
call fcn.1400b82d0
mov dword [rbx + 0x1cc], 2
mov dword [rbx + 0x1d0], 1
jmp 0x1400b9941
mov rcx, rbx
call fcn.1400b8cb0
movsx r8d, word [rsp + 0x60]
lea rdx, str.500_Failed_to_enter_passive_mode__invalid_family__d_r_n
jmp 0x1400b9939
mov rcx, rbx
call fcn.1400b8cb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.500_Failed_to_enter_passive_mode__getsockname_failed__d_r_n
jmp 0x1400b9936
mov rcx, rbx
call fcn.1400b8cb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.500_Failed_to_enter_passive_mode__socket_listen__d_r_n
jmp 0x1400b9936
mov rcx, rbx
call fcn.1400b8cb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.500_Failed_to_enter_passive_mode__bind_failed__d_r_n
jmp 0x1400b9936
mov rcx, rbx
call fcn.1400b8cb0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.500_Failed_to_enter_passive_mode__socket_failed__d_r_n
mov r8d, eax
mov rcx, rbx
call fcn.1400b82d0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x1400bb580
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov ecx, 0x2d0
call fcn.1400cf3f0
xor edx, edx
mov r8d, 0x2d0
mov rcx, rax
mov rdi, rax
call fcn.1401a9350
mov qword [rdi + 8], rbx
xor ebx, ebx
mov dword [rdi + 0xb8], ebx
call fcn.1400f40a0
lea r8, [0x1400b9700]
mov r9, rdi
xor edx, edx
mov rcx, rax
call fcn.140016f50
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x90], rax
call fcn.14016e020
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x260], 0xffffffffffffffff
mov dword [rdi + 0xd0], ebx
mov dword [rdi + 0x258], ebx
mov qword [rdi + 0xd8], rax
call fcn.14016e020
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x100], rax
call fcn.14016e020
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x108], rax
mov dword [rdi + 0x114], ebx
call fcn.14016e020
lea rcx, [0x1401b0f62]
mov qword [rdi + 0x158], rax
call fcn.14016e020
mov rcx, qword [rdi + 8]
lea rdx, [rdi + 0x10]
lea r8, [rsp + 0x20]
mov qword [rdi + 0x160], rax
mov dword [rdi + 0x16c], ebx
mov dword [rdi + 0xe0], 1
mov dword [rdi + 0x11c], 0xffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getpeername]
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
cmp word [rsp + 0x30], 0x17
jne 0x1400bb6ca
mov dword [rdi + 0xd0], 1
mov rax, qword [0x14020e0e8]
cmp qword [rax + 0x10], rbx
je 0x1400bb6f6
mov rax, qword [rax + 0x18]
mov qword [rax + 0xc0], rdi
mov rax, qword [0x14020e0e8]
mov rcx, qword [rax + 0x18]
mov qword [rdi + 0xc8], rcx
jmp 0x1400bb701
mov qword [rax + 0x10], rdi
mov qword [rdi + 0xc8], rbx
mov qword [rdi + 0xc0], rbx
mov rax, qword [0x14020e0e8]
lea rdx, str.Connected._r_n
mov rcx, rdi
mov qword [rax + 0x18], rdi
call fcn.1400b80a0
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400bc930
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
nop
nop
nop
nop
mov rax, qword [rdi + 0x1a8]
cmp qword [rdi + 0x1a0], rax
jne 0x1400bc9c3
mov ecx, 0x10000
call fcn.1400cf3f0
cmp qword [rdi + 0x190], r15
mov r11, rax
je 0x1400bc992
mov rax, qword [rdi + 0x198]
mov qword [rax], r11
jmp 0x1400bc999
mov qword [rdi + 0x190], rax
mov qword [r11], r15
add dword [rdi + 0x1b0], 1
lea rax, [r11 + 0x10000]
mov qword [rdi + 0x1a8], rax
lea rax, [r11 + 8]
mov qword [rdi + 0x198], r11
mov qword [rdi + 0x1a0], rax
mov r8d, dword [rdi + 0x1a8]
mov rdx, qword [rdi + 0x1a0]
mov rcx, qword [rdi + 8]
sub r8d, dword [rdi + 0x1a0]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r13, eax
cmp r13d, 0xffffffff
je 0x1400bcb90
test eax, eax
je 0x1400bcb8c
mov rsi, qword [rdi + 0x1a0]
mov rbx, r15
lea rax, [rsi + r13]
mov qword [rdi + 0x1a0], rax
nop
cmp byte [rsi], 0xa
jne 0x1400bcb32
test rbx, rbx
mov byte [rsi], r15b
je 0x1400bca38
mov rdx, rbx
mov rcx, rdi
call fcn.1400bc050
add rsi, 1
mov rbx, rsi
jmp 0x1400bcb36
mov ecx, dword [rdi + 0x1b0]
cmp ecx, 1
jne 0x1400bca62
mov rdx, qword [rdi + 0x198]
mov rcx, rdi
add rdx, 8
call fcn.1400bc050
add rsi, 1
mov rbx, rsi
jmp 0x1400bcb36
mov eax, esi
sub eax, dword [rdi + 0x198]
sub eax, 8
movsxd rdx, eax
lea eax, [rcx - 1]
movsxd rcx, eax
imul rcx, rcx, 0xfff8
lea rcx, [rdx + rcx + 1]
call fcn.1400cf3f0
mov rbp, qword [rdi + 0x190]
cmp rbp, qword [rdi + 0x198]
mov r14, rax
mov r12, rax
je 0x1400bcad1
nop
mov rbx, qword [rbp]
lea rdx, [rbp + 8]
mov r8d, 0xfff8
mov rcx, r12
call fcn.1401a9000
mov rcx, rbp
add r12, 0xfff8
call fcn.1400cf470
cmp rbx, qword [rdi + 0x198]
mov rbp, rbx
jne 0x1400bcaa0
mov rdx, qword [rdi + 0x198]
mov eax, esi
mov rcx, r12
sub eax, dword [rdi + 0x198]
add rdx, 8
sub eax, 8
movsxd r8, eax
call fcn.1401a9000
sub r12, qword [rdi + 0x198]
mov rdx, r14
mov byte [r12 + rsi - 8], r15b
mov rax, qword [rdi + 0x198]
mov rcx, rdi
mov qword [rdi + 0x190], rax
mov dword [rdi + 0x1b0], 1
call fcn.1400bc050
mov rcx, r14
call fcn.1400cf470
add rsi, 1
mov rbx, rsi
jmp 0x1400bcb36
add rsi, 1
sub r13d, 1
jne 0x1400bca10
test rbx, rbx
je 0x1400bc960
mov eax, dword [rdi + 0x1a0]
mov rcx, qword [rdi + 0x198]
mov rdx, rbx
sub eax, ebx
add rcx, 8
movsxd r8, eax
call fcn.1401a9000
mov r11d, dword [rdi + 0x1a0]
mov rax, qword [rdi + 0x198]
sub r11d, ebx
movsxd rcx, r11d
lea rcx, [rcx + rax + 8]
mov qword [rdi + 0x1a0], rcx
jmp 0x1400bc960
xor eax, eax
jmp 0x1400bcba2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400bded0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r14, rdx
xor edi, edi
mov r12d, r9d
lea edx, [rdi + 1]
mov r13, r8
call fcn.1400d56d0
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x1400bdf97
lea rdx, [rsp + 0x38]
mov rcx, rax
mov qword [rsp + 0x68], rsi
call fcn.1400d7960
test eax, eax
je 0x1400bdf89
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x38]
test ebx, ebx
jle 0x1400bdf75
movsxd rcx, ebx
call fcn.1400cf440
test rax, rax
mov rsi, rax
je 0x1400bdf84
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bdf6b
cmp dword [rsp + 0x30], ebx
jne 0x1400bdf6b
mov r9d, r12d
mov r8, r13
mov edx, ebx
mov rcx, rsi
call r14
mov edi, eax
mov rcx, rsi
call fcn.1400cf470
jmp 0x1400bdf84
mov r9d, r12d
mov r8, r13
xor edx, edx
xor ecx, ecx
call r14
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret

Function at 0x1400bdfb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
xor edi, edi
lea edx, [rdi + 1]
call fcn.1400d56d0
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be073
lea r9, [rsp + 0x30]
lea r8d, [rdi + 0x1a]
lea rdx, [rsp + 0x38]
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be06a
cmp dword [rsp + 0x30], 0x1a
jne 0x1400be06a
mov eax, dword [rsp + 0x38]
and eax, 0xffffff00
cmp eax, 0x474e5000
jne 0x1400be06a
cmp dword [rsp + 0x44], 0x52444849
jne 0x1400be06a
mov eax, dword [rsp + 0x48]
movzx ecx, byte [rsp + 0x51]
cmp cl, 2
bswap eax
mov dword [rbx], eax
mov eax, dword [rsp + 0x4c]
bswap eax
mov dword [rbx + 4], eax
movzx eax, byte [rsp + 0x50]
mov dword [rbx + 8], eax
je 0x1400be05f
cmp cl, 4
je 0x1400be05b
cmp cl, 6
jne 0x1400be065
shl eax, 2
jmp 0x1400be062
add eax, eax
jmp 0x1400be062
lea eax, [rax + rax*2]
mov dword [rbx + 8], eax
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401a8fd0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400be0a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
xor ebx, ebx
lea edx, [rbx + 1]
call fcn.1400d56d0
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be118
lea r9, [rsp + 0x70]
lea r8d, [rbx + 0x1e]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be10f
cmp dword [rsp + 0x70], 0x1e
jne 0x1400be10f
cmp word [rsp + 0x30], 0x4d42
jne 0x1400be10f
mov eax, dword [rsp + 0x42]
mov ebx, 1
mov dword [rdi], eax
mov eax, dword [rsp + 0x46]
mov dword [rdi + 4], eax
movzx eax, word [rsp + 0x4c]
mov dword [rdi + 8], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1400be390
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
xor ebx, ebx
lea edx, [rbx + 1]
call fcn.1400d56d0
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be41b
lea r9, [rsp + 0x60]
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be412
cmp dword [rsp + 0x60], 0xa
jne 0x1400be412
cmp dword [rsp + 0x30], 0x38464947
jne 0x1400be412
movzx eax, word [rsp + 0x34]
cmp ax, 0x6139
je 0x1400be3f7
cmp ax, 0x6137
jne 0x1400be412
movzx eax, word [rsp + 0x36]
mov dword [rdi + 8], 8
mov ebx, 1
mov dword [rdi], eax
movzx eax, word [rsp + 0x38]
mov dword [rdi + 4], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400be430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0xf0], rax
movsxd rbp, edx
xor ebx, ebx
mov rdi, r8
lea edx, [rbx + 1]
call fcn.1400d56d0
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400be5e2
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je case.default.0x1400be50e
mov edx, dword [rsp + 0x5c]
xor r8d, r8d
mov rcx, rsi
add rdx, 0xffffffffffffff80
call fcn.1400db900
test eax, eax
je case.default.0x1400be50e
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov r8d, 0x80
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je case.default.0x1400be50e
cmp dword [rsp + 0x30], 0x80
jne case.default.0x1400be50e
cmp byte [rsp + 0x70], 0x54
jne case.default.0x1400be50e
cmp byte [rsp + 0x71], 0x41
jne case.default.0x1400be50e
cmp byte [rsp + 0x72], 0x47
jne case.default.0x1400be50e
cmp ebp, 6
ja case.default.0x1400be50e
lea rcx, [0x140000000]
mov eax, dword [rcx + rbp*4 + 0xbe608]
add rax, rcx
jmp rax
lea rdx, [rsp + 0x73]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017ba10
jmp 0x1400be5d4
lea rdx, [rsp + 0x91]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017ba10
jmp 0x1400be5d4
lea rdx, [rsp + 0xaf]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017ba10
jmp 0x1400be5d4
lea rdx, [rsp + 0xcd]
mov r8d, 4
mov rcx, rdi
call fcn.14017ba10
jmp 0x1400be5d4
lea rdx, [rsp + 0xd1]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14017ba10
jmp 0x1400be5d4
cmp byte [rsp + 0xed], bl
jne case.default.0x1400be50e
movzx eax, byte [rsp + 0xee]
test al, al
je case.default.0x1400be50e
lea rdx, [0x1401b0f64]
movzx r8d, al
mov rcx, rdi
call fcn.140178c40
jmp 0x1400be5d4
movzx eax, byte [rsp + 0xef]
cmp al, 0x7e
jae case.default.0x1400be50e
movzx edx, al
mov rdx, qword [rcx + rdx*8 + 0x1ffcf0]
mov rcx, rdi
call fcn.140178250
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401a8fd0
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c2540
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rsi, rcx
mov qword [rsp + 0x40], r12
xor ebp, ebp
nop
cmp dword [rsi + 0x90], ebp
jne 0x1400c257a
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1400c25df
mov eax, dword [rax + 8]
mov dword [rsi + 0x90], eax
mov rax, qword [rsi + 0x68]
movsxd r8, dword [rsi + 0x90]
mov rcx, qword [rsi]
movsxd rdx, dword [rax + 8]
xor r9d, r9d
add rdx, qword [rax + 0x10]
sub rdx, r8
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400c2734
test eax, eax
je 0x1400c26e8
sub dword [rsi + 0x90], eax
jne 0x1400c2560
mov rax, qword [rsi + 0x68]
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdi, qword [rax]
call fcn.1400cf470
mov rcx, rbx
call fcn.1400cf470
test rdi, rdi
mov qword [rsi + 0x68], rdi
jne 0x1400c2560
mov qword [rsi + 0x70], rbp
jmp 0x1400c2560
cmp dword [rsi + 0x94], ebp
je 0x1400c2741
cmp qword [rsi + 0xc0], 0xffffffffffffffff
je 0x1400c271f
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [rsi + 0xc8]
mov r12d, dword [rsi + 0xb8]
mov ebx, dword [rsi + 0x10c]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x1400c26b9
nop
mov rcx, qword [rsi]
movsxd rax, edi
movsxd rdx, r12d
sub rdx, rax
xor r9d, r9d
mov r8d, edi
add rdx, qword [rsi + 0xb0]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
mov ebx, eax
je 0x1400c26db
test eax, eax
je 0x1400c26e8
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 0xe0]
sub edi, ebx
mov dword [rsi + 0xc8], edi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [rsi + 0xc8]
mov r12d, dword [rsi + 0xb8]
mov ebx, dword [rsi + 0x10c]
lea rcx, [rsi + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x1400c2630
cmp ebx, 1
jne 0x1400c2704
cmp dword [rsi + 0x110], ebp
jne 0x1400c2741
mov rcx, qword [rsi]
mov edx, ebx
mov dword [rsi + 0x110], ebx
call qword [sym.imp.WS2_32.dll_shutdown]
mov eax, ebx
jmp 0x1400c26ea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400c2741
xor eax, eax
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
cmp ebx, 2
je 0x1400c26e8
test ebx, ebx
jne 0x1400c2741
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [rbx + 1]
jmp 0x1400c26ea
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.WS2_32.dll_shutdown]
mov eax, 1
jmp 0x1400c26ea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400c26e8
mov eax, 1
jmp 0x1400c26ea
Function at 0x1400c7700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x198
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea r13, str.main.css
xor esi, esi
mov rbp, rdx
mov rdi, r13
mov r12, rcx
mov ebx, esi
nop
nop
nop
mov rdx, qword [rdi]
mov rcx, rbp
call fcn.14016f200
test eax, eax
je 0x1400c7760
add ebx, 1
add rdi, 0x18
cmp ebx, 8
jb 0x1400c7740
jmp 0x1400c796d
mov rcx, qword [0x14020e1d8]
movsxd rax, ebx
mov qword [rsp + 0x190], r15
lea r15, [rax + rax*2]
mov r8d, 0xa
movzx edx, word [r13 + r15*8 + 0x10]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov rbx, rax
je 0x1400c7965
mov rcx, qword [0x14020e1d8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
movsxd r13, eax
jle 0x1400c7965
mov rcx, qword [0x14020e1d8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbp, rax
je 0x1400c7965
mov rcx, rax
mov qword [rsp + 0x1e0], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov r14, rax
je 0x1400c7954
lea rcx, [rsp + 0x60]
call fcn.1400012c0
mov rdx, qword [0x14020e1d8]
lea rcx, [rsp + 0x60]
call fcn.1400d9a90
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x38]
call fcn.1400da290
lea rcx, [rsp + 0x60]
call fcn.140177510
mov r11, qword [rsp + 0x40]
lea rbx, str.main.css
mov rbx, qword [rbx + r15*8 + 8]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], r11
call fcn.1400012c0
lea rdx, str.200_OK_r_n
mov rcx, r12
call fcn.1400c1c70
lea rdx, str.HTTP_1.0_200_OK_r_n
mov rcx, r12
call fcn.1400c2ea0
lea rdx, str.Server:_Everything_HTTP_Server_r_n
mov rcx, r12
call fcn.1400c2ea0
lea rdx, str.Content_Type:__s_r_n
mov r8, rbx
mov rcx, r12
call fcn.1400c2ea0
lea rdx, str.Content_Length:__I64u_r_n
mov r8, r13
mov rcx, r12
call fcn.1400c2ea0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400c1950
mov r8, qword [rsp + 0x68]
lea rdx, str.Date:__s_r_n
mov rcx, r12
call fcn.1400c2ea0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400c1950
mov r8, qword [rsp + 0x68]
lea rdx, str.Last_Modified:__s_r_n
mov rcx, r12
call fcn.1400c2ea0
lea rdx, str.Cache_Control:_private__max_age3600_r_n
mov rcx, r12
call fcn.1400c2ea0
lea rdx, str.Connection:_Close_r_n
mov rcx, r12
call fcn.1400c2ea0
mov rdx, qword [0x14020df68]
cmp byte [rdx], sil
je 0x1400c7920
mov rcx, r12
call fcn.1400c3110
lea rdx, [0x1401b0f68]
mov rcx, r12
call fcn.1400c2ea0
lea rcx, [rsp + 0x60]
call fcn.140177510
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call fcn.1400c2d70
mov rcx, r12
call fcn.1400c2750
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x190]
mov eax, esi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401a8fd0
add rsp, 0x198
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c8840
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
xor r15d, r15d
mov rax, qword [rdi + 0x58]
cmp qword [rdi + 0x50], rax
jne 0x1400c88aa
mov ecx, 0x10000
call fcn.1400cf3f0
cmp qword [rdi + 0x40], r15
mov r11, rax
je 0x1400c8888
mov rax, qword [rdi + 0x48]
mov qword [rax], r11
jmp 0x1400c888c
mov qword [rdi + 0x40], rax
mov qword [r11], r15
add dword [rdi + 0x60], 1
lea rax, [r11 + 0x10000]
mov qword [rdi + 0x58], rax
lea rax, [r11 + 8]
mov qword [rdi + 0x48], r11
mov qword [rdi + 0x50], rax
mov r8d, dword [rdi + 0x58]
mov rdx, qword [rdi + 0x50]
mov rcx, qword [rdi]
sub r8d, dword [rdi + 0x50]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd r13, eax
cmp r13d, 0xffffffff
je 0x1400c8a3c
test eax, eax
je 0x1400c8a38
mov rsi, qword [rdi + 0x50]
mov rbx, r15
lea rax, [rsi + r13]
mov qword [rdi + 0x50], rax
cmp byte [rsi], 0xa
jne 0x1400c89ed
test rbx, rbx
mov byte [rsi], r15b
je 0x1400c890e
mov rdx, rbx
mov rcx, rdi
call fcn.1400c7aa0
add rsi, 1
mov rbx, rsi
jmp 0x1400c89f1
mov ecx, dword [rdi + 0x60]
cmp ecx, 1
jne 0x1400c8932
mov rdx, qword [rdi + 0x48]
mov rcx, rdi
add rdx, 8
call fcn.1400c7aa0
add rsi, 1
mov rbx, rsi
jmp 0x1400c89f1
mov eax, esi
sub eax, dword [rdi + 0x48]
sub eax, 8
movsxd rdx, eax
lea eax, [rcx - 1]
movsxd rcx, eax
imul rcx, rcx, 0xfff8
lea rcx, [rdx + rcx + 1]
call fcn.1400cf3f0
mov rbp, qword [rdi + 0x40]
cmp rbp, qword [rdi + 0x48]
mov r14, rax
mov r12, rax
je 0x1400c899e
nop
nop
nop
mov rbx, qword [rbp]
lea rdx, [rbp + 8]
mov r8d, 0xfff8
mov rcx, r12
call fcn.1401a9000
mov rcx, rbp
add r12, 0xfff8
call fcn.1400cf470
cmp rbx, qword [rdi + 0x48]
mov rbp, rbx
jne 0x1400c8970
mov rdx, qword [rdi + 0x48]
mov eax, esi
mov rcx, r12
sub eax, dword [rdi + 0x48]
add rdx, 8
sub eax, 8
movsxd r8, eax
call fcn.1401a9000
sub r12, qword [rdi + 0x48]
mov rdx, r14
mov byte [r12 + rsi - 8], r15b
mov rax, qword [rdi + 0x48]
mov rcx, rdi
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x60], 1
call fcn.1400c7aa0
mov rcx, r14
call fcn.1400cf470
add rsi, 1
mov rbx, rsi
jmp 0x1400c89f1
add rsi, 1
sub r13d, 1
jne 0x1400c88e6
test rbx, rbx
je 0x1400c8862
mov eax, dword [rdi + 0x50]
mov rcx, qword [rdi + 0x48]
mov rdx, rbx
sub eax, ebx
add rcx, 8
movsxd r8, eax
call fcn.1401a9000
mov r11d, dword [rdi + 0x50]
mov rax, qword [rdi + 0x48]
sub r11d, ebx
movsxd rcx, r11d
lea rcx, [rcx + rax + 8]
mov qword [rdi + 0x50], rcx
jmp 0x1400c8862
xor eax, eax
jmp 0x1400c8a4e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret