joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c6600
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x1402c87c0], 1
je 0x1400c6652
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rbx, rcx, 0x10624dd3
shr rbx, 0x26
imul ecx, ebx, 0x3e8
sub eax, ecx
imul r14d, eax, 0x3e8
jmp 0x1400c668e
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x28]
mov qword [rbx], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov rcx, qword [0x1402c87c8]
cqo
idiv rcx
mov rbx, rax
imul rax, rdx, 0xf4240
cqo
idiv rcx
mov r14, rax
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1400c66c6
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140191d70
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r12, 0xffdf3b645a1cac09
movabs r13, 0xffbe76c8b4395813
mov r15d, 0x3e8
mov ebp, 1
jmp 0x1400c6787
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
mov r8, qword [0x1402c87c8]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
sub rcx, rbx
lea rdx, [rcx + r12]
cmp rdx, r13
jb 0x1400c66a6
imul rcx, rcx, 0x3e8
sub eax, r14d
cdqe
imul rax, rax, 0x10624dd3
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x26
add eax, edx
cdqe
add rax, rcx
cmp rax, r15
ja 0x1400c66a6
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400c66a4
cmp byte [0x1402c87c0], 1
je 0x1400c66ea
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400c6724
Function at 0x1400ceaa0
Capabilities:
Get socket status

Disassembly:
push rsi
sub rsp, 0x40
mov r10, qword [rsp + 0x70]
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 0x7fffffff
cmp r10, 0x7fffffff
cmovl rax, r10
test rdx, rdx
je 0x1400ceb87
cmp dword [rdx], 0
je 0x1400ceb87
movabs r11, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r11
xor r11d, r11d
test r10, r10
js 0x1400ceb82
mov esi, 0
je 0x1400ceb1b
mov r10d, eax
imul r11, r10, 0x10624dd3
shr r11, 0x26
imul r10d, r11d, 0x3e8
sub eax, r10d
imul esi, eax, 0x3e8
lea r10, [rsp + 0x30]
mov dword [r10], r11d
mov dword [r10 + 4], esi
xor eax, eax
test r9, r9
je 0x1400ceb36
cmp dword [r9], 0
cmovne rax, r9
xor r9d, r9d
test r8, r8
je 0x1400ceb46
cmp dword [r8], 0
cmovne r9, r8
xor r8d, r8d
test rdx, rdx
je 0x1400ceb55
cmp dword [rdx], 0
cmovne r8, rdx
inc ecx
mov qword [rsp + 0x20], r10
mov rdx, r8
mov r8, r9
mov r9, rax
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140191d70
mov eax, esi
add rsp, 0x40
pop rsi
ret
xor r10d, r10d
jmp 0x1400ceb27
test r8, r8
je 0x1400ceb96
cmp dword [r8], 0
jne 0x1400ceadb
test r9, r9
je 0x1400ceba5
cmp dword [r9], 0
jne 0x1400ceadb
xor esi, esi
test eax, eax
je 0x1400ceb6d
js 0x1400cebb7
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400ceb6d
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, 0xffffffff
jmp 0x1400ceb6d
Function at 0x1400cf1e0
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r9, [rsp + 0x20]
mov qword [r9], rax
mov qword [rsi], 0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x1400cf24b
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140191d70
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15, qword [rsp + 0x20]
test r15, r15
je 0x1400cf276
xor r12d, r12d
xorps xmm6, xmm6
xor edi, edi
jmp 0x1400cf29c
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400cf26f
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor ebx, ebx
test rdi, rdi
jne 0x1400cf288
mov ebx, 0x2af9
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor edi, edi
mov qword [rsi], rdi
jmp 0x1400cf229
mov rbx, r12
mov r15, qword [r15 + 0x28]
mov r12, rbx
test r15, r15
je 0x1400cf25f
mov eax, dword [r15 + 4]
cmp eax, 2
je 0x1400cf2b2
cmp eax, 0x17
jne 0x1400cf28d
mov r14d, 0x1c
jmp 0x1400cf2b8
mov r14d, 0x10
cmp qword [r15 + 0x20], 0
je 0x1400cf28d
cmp qword [r15 + 0x10], r14
jb 0x1400cf28d
mov rax, qword [fcn.140136bd0]
mov ecx, 0x30
call qword [0x1402a3ee8]
test rax, rax
je 0x1400cf392
mov rbx, rax
mov eax, dword [r15]
mov dword [rbx], eax
mov eax, dword [r15 + 4]
mov dword [rbx + 4], eax
mov eax, dword [r15 + 8]
mov dword [rbx + 8], eax
mov eax, dword [r15 + 0xc]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x10], r14d
movups xmmword [rbx + 0x18], xmm6
mov qword [rbx + 0x28], 0
mov rax, qword [fcn.140136bd0]
mov rcx, r14
call qword [0x1402a3ee8]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1400cf382
mov rdx, qword [r15 + 0x20]
mov rcx, rax
mov r8, r14
call fcn.1401cd6e0
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1400cf357
lea r14, [rbx + 0x18]
mov rax, qword [fcn.1401aa570]
call qword [0x1402a3ee8]
mov qword [r14], rax
test rax, rax
je 0x1400cf371
test rdi, rdi
cmove rdi, rbx
test r12, r12
je 0x1400cf290
mov qword [r12 + 0x28], rbx
jmp 0x1400cf290
mov rax, qword [fcn.14018db40]
mov rcx, qword [rbx + 0x20]
call qword [0x1402a3ee8]
mov rax, qword [fcn.14018db40]
mov rcx, rbx
call qword [0x1402a3ee8]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400cf3a2
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ebx, 8
test rdi, rdi
je 0x1400cf286
mov rax, qword [fcn.14018db40]
mov rcx, qword [rdi + 0x20]
call qword [0x1402a3ee8]
mov rax, qword [fcn.14018db40]
mov rcx, qword [rdi + 0x18]
call qword [0x1402a3ee8]
mov r14, qword [rdi + 0x28]
mov rax, qword [fcn.14018db40]
mov rcx, rdi
call qword [0x1402a3ee8]
mov rdi, r14
test r14, r14
jne 0x1400cf3b0
jmp 0x1400cf286
Function at 0x1400d9800
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, r8d
mov rsi, rcx
mov r9, qword [rcx]
lea ecx, [rdi - 0xd]
mov eax, 0x9b0
cmp ecx, 2
ja 0x1400d9829
mov eax, ecx
lea rcx, [0x140296668]
mov rax, qword [rcx + rax*8]
mov r8, qword [r9 + 0x1e0]
lea rcx, [rsi + 0xa00]
mov rax, qword [r9 + rax]
test dl, dl
jne 0x1400d986f
mov edx, dword [rsi + 0xaac]
lea r10d, [rdx + 1]
mov dword [rsi + 0xaac], r10d
test rax, rax
je 0x1400d98c9
test edx, edx
js 0x1400d987e
xor r10d, r10d
mov rax, qword [rax + 8]
cmp r10d, edx
jge 0x1400d9879
inc r10d
test rax, rax
jne 0x1400d985c
jmp 0x1400d9879
mov dword [rsi + 0xaac], 0
test rax, rax
je 0x1400d98c9
mov rax, qword [rax]
xor edx, edx
cmp byte [rax], 0x2a
sete dl
lea r8, [rdx + rax]
mov dword [rsi + 0xab0], edx
lea rdx, [0x1402742d5]
call fcn.1400f6430
test eax, eax
jne 0x1400d98ab
mov dword [rsi + 0xab8], edi
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [r8 + 0x10], 0
je 0x1400d99e6
mov dword [rsi + 0xab8], 0
jmp 0x1400d98a9
xor eax, eax
cmp edi, 0xd
je 0x1400d98b2
cmp edi, 0xe
je 0x1400d99c8
cmp edi, 0xf
je 0x1400d98ab
cmp byte [rsi + 0xa92], 1
jne 0x1400d992e
cmp byte [r9 + 0xf09], 0
jne 0x1400d98ff
cmp dword [r9 + 0x9f8], 0
je 0x1400d99d8
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400d99d8
lea rdx, str.MDTM__s
call fcn.1400f6430
test eax, eax
jne 0x1400d98ab
mov dword [rsi + 0xab8], 0x12
jmp 0x1400d98a9
mov dword [rsi + 0xab0], 0
xor eax, eax
cmp dword [r9 + 0xbac], 2
sete al
mov dword [rsi + 0xab4], eax
cmp byte [rsi + 0x655], 1
jne 0x1400d9984
mov r8, qword [rsi + 0xa70]
test r8, r8
je 0x1400d9984
cmp dword [rsi + 0xa80], 0
je 0x1400d9978
mov rax, qword [rsi + 0xa78]
mov rax, qword [rax]
cmp byte [rax], 0x2f
je 0x1400d9984
mov dword [rsi + 0xa94], 0
jmp 0x1400d99a5
cmp dword [rsi + 0xa80], 0
je 0x1400d98e7
mov dword [rsi + 0xa94], 1
mov rax, qword [rsi + 0xa78]
mov r8, qword [rax]
lea rdx, str.CWD__s
call fcn.1400f6430
test eax, eax
jne 0x1400d98ab
mov dword [rsi + 0xab8], 0x10
jmp 0x1400d98a9
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400d9f20
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400da170
mov rax, qword [rsi + 0xad0]
cmp rax, 0xffffffffffffffff
je 0x1400d9a35
mov ecx, dword [r9 + 0xfa4]
and ecx, 0xffffffbf
xor edx, edx
test rax, rax
cmovg rdx, rax
shr rax, 0x39
and eax, 0xffffffc0
or eax, ecx
xor eax, 0x40
mov qword [r9 + 0xf78], rdx
mov dword [r9 + 0xfa4], eax
mov rdx, qword [rsi + 0xad0]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400d9d90
mov r8, qword [rsi + 0xa88]
cmp byte [r9 + 0xf24], 1
je 0x1400d9a69
lea rdx, str.SIZE__s
call fcn.1400f6430
test eax, eax
jne 0x1400d98ab
mov dword [rsi + 0xab8], 0x18
jmp 0x1400d98a9
lea rdx, str.RETR__s
call fcn.1400f6430
test eax, eax
jne 0x1400d98ab
mov dword [rsi + 0xab8], 0x20
jmp 0x1400d98a9
Function at 0x1400da170
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp byte [rax + 0xf1c], 1
jne 0x1400da1ef
cmp qword [rsi + 0xa88], 0
je 0x1400da1ef
movzx edx, byte [rax + 0xf0b]
movsx r8d, byte [rsi + 0xaa8]
xor edx, 1
lea edx, [rdx*8 + 0x41]
cmp edx, r8d
je 0x1400da1ef
mov dword [rcx + 0x10], 1
mov bl, byte [rax + 0xf0b]
xor bl, 1
shl bl, 3
or bl, 0x41
cmp byte [rsi + 0xaa8], bl
jne 0x1400da268
mov dword [rsi + 0xab8], 0x13
mov rax, qword [rsi]
mov rax, qword [rax + 0x1e0]
mov eax, dword [rax + 0x10]
jmp 0x1400da1f2
mov eax, dword [rcx + 0x10]
test eax, eax
je 0x1400da22a
lea rcx, [rsi + 0xa00]
cmp eax, 1
jne 0x1400da238
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400da22a
lea rdx, str.SIZE__s
call fcn.1400f6430
test eax, eax
jne 0x1400da261
mov dword [rsi + 0xab8], 0x17
jmp 0x1400da25f
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400da2a0
cmp qword [rsi + 0xa88], 0
je 0x1400da22a
lea rdx, str.REST__d
xor r8d, r8d
call fcn.1400f6430
test eax, eax
jne 0x1400da261
mov dword [rsi + 0xab8], 0x1a
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
movzx r8d, bl
lea rcx, [rsi + 0xa00]
lea rdx, str.TYPE__c
call fcn.1400f6430
test eax, eax
jne 0x1400da261
mov dword [rsi + 0xab8], 0x13
mov byte [rsi + 0xaa8], bl
jmp 0x1400da25f

Function at 0x1400da2a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [rcx]
mov rcx, qword [rax + 0x1e0]
cmp dword [rcx + 0x10], 0
je 0x1400da2d9
mov dword [rsi + 0xab8], 0xd
mov rcx, rsi
mov dl, 1
mov r8d, Ordinal_14
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400d9800
cmp byte [rax + 0xf0e], 1
jne 0x1400da2f2
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400da3e0
lea rcx, [rsi + 0xa00]
cmp byte [rax + 0xf11], 1
jne 0x1400da323
mov r8, qword [rsi + 0xa88]
test r8, r8
je 0x1400da38c
cmp byte [rax + 0xf1d], 1
jne 0x1400da383
lea rdx, str.PRET_STOR__s
jmp 0x1400da3b8
mov al, byte [rsi + 0x666]
test al, al
jne 0x1400da33f
cmp byte [rsi + 0x65f], 1
jne 0x1400da33f
mov byte [rsi + 0x666], 1
mov al, 1
xor al, 1
movzx edi, al
lea rax, [rdi + rdi*4]
lea r8, str.EPSV
add r8, rax
lea rdx, [0x1402742d5]
call fcn.1400f6430
test eax, eax
jne 0x1400da3cd
mov dword [rsi + 0xaac], edi
mov dword [rsi + 0xab8], 0x1e
mov rcx, qword [rsi]
lea rdx, str.Connect_data_stream_passively_n
call fcn.1400b0c00
jmp 0x1400da3cb
lea rdx, str.PRET_RETR__s
jmp 0x1400da3b8
mov r8, qword [rax + 0xc08]
test r8, r8
jne 0x1400da3b1
lea rdx, str.NLST
lea r8, str.LIST
cmp byte [rax + 0xf0d], 0
cmovne r8, rdx
lea rdx, str.PRET__s
call fcn.1400f6430
test eax, eax
jne 0x1400da3cd
mov dword [rsi + 0xab8], 0x1d
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400db140
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, qword [rcx]
mov rbx, qword [rcx + 0x4c8]
movaps xmm0, xmmword [0x14026f080]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x70], xmm0
movaps xmmword [rdx + 0x60], xmm0
movaps xmmword [rdx + 0x50], xmm0
movaps xmmword [rdx + 0x40], xmm0
movaps xmmword [rdx + 0x30], xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400db1ed
mov rcx, rsi
mov rdx, rbx
call fcn.1400b6ea0
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rdi
call fcn.1400b0f00
mov ebx, 0x1e
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140191d70
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, [rsp + 0x28]
mov dword [r8], Ordinal_133
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov r14, rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400b6ea0
cmp r14, 0xffffffffffffffff
je 0x1400db1ba
lea rdx, str.Connection_accepted_from_server_n
mov rcx, rdi
call fcn.1400b0c00
mov byte [rsi + 0x660], 0
mov qword [rsi + 0x4c8], r14
lea r8, [rsp + 0x2c]
mov dword [r8], 1
mov rcx, r14
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [rsi + 0xb2c], 1
mov rax, qword [rdi + 0x728]
xor ebx, ebx
test rax, rax
je 0x1400db1ce
test rdi, rdi
je 0x1400db2f4
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400db31b
mov byte [rcx + 0x18a], 1
mov rax, qword [rdi + 0x728]
mov rcx, qword [rdi + 0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a3ee8]
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x1400db30d
mov byte [rcx + 0x18a], 0
test eax, eax
je 0x1400db1ce
mov rdx, qword [rsi + 0x4c8]
cmp rdx, 0xffffffffffffffff
je 0x1400db2e3
mov rcx, rsi
call fcn.1400b6ea0
mov qword [rsi + 0x4c8], 0xffffffffffffffff
mov byte [rsi + 0x653], 0
mov ebx, Ordinal_46
jmp 0x1400db1ce
mov rcx, qword [0x730]
mov rdx, r14
mov r8d, 1
call qword [0x1402a3ee8]
jmp 0x1400db2bb
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400db2b4
jmp 0x1400db2bb
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
jne 0x1400db284
jmp 0x1400db292
Function at 0x1400ddb50
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp edx, 0x1f
jne 0x1400ddcef
mov rdi, rcx
mov rsi, qword [rcx]
mov rbx, qword [rsi + 0x1e0]
lea r12, [rbx + 0x1eb8]
mov word [rbx + 0x1cb8], 0xfaff
lea r14, [rbx + 0x1cbb]
mov qword [rbx + 0x1eb8], r14
mov byte [rbx + 0x1cba], 0x1f
movzx ecx, word [rbx + 0x1ca8]
mov r15, qword [sym.imp.WS2_32.dll_htons]
call r15
mov ebp, eax
movzx ecx, word [rbx + 0x1caa]
call r15
mov r9, qword [rbx + 0x1eb8]
cmp r9, r12
jae 0x1400ddbd1
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400ddbe8
shr ebp, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], bpl
mov r9, qword [r12]
cmp r9, r12
jae 0x1400ddbfc
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400ddc13
shr eax, 8
lea rcx, [r9 + 1]
mov qword [r12], rcx
mov byte [r9], al
mov r9, qword [r12]
cmp r9, r12
jae 0x1400ddc28
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xff
mov r9, qword [r12]
lea r15, [rbx + 0x1cb8]
lea r8, [rbx + 0x1cba]
cmp r9, r12
jae 0x1400ddc4b
lea rax, [r9 + 1]
mov qword [r12], rax
mov byte [r9], 0xf0
mov r9, qword [r12]
mov qword [rbx + 0x1ec0], r9
mov qword [rbx + 0x1eb8], r15
sub r9, r15
add r9, 0xfffffffffffffffe
mov rcx, rsi
mov edx, 0x3e
call fcn.1400ddd00
mov rcx, qword [rdi + 0x4c0]
mov rdx, r15
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400ddca2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400b0f00
mov r8d, 4
mov rcx, rdi
mov rdx, r14
call fcn.1400dd650
add rbx, 0x1cbf
mov rcx, qword [rdi + 0x4c0]
mov rdx, rbx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400ddcef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.1400b0f00
nop
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400eab10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, r9
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x2c], 0x10
mov dword [rsp + 0x28], 1
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x14026f080]
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x1400eacf0
mov rdi, rax
mov qword [rsp + 0x50], 0
mov word [rsp + 0x48], 2
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x4a], 0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsi], xmm0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x28]
mov rcx, rdi
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1400eacb2
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1400eacb2
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1400eacb2
mov rcx, rdi
mov edx, 1
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1400eacb2
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x1400eacb2
lea rdx, [rsp + 0x48]
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400eacb2
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400eacb2
lea r8, [0x140275aa8]
lea rbx, [rsp + 0x30]
mov edx, Ordinal_14
mov rcx, rbx
mov r9, rsi
call fcn.1400bc150
mov rcx, rbx
call fcn.1401b34d0
mov r14, rax
mov rcx, qword [rsi]
mov rdx, rbx
mov r8d, r14d
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp r14, rax
je 0x1400eacf7
mov rbx, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rdi
call rbx
mov rcx, qword [rsi]
call rbx
mov rdi, qword [rsi + 8]
mov ebx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140191d70
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ebx, 0xffffffff
jmp 0x1400eacd5
lea r15, [rsp + 0x3c]
mov rcx, qword [rsi + 8]
xor ebx, ebx
mov rdx, r15
mov r8d, Ordinal_14
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp r14, rax
jne 0x1400eacb2
lea rcx, [rsp + 0x30]
mov rdx, r15
mov r8, r14
call fcn.1401cd530
test eax, eax
jne 0x1400eacb2
jmp 0x1400eaccc
Function at 0x1400ed810
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rsp + 0x90]
mov qword [rax], 0
mov rcx, qword [rcx]
xor edx, edx
mov r8b, 1
call fcn.1400b5e20
test rax, rax
js 0x1400ed8e6
xor r12d, r12d
movabs r13, 0x7fffffffffffffff
mov r15, qword [sym.imp.WS2_32.dll_recv]
mov ebp, 0xffffffff
jmp 0x1400ed89a
movsxd rdx, eax
mov rcx, r14
sub rcx, rdx
je 0x1400ed8fe
test eax, eax
je 0x1400ed8eb
add rsi, rdx
add r12, rdx
mov r14, rcx
mov rcx, qword [rbx]
xor edx, edx
mov r8b, 1
call fcn.1400b5e20
test rax, rax
js 0x1400ed8e6
test rax, rax
cmove rax, r13
mov rcx, rdi
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
mov r9, rax
call fcn.1400cebd0
test eax, eax
jle 0x1400ed8eb
mov rcx, rdi
mov rdx, rsi
mov r8d, r14d
xor r9d, r9d
call r15
cmp eax, 0xffffffff
jne 0x1400ed86c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400ed888
mov ebp, 0x38
jmp 0x1400ed8eb
mov ebp, 0x1c
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add r12, r14
mov rax, qword [rsp + 0x90]
mov qword [rax], r12
xor ebp, ebp
jmp 0x1400ed8eb
Function at 0x1400f5bf0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x1402b3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rcx + 0x58]
mov r12, qword [r14]
mov ebp, dword [r12 + 0x798]
test ebp, ebp
jne 0x1400f5c2a
mov ebp, dword [rdi + 0x50]
cmp byte [0x1402c87c0], 1
je 0x1400f5c56
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400f5c8f
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsi]
mov r8, qword [0x1402c87c8]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
movsxd rsi, ebp
movabs r15, 0x7fffffffffffffff
movabs r13, 0x20c49ba5e353f6
sub rcx, qword [rdi + 0x40]
mov rdx, r15
cmp rcx, r13
jg 0x1400f5ced
movabs rdx, 0xffdf3b645a1cac0a
cmp rcx, rdx
jl 0x1400f5ce9
imul rcx, rcx, 0x3e8
sub eax, dword [rdi + 0x48]
cdqe
imul rax, rax, 0x10624dd3
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x26
add eax, edx
movsxd rdx, eax
add rdx, rcx
jmp 0x1400f5ced
lea rdx, [r15 + 1]
sub rsi, rdx
movsxd r12, dword [r12 + 0x788]
test r12, r12
sete al
or al, bl
jne 0x1400f5d93
cmp byte [0x1402c87c0], 1
je 0x1400f5d32
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
imul edx, ecx, 0x3e8
sub eax, edx
imul eax, eax, 0x3e8
jmp 0x1400f5d6b
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x28]
mov qword [rdi], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rdi]
mov r8, qword [0x1402c87c8]
cqo
idiv r8
mov rcx, rax
imul rax, rdx, 0xf4240
cqo
idiv r8
sub rcx, qword [r14 + 0x490]
cmp rcx, r13
jg 0x1400f5d89
movabs rdx, 0xffdf3b645a1cac0a
cmp rcx, rdx
jge 0x1400f5db4
inc r15
sub r12, r15
cmp rsi, r12
cmovge rsi, r12
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140191d70
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
imul rcx, rcx, 0x3e8
sub eax, dword [r14 + 0x498]
cdqe
imul rax, rax, 0x10624dd3
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x26
add eax, edx
movsxd r15, eax
add r15, rcx
jmp 0x1400f5d89