joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048800
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x140270f40]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rax + rbx*8]
call fcn.14002e7d0
cmp dword [rbx + 0xc], 2
jne 0x140048780
cmp esi, 0x10
jae 0x140048692
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048679
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x1400486ac
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x140048780
cmp word [rbx + 0x6c], 0
je 0x140048780
mov rcx, rbx
call fcn.14004a200
test eax, eax
jne 0x14004867f
mov eax, dword [rdi + 4]
test eax, eax
je 0x14004871e
cmp eax, dword [rbx + 0x9c]
je 0x14004871e
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140048705
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x140048763
movzx eax, word [rdi + 2]
test ax, ax
je 0x140048763
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140048800
cmp dword [0x14027103c], 0
je 0x14004879e
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.14002ecc0
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140170a40
cmp dword [0x14027103c], 0
mov rdi, rax
je 0x1400487c7
call fcn.14002f160
test edi, edi
jne 0x1400487ed
cmp dword [rbx + 0xc], 2
jne 0x1400487ed
cmp word [rbx + 0x94], di
jne 0x1400487ed
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140048800
test eax, eax
jne 0x14004867f
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
je 0x14004883a
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400490e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x68]
or rdi, 0xffffffffffffffff
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
bt eax, 0x1a
jae 0x140049135
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x14004912a
call fcn.140174cc4
mov dword [rax], 0x2746
jmp 0x1400492e2
cmp word [rcx + 0x6c], 0
je 0x1400491f5
mov rcx, qword [rcx + 0x80]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.14004de60
movsxd rax, dword [rsp + 0x50]
mov r9d, r14d
movsxd rcx, dword [rbx + 0x70]
cmp rsi, rax
mov rdx, qword [rsp + 0x28]
cmovb rax, rsi
mov r8d, eax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140170a40
mov rsi, rax
test eax, eax
jns 0x1400492e2
mov rcx, qword gs:[0x58]
mov eax, 0x2fe0
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x1400491ae
call fcn.140174cc4
cmp dword [rax], 0x2738
jne 0x1400492e2
mov rcx, qword [rbx + 0x80]
mov edx, esi
call fcn.14004ded0
cmp dword [rsp + 0x70], 0
jne 0x1400491ed
mov rcx, qword [rbx + 0x80]
mov r8d, esi
mov rdx, rbp
call fcn.140044a20
mov rcx, qword [rbx + 0x80]
call fcn.14004df30
movsxd rax, esi
jmp 0x1400492e5
test eax, 0x4080
jne 0x140049237
bt eax, 0xa
jb 0x14004920f
call fcn.140044e00
test eax, eax
jne 0x14004910b
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jae 0x140049237
nop dword [rax + rax]
mov edx, 1
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jb 0x140049220
bt eax, 0xe
jae 0x1400492a7
mov rcx, qword [rbx + 0x80]
call fcn.14004e0e0
test eax, eax
je 0x140049285
cmp dword [rsp + 0x70], 0
mov edi, eax
jne 0x140049285
mov rcx, qword [rbx + 0x80]
mov rdx, rbp
cdqe
cmp rax, rsi
cmovb rsi, rax
mov r8d, esi
call fcn.140044a20
test byte [rbx + 0x68], 0x20
mov edi, eax
jne 0x14004928b
mov rcx, qword [rbx + 0x80]
call fcn.14004df30
test byte [rbx + 0x68], 0x20
je 0x14004929b
mov rcx, qword [rbx + 0x80]
call fcn.14004e0e0
test eax, eax
jne 0x1400492a2
and dword [rbx + 0x68], 0xffffbfff
movsxd rax, edi
jmp 0x1400492e5
test al, al
mov edx, 0x2fe0
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
jns 0x1400492d2
test rax, rax
jne 0x1400492ca
call fcn.140174cc4
mov dword [rax], 0x2733
jmp 0x1400492e2
test rax, rax
jne 0x1400492dc
call fcn.140174cc4
mov dword [rax], 0x2714
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400497f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rdi
sub rsp, 0x70
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov r13d, r9d
mov qword [rax - 0x38], r15
call fcn.14004ddc0
mov r10, qword [rsp + 0xb0]
mov rdi, rax
movzx ebx, word [rsi + 0x94]
mov ebp, 0x1c
mov r12d, dword [rsi + 0x9c]
mov dword [rsp + 0x90], reloc.WS2_32.dll_recv
movzx eax, word [r10 + 2]
mov r15d, dword [r10 + 4]
mov word [rsp + 0xb0], ax
test bx, bx
jne 0x1400498ff
xor eax, eax
mov qword [rsp + 0x58], r14
movsxd r14, dword [rsi + 0x90]
lea r8d, [rbp - 0xc]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov eax, 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rcx, r14
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], ebx
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
je 0x1400498c2
lea rdx, str.bind_failed__m
mov ecx, 0x580003
call fcn.140028e10
jmp 0x1400498fa
lea r8, [rsp + 0x30]
mov rcx, r14
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
je 0x1400498f5
lea rdx, str.getsockname_failed__m
mov ecx, 0x580003
call fcn.140028e10
jmp 0x1400498fa
movzx ebx, word [rsp + 0x42]
mov r14, qword [rsp + 0x58]
mov r8d, dword [rsp + 0xa0]
mov rcx, rdi
mov rdx, qword [rsp + 0x98]
mov word [rsi + 0x94], bx
call fcn.14004dcb0
movzx r8d, word [rsp + 0xb0]
mov r9d, r12d
movzx edx, bx
mov dword [rsp + 0x20], r15d
mov rcx, rdi
call fcn.1400500b0
mov r9b, reloc.WS2_32.dll_recvfrom
mov r8d, r15d
mov edx, r12d
mov rcx, rdi
call fcn.14004ffb0
cmp word [rsi + 0x6c], 0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x68]
je 0x140049975
mov edx, dword [rsi + 0x68]
mov rcx, rdi
and edx, 0x200000
shl edx, 4
call fcn.14004dd40
mov ebp, 0x20
lea r8, [rsp + 0x90]
mov rcx, rdi
lea rdx, [rsp + 0x38]
call fcn.14004de10
movsxd r8, dword [rsp + 0x90]
mov r9d, r13d
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140049400
mov r13, qword [rsp + 0x60]
mov ebx, eax
mov rsi, qword [rsp + 0xa8]
test eax, eax
jle 0x1400499b7
sub ebx, ebp
mov rcx, rdi
call fcn.14004dc80
movsxd rax, ebx
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400499d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rbx, ecx
mov rsi, r8
lea rcx, [0x140270f40]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea r14, [rbx*8]
lea rcx, [0x140270f40]
mov rbx, qword [r14 + rax]
call fcn.14002e7d0
cmp qword [rbx + 0x40], 0
je 0x140049a8b
cmp dword [rbx + 0xc], 2
jne 0x140049a8b
cmp word [rbx + 0x6c], 0
je 0x140049a8b
cmp dword [rsi], 0x10
jae 0x140049a5c
mov rax, qword gs:[0x58]
mov edx, 0x2fe0
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140049a51
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
jmp 0x140049ad2
mov dword [rsi], reloc.WS2_32.dll_recv
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov eax, 2
mov word [rdi], ax
mov eax, dword [rbx + 0x9c]
mov dword [rdi + 4], eax
movzx eax, word [rbx + 0x94]
mov word [rdi + 2], ax
xor eax, eax
jmp 0x140049ad2
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [r14 + rax]
call fcn.14002e7d0
cmp qword [rbx + 0x40], 0
jne 0x140049ac7
movsxd rcx, dword [rbx + 0x70]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x140049aca
or eax, 0xffffffff
movsxd rcx, eax
call fcn.140170a40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140049b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x140270f40]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rax + rbx*8]
call fcn.14002e7d0
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140049c57
test al, 1
je 0x140049bc7
cmp qword [rbx + 0x40], 0
je 0x140049b96
cmp dword [rbx + 0xc], 2
jne 0x140049b96
cmp word [rbx + 0x6c], 0
jne 0x140049bc7
mov rax, qword [rsp + 0x68]
mov r9d, edi
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
movsxd rcx, eax
call fcn.140170a40
jmp 0x140049c42
test eax, 0x80000004
jne 0x140049c08
cmp qword [rbx + 0x40], 0
je 0x140049be2
cmp dword [rbx + 0xc], 2
jne 0x140049be2
cmp word [rbx + 0x6c], 0
jne 0x140049c08
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x76d
lea rdx, str.vsock_recvfrom
mov ecx, 0x580202
call fcn.140029040
cdqe
jmp 0x140049c42
cmp dword [rbx + 0xc], 0
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x140049c29
mov dword [rsp + 0x20], 0
call fcn.1400490e0
jmp 0x140049c42
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140049300
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.recvfrom_from_non_packet_socket
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x140049c80
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x140270f40]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rax + rbx*8]
call fcn.14002e7d0
mov eax, dword [rbx + 0x68]
test al, 0x40
jne 0x140049cef
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x72e
lea rdx, str.vsock_send
mov ecx, 0x580202
call fcn.140029040
mov eax, dword [rbx + 0x68]
mov rcx, qword [rbx + 0x40]
test eax, 0x80000004
jne 0x140049d54
test rcx, rcx
je 0x140049d0c
cmp dword [rbx + 0xc], 2
jne 0x140049d0c
cmp word [rbx + 0x6c], 0
jne 0x140049d54
test al, 1
je 0x140049d30
movsxd rcx, dword [rbx + 0x70]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
call fcn.140170a40
jmp 0x140049db3
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x733
lea rdx, str.vsock_send
mov ecx, 0x580202
call fcn.140029040
jmp 0x140049db1
test rcx, rcx
je 0x140049da0
cmp dword [rbx + 0xc], 2
jne 0x140049da0
cmp word [rbx + 0x6c], 0
je 0x140049da0
bt eax, 0x18
jae 0x140049dc8
cmp dword [rbx + 0x14], 0x11
lea rax, [rbx + 0xb0]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x140049d99
call fcn.1400497f0
jmp 0x140049db1
call fcn.140049700
jmp 0x140049db1
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140049400
cdqe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cannot_use_send_when_socket_not_connected
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x140049de0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
movsxd rbx, ecx
mov esi, r9d
lea rcx, [0x140270f40]
mov rbp, r8
mov r14, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rbx, qword [rax + rbx*8]
call fcn.14002e7d0
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140049f41
test eax, 0x80000004
jne 0x140049ea3
cmp qword [rbx + 0x40], 0
je 0x140049e4a
cmp dword [rbx + 0xc], 2
jne 0x140049e4a
cmp word [rbx + 0x6c], 0
jne 0x140049ea3
test al, 1
je 0x140049e7d
mov eax, dword [rsp + 0x68]
mov r9d, esi
movsxd rcx, dword [rbx + 0x70]
mov r8d, ebp
mov dword [rsp + 0x28], eax
mov rdx, r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
movsxd rcx, eax
call fcn.140170a40
jmp 0x140049ec7
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x783
lea rdx, str.vsock_sendto
mov ecx, 0x580202
call fcn.140029040
cdqe
jmp 0x140049ec7
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x140049edd
mov ecx, dword [rbx]
mov r9d, esi
mov r8, rbp
mov rdx, r14
call fcn.140049c80
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
cmp dword [rbx + 0xc], 2
jne 0x140049f53
cmp dword [rbx + 0x14], 0x11
jne 0x140049f1b
mov rcx, rbx
call fcn.14004a200
test eax, eax
je 0x140049efb
or rax, 0xffffffffffffffff
jmp 0x140049ec2
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.1400497f0
jmp 0x140049ec2
cmp dword [rbx + 0x10], 3
jne 0x140049f53
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140049700
jmp 0x140049ec2
lea rdx, str.sendto_to_non_packet_socket
mov ecx, 0x580000
call fcn.1400292e0
int3
lea rdx, str.invalid_socket_address
mov ecx, 0x580000
call fcn.1400292e0
int3
Function at 0x14004a0c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x140270f40]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x140270fc0]
lea rcx, [0x140270f40]
mov rdi, qword [rax + rbx*8]
call fcn.14002e7d0
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
lea rbx, [rdi + 0x150]
test dword [rdi + 0x68], 0x800000
jne 0x14004a1c0
movsxd rcx, dword [rdi + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14004a13e
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x24]
lea r8, [rsp + 0x40]
mov dword [rbx + 4], eax
lea rdx, [rsp + 0x20]
movzx eax, word [rsp + 0x22]
mov dword [rbx + 8], eax
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
movsxd rcx, dword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14004a12b
cmp dword [rdi + 0x54], eax
je 0x14004a17b
movups xmm0, xmmword [rdi + 0x50]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x20]
shr rax, 0x20
mov dword [rbx + 0xc], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x10
movzx ecx, ax
mov dword [rbx + 0x10], ecx
test esi, esi
je 0x14004a1a3
mov eax, dword [rbx + 8]
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov dword [rbx], 5
call fcn.140047cb0
test eax, eax
jne 0x14004a12b
or dword [rdi + 0x68], 0x800000
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140055700
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
or ebx, 0xffffffff
mov rcx, qword [rdx]
xor esi, esi
mov rdi, rdx
test rcx, rcx
je 0x14005572f
call fcn.140174cec
mov qword [rdi], rsi
mov edx, 1
mov ecx, 0x400
call fcn.140174ce4
lea r9, [rsp + 0x38]
mov qword [rdi], rax
mov r8d, 0x400
mov rdx, rax
mov rcx, rbp
call sub.PSAPI.DLL_EnumProcessModules
movsxd rcx, eax
call fcn.140170a40
test rax, rax
jne 0x1400557a5
cmp dword [0x140271494], 6
jl 0x14005577e
lea rdx, str.EnumProcessModules_failed:__m
mov ecx, 0x650006
call fcn.140028e10
mov rcx, qword [rdi]
test rcx, rcx
je 0x14005578e
call fcn.140174cec
mov qword [rdi], rsi
mov rbp, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov ebx, dword [rsp + 0x38]
shr ebx, 3
cmp ebx, 0x80
jb 0x14005578e
mov rcx, qword [rdi]
lea esi, [rbx + rbx]
mov edx, esi
shl rdx, 3
call fcn.140180120
lea r8d, [rsi*8]
mov qword [rdi], rax
lea r9, [rsp + 0x38]
mov rdx, rax
mov rcx, rbp
call sub.PSAPI.DLL_EnumProcessModules
movsxd rcx, eax
call fcn.140170a40
test rax, rax
je 0x1400557fa
mov ebx, dword [rsp + 0x38]
shr ebx, 3
cmp ebx, esi
jae 0x14005580c
jmp 0x14005578e
lea rdx, str.EnumProcessModules_2nd_failed:__m
mov ecx, 0x650000
call fcn.1400292e0
int3
lea rdx, str.EnumProcessModules_no_space
mov ecx, 0x650000
call fcn.1400292e0
int3
Function at 0x140055960
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbp, r8
xor edx, edx
mov ebx, r9d
mov rsi, rcx
lea r8d, [rdx + 0x78]
call fcn.140173680
xor r8d, r8d
mov dword [rsi + 0x38], ebx
mov rdx, rdi
mov qword [rsi], rdi
mov rcx, rsi
mov qword [rsi + 8], rbp
call fcn.140055e30
mov rcx, rsi
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x10], rax
call fcn.140055bb0
test eax, eax
jne 0x140055a4c
mov rbx, qword [rsi + 0x10]
lea r9, [rsp + 0x58]
mov rcx, rbx
lea edx, [rax + 0x32]
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140055a4c
mov edi, dword [rsp + 0x58]
test rbx, rbx
je 0x140055a4c
mov r9, qword [rsi + 0x10]
mov rdx, rbx
mov r8d, dword [rsi + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.140055fa0
movsd xmm0, qword [rbx]
mov r8d, edi
mov r9, qword [rsi + 8]
mov edx, 0x32
movsd qword [rsi + 0x3c], xmm0
mov rcx, rbx
mov eax, dword [rbx + 8]
mov dword [rsi + 0x44], eax
movzx eax, word [rbx + 0xc]
mov word [rsi + 0x48], ax
movsd xmm0, qword [r9]
movsd qword [rsi + 0x66], xmm0
mov eax, dword [r9 + 8]
mov dword [rsi + 0x6e], eax
movzx eax, word [r9 + 0xc]
lea r9, [rsp + 0x58]
mov word [rsi + 0x72], ax
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
jmp 0x140055a6e
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140055a6b
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsi + 0x20], 0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140055bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
sub rsp, 0xcc8
mov r9d, dword [rcx + 0x38]
lea rax, [rsp + 0xce0]
mov rdx, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x28], recvfrom
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x32]
call fcn.140007ed0
cmp eax, 3
je 0x140055e22
lea edx, [rbx + 0x2a]
mov qword [rsp + 0xce8], rbp
xor ecx, ecx
lea r9d, [rbx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x140055e0d
mov qword [rsp + 0xcf0], rdi
mov qword [rsp + 0xcf8], r12
mov qword [rsp + 0xcc0], r13
mov qword [rsp + 0xcb8], r14
mov qword [rsp + 0xcb0], r15
cmp qword [rsi + 0x28], rbx
jne 0x140055c5a
mov qword [rsi + 0x28], rax
mov rdx, qword [rsi + 8]
mov r13d, 0x80000000
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
mov rdi, rcx
sub rdi, rdx
mov r14d, 5
cmp rcx, rdx
mov r8d, r14d
mov r12d, recvfrom
cmovbe rdi, rax
cmp rdi, r13
mov edi, dword [rsp + 0xce0]
cmovae r8d, r12d
xor edx, edx
test edi, edi
je 0x140055cbb
nop
cmp ebx, r8d
jge 0x140055cbb
mov eax, edx
inc edx
imul rcx, rax, 0xd0
add ebx, dword [rsp + rcx + 0x140]
cmp edx, edi
jb 0x140055ca0
mov rdx, qword [rsi + 0x18]
mov rcx, rbp
movsxd r15, ebx
mov r8, r15
call fcn.140173e20
mov rdx, qword [rsi + 0x28]
mov rdi, qword [rsi + 0x10]
mov rcx, rdx
sub rcx, rdi
mov rax, rdi
sub rax, rdx
cmp rdx, rdi
lea r9, [r15 + rdx]
lea r8, [r15 + rdi]
mov edx, r14d
cmovbe rcx, rax
mov rax, r8
cmp rcx, r13
mov rcx, r9
cmovae edx, r12d
sub rax, r9
sub rcx, r8
cmp r9, r8
cmovbe rcx, rax
cmp rcx, r13
jae 0x140055d2c
sub r8d, r9d
mov eax, r14d
sub r8d, r14d
mov byte [rsp + 0x40], 0xe9
mov dword [rsp + 0x41], r8d
lea rdi, [rsp + 0x45]
jmp 0x140055d48
mov eax, r12d
lea rdi, [rsp + 0x4e]
mov word [rsp + 0x40], 0x25ff
mov dword [rsp + 0x42], 0
mov qword [rsp + 0x46], r8
mov r8d, edx
cmp eax, edx
jae 0x140055d5c
mov ecx, r8d
sub rcx, rax
mov eax, 0xcc
rep stosb byte [rdi], al
lea rcx, [r15 + rbp]
lea rdx, [rsp + 0x40]
call fcn.140173e20
mov r9, qword [rsi + 0x10]
lea rax, [rsp + 0x80]
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbp
call fcn.140055ed0
mov r15, qword [rsp + 0xcb0]
test eax, eax
jne 0x140055df7
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x28]
mov rcx, r8
sub rcx, rdx
mov qword [rsi + 0x20], rbp
mov rdi, rdx
mov dword [rsi + 0x30], ebx
sub rdi, r8
cmp rdx, r8
cmovbe rdi, rcx
cmp rdi, r13
cmovae r14d, r12d
add r14d, ebx
mov dword [rsi + 0x34], r14d
mov r13, qword [rsp + 0xcc0]
mov r12, qword [rsp + 0xcf8]
mov rdi, qword [rsp + 0xcf0]
mov r14, qword [rsp + 0xcb8]
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
or eax, 0xffffffff
jmp 0x140055dc5
or eax, 0xffffffff
mov rbp, qword [rsp + 0xce8]
add rsp, 0xcc8
pop rsi
pop rbx
ret
or eax, 0xffffffff
add rsp, 0xcc8
pop rsi
pop rbx
ret