joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b380
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002b468
xor ecx, ecx
lea r8, [rsp + 0x60]
xor eax, eax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea edx, [rcx + 1]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x18
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
jne 0x14002b3fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW_failed_with_error_code__d
call fcn.140046b30
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x14002b426
lea rcx, str.IsValidSecurityDescriptor_return_FALSE
call fcn.140046b30
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002b468
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.Failed_to_create_directory:_ls_error:_d
mov r8d, eax
call fcn.140046b30
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14002cd40
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x60
mov rbx, rdx
mov rbp, rcx
call fcn.14002b660
test eax, eax
jne 0x14002cd75
lea rcx, str.Not_running_as_SYSTEM:_skipping_loading_user_profile
call fcn.140046c10
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
mov rcx, rbx
call fcn.140033fd0
mov rbx, rax
test rax, rax
je 0x14002ce9c
mov qword [rsp + 0x70], rsi
mov rcx, rax
mov qword [rsp + 0x78], rdi
mov rdi, rax
mov qword [rsp + 0x80], r14
xor r14d, r14d
mov esi, r14d
lea edx, [r14 + 0x5c]
call fcn.140079df8
test rax, rax
je 0x14002cdc0
mov rsi, rbx
mov word [rax], r14w
lea rdi, [rax + 2]
xor eax, eax
mov dword [rsp + 0x20], gethostname
mov qword [rsp + 0x24], rax
lea rcx, str.SeBackupPrivilege
mov qword [rsp + 0x2c], rax
xorps xmm0, xmm0
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
lea edx, [rax + 1]
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x24], 1
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rsi
movdqu xmmword [rsp + 0x48], xmm0
call fcn.14002c2a0
mov edx, 1
lea rcx, str.SeRestorePrivilege
call fcn.14002c2a0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
test eax, eax
jne 0x14002ce68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.load_user_profile
lea rcx, str._s:_LoadUserProfileW___failed_for_user__S_with_error__d.
call fcn.140046c70
xor edx, edx
lea rcx, str.SeBackupPrivilege
call fcn.14002c2a0
xor edx, edx
lea rcx, str.SeRestorePrivilege
call fcn.14002c2a0
mov rcx, rbx
call fcn.14007a8b4
mov rbx, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x60
pop rbp
ret
lea rcx, str.out_of_memory
call fcn.14004db00
int3
Function at 0x14002d3e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [0x1400eeeb8], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], rbx
jne 0x14002d504
lea rax, [rsp + 0x48]
mov r9d, 0x20101
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenSSH
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d4ea
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.LSAAuthenticationPackage
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002d4ea
movsxd rcx, dword [rsp + 0x40]
call fcn.140088334
mov rbx, rax
test rax, rax
jne 0x14002d480
lea rdx, str.get_custom_lsa_package
lea rcx, str._s:_out_of_memory
call fcn.14004db00
movsxd r8, dword [rsp + 0x40]
xor edx, edx
mov rcx, rbx
call fcn.14007a110
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.LSAAuthenticationPackage
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002d4dd
mov rcx, rbx
call fcn.140034090
mov qword [0x1400eeec0], rax
test rax, rax
jne 0x14002d4dd
mov rdx, rbx
lea rcx, str.utf16_to_utf8_failed_to_convert_lsa_auth_pkg_w:_ls
call fcn.14004db00
test rbx, rbx
je 0x14002d4ea
mov rcx, rbx
call fcn.14007a8b4
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002d4fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1400eeeb8], 1
mov rax, qword [0x1400eeec0]
add rsp, 0x30
pop rbx
ret

Function at 0x14002dca0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.14002db60
call fcn.14002d930
test eax, eax
jne 0x14002dce9
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x198
call fcn.14007a110
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 0x100010
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [0x140112168], rax
test rax, rax
je 0x14002dd2c
call fcn.140033e30
test eax, eax
jne 0x14002dd2c
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140078840
add rsp, 0x1d8
ret
lea rcx, str.failed_to_initialize_w32posix_wrapper
call fcn.14004db00
int3
Function at 0x14002df80
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, r9
movsxd rsi, ecx
mov ebx, r8d
mov r14d, edx
call fcn.140084fc0
mov dword [rax], 0
cmp esi, 0xff
ja 0x14002e098
lea rcx, [0x14010f5e0]
cmp qword [rcx + rsi*8], 0
lea rdi, [rcx + rsi*8]
je 0x14002e098
call fcn.140084fc0
mov dword [rax], 0
mov rax, qword [rdi]
cmp dword [rax + 0x84], 1
je 0x14002e00b
call fcn.140084fc0
lea rcx, str._s_ERROR:_not_sock_:_d
mov dword [rax], 0x80
mov rax, qword [rdi]
mov r8d, dword [rax + 0x84]
jmp 0x14002e0ad
cmp ebx, 0x1b
ja 0x14002e075
mov ecx, 0x8000112
bt ecx, ebx
jae 0x14002e075
mov rcx, qword [rax + 0x90]
mov r9, rbp
mov r8d, ebx
mov dword [rsp + 0x20], 4
mov edx, r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14002e094
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400303e0
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socketio_setsockopt
lea rcx, str._s___ERROR:_d
call fcn.140046c70
mov eax, edi
jmp 0x14002e0bc
mov r8, rax
lea rcx, str.setsockop___ERROR:_unsupported_optname:_d_io:_p
mov edx, ebx
call fcn.140046c70
call fcn.140084fc0
or edi, 0xffffffff
mov dword [rax], 0x81
mov eax, edi
jmp 0x14002e0bc
call fcn.140084fc0
mov r8d, esi
lea rcx, str._s_ERROR:_bad_fd:__d
mov dword [rax], 9
lea rdx, str.w32_setsockopt
call fcn.140046c70
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002e210
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movsxd rdi, ecx
mov rbp, rdx
call fcn.140084fc0
mov dword [rax], 0
cmp edi, 0xff
ja 0x14002e2df
lea rcx, [0x14010f5e0]
cmp qword [rcx + rdi*8], 0
lea rbx, [rcx + rdi*8]
je 0x14002e2df
call fcn.140084fc0
mov dword [rax], 0
mov rcx, qword [rbx]
cmp dword [rcx + 0x84], 1
je 0x14002e28f
call fcn.140084fc0
lea rcx, str._s_ERROR:_not_sock_:_d
mov dword [rax], 0x80
mov rax, qword [rbx]
mov r8d, dword [rax + 0x84]
jmp 0x14002e2f4
mov rcx, qword [rcx + 0x90]
mov r8, rsi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_getsockname]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14002e2db
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400303e0
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socketio_getsockname
lea rcx, str._s___ERROR:_d
call fcn.140046c70
mov eax, edi
jmp 0x14002e303
call fcn.140084fc0
mov r8d, edi
lea rcx, str._s_ERROR:_bad_fd:__d
mov dword [rax], 9
lea rdx, str.w32_getsockname
call fcn.140046c70
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ec10
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
movsxd rbx, ecx
mov rsi, rdx
call fcn.140084fc0
mov dword [rax], 0
cmp ebx, 0xff
ja 0x14002ec82
lea rcx, [0x14010f5e0]
mov rcx, qword [rcx + rbx*8]
test rcx, rcx
je 0x14002ec82
cmp dword [rcx + 0x84], 1
mov r8, rdi
mov rdx, rsi
jne 0x14002ec6e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140030e80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140035560
call fcn.140084fc0
mov r8d, ebx
lea rdx, str.w32_write
lea rcx, str._s_ERROR:_bad_fd:__d
mov dword [rax], 9
call fcn.140046c70
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002fb60
Capabilities:
Check if file exists
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0xf0
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov r12, rcx
or rbp, 0xffffffffffffffff
call fcn.14002bbe0
mov r13, rax
test rax, rax
jne 0x14002fba1
call fcn.140084fc0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x14002fdcd
mov rcx, r13
mov qword [rsp + 0x120], rdi
call fcn.140033fd0
mov rdi, rax
test rax, rax
jne 0x14002fbc9
call fcn.140084fc0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x14002fdb0
xor edx, edx
mov qword [rsp + 0x128], r15
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
call fcn.14007a110
mov rax, qword [rsp + 0x140]
lea rdx, str.sshd.exe
mov rcx, r12
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x80], WSAGetLastError
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rbx
mov dword [rsp + 0xbc], 0x100
call fcn.14007950c
mov esi, dword [rsp + 0x148]
test rax, rax
je 0x14002fc38
or esi, 8
mov r15, qword [rsp + 0x150]
mov rbx, rdi
nop dword [rax]
nop word [rax + rax]
mov rdx, rbx
lea rcx, str.spawning__ls
call fcn.140046c70
xor r9d, r9d
lea rax, [rsp + 0x60]
test r15, r15
je 0x14002fcab
mov qword [rsp + 0x50], rax
mov r8, rbx
lea rax, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, r15
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x14002fce3
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x80]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14002fd6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14002fd30
test r14, r14
je 0x14002fd01
cmp qword [r14], 0
jne 0x14002fd30
cmp byte [r12], 0x22
je 0x14002fd30
add rbx, 2
mov rax, rbp
nop
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14002fd10
xor ecx, ecx
mov word [rdi + rax*2 - 2], cx
lea rax, [rdi + 2]
cmp rbx, rax
je 0x14002fc50
call fcn.140084fc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r15, r15
lea rdx, [0x1400d4ce8]
mov r8d, eax
lea rcx, str._s_failed_error:_d
lea rax, [0x1400d4cd0]
cmovne rdx, rax
call fcn.140046b30
jmp 0x14002fda8
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.140031ce0
cmp eax, 0xffffffff
jne 0x14002fd99
mov rcx, qword [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002fda8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [rsp + 0x70]
mov r15, qword [rsp + 0x128]
mov rcx, r13
call fcn.14007a8b4
test rdi, rdi
je 0x14002fdc5
mov rcx, rdi
call fcn.14007a8b4
mov rdi, qword [rsp + 0x120]
mov eax, ebp
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x14002fdf0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, dword [rcx + 0xc]
mov rsi, rcx
mov eax, dword [rcx + 8]
xor ebx, ebx
movsxd r12, dword [rcx]
mov r14, rdx
movsxd r13, dword [rcx + 4]
lea ebp, [r15*8 + 8]
mov dword [rsp + 0x70], ebx
movsxd rcx, ebp
mov dword [rsp + 0x80], eax
call fcn.140088334
mov rdi, rax
test rax, rax
je 0x14002fef9
mov dword [rax], r15d
lea r10, [0x14010f5c0]
mov rax, qword [r10 + r12*8 + 0x20]
movzx ecx, byte [rax + 0x84]
mov byte [rdi + 4], cl
mov rax, qword [r10 + r13*8 + 0x20]
movzx ecx, byte [rax + 0x84]
movsxd rax, dword [rsp + 0x80]
mov byte [rdi + 5], cl
mov rax, qword [r10 + rax*8 + 0x20]
movzx ecx, byte [rax + 0x84]
lea rax, [rdi + 8]
mov byte [rdi + 6], cl
test r15d, r15d
jle 0x14002fec2
lea r8, [rsi + 0x10]
nop dword [rax]
mov ecx, dword [r14 + rbx*8]
inc rbx
mov dword [rax], ecx
lea rax, [rax + 8]
movzx ecx, word [r8 + 0x28]
lea r8, [r8 + 4]
mov word [rax - 4], cx
movsxd rcx, dword [r8 - 4]
mov rcx, qword [r10 + rcx*8 + 0x20]
movzx edx, byte [rcx + 0x84]
mov byte [rax - 2], dl
cmp rbx, r15
jl 0x14002fe90
lea rax, [rsp + 0x70]
xor r9d, r9d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov ecx, dword [rsp + 0x70]
call fcn.140088334
mov rbx, rax
mov rcx, rdi
test rax, rax
jne 0x14002ff08
call fcn.14007a8b4
call fcn.140084fc0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
xor eax, eax
jmp 0x14002ff2e
lea rax, [rsp + 0x70]
mov r9, rbx
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
mov edx, ebp
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov rcx, rdi
call fcn.14007a8b4
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ff50
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov r11, rsp
push rbx
push r14
sub rsp, 0x58
lea rax, [r11 + 0x18]
mov dword [rsp + 0x78], 0
mov qword [r11 - 0x38], rax
xor r9d, r9d
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [r11 - 0x40], rax
mov r8d, 0x20000001
lea rax, [r11 + 0x10]
mov rbx, rcx
mov qword [r11 - 0x48], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov ecx, dword [rsp + 0x78]
call fcn.140088334
mov r14, rax
test rax, rax
je 0x140030129
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rax
mov r9, r14
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov r8d, 0x20000001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
movsx ecx, byte [r14 + 4]
mov rax, qword [0x14010f5e0]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14003000d
mov rax, qword [0x14010f5e0]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 5]
mov rax, qword [0x14010f5e8]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x140030035
mov rax, qword [0x14010f5e8]
mov dword [rax + 0xb0], 3
movsx ecx, byte [r14 + 6]
mov rax, qword [0x14010f5f0]
mov dword [rax + 0x84], ecx
cmp ecx, 1
jne 0x14003005d
mov rax, qword [0x14010f5f0]
mov dword [rax + 0xb0], 3
mov esi, dword [r14]
lea rdi, [r14 + 8]
mov qword [rsp + 0x50], rbp
test esi, esi
je 0x14003010a
lea rbp, [0x14010f5c0]
nop dword [rax + rax]
mov ecx, 0xc0
dec esi
call fcn.140088334
mov rbx, rax
test rax, rax
je 0x140030136
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.14007a110
movsxd rcx, dword [rdi]
mov qword [rbx + 0x90], rcx
movsx ecx, byte [rdi + 6]
mov dword [rbx + 0x84], ecx
cmp ecx, 1
jne 0x1400300cb
mov dword [rbx + 0xb0], 3
movsx rax, word [rdi + 4]
mov r8, rax
sar r8, 3
mov qword [rbp + rax*8 + 0x20], rbx
mov dword [rbx + 0x80], eax
and eax, 0x80000007
jge 0x1400300f0
dec eax
or eax, 0xfffffff8
inc eax
mov edx, 0x80
movzx ecx, al
sar edx, cl
add rdi, 8
or byte [r8 + rbp], dl
test esi, esi
jne 0x140030080
mov rcx, r14
call fcn.14007a8b4
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
add rsp, 0x58
pop r14
pop rbx
ret
lea rcx, str.out_of_memory
call fcn.14004db00
int3
lea rcx, str.out_of_memory
call fcn.14004db00
int3
Function at 0x1400304a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0xe0
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, qword [rcx + 0xb8]
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x40], 0x80
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rsi + 0x90]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x14003052b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400303e0
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rsi
lea rcx, str.acceptEx___getsockname___ERROR:_d__io:_p
mov edx, eax
call fcn.140046c10
or eax, 0xffffffff
jmp 0x1400305fb
movzx ecx, word [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x108], rbp
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [r14 + 0x400], rax
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140030588
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400303e0
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rsi
lea rcx, str.acceptEx___socket___ERROR:_d__io:_p
mov edx, eax
call fcn.140046c70
or eax, ebp
jmp 0x1400305f3
mov qword [rsp + 0x110], rdi
lea rbx, [r14 + 0x418]
mov rdi, qword [r14 + 0x408]
mov rcx, rdi
call qword [fcn.140078e90]
mov rcx, qword [rsi + 0x90]
xor r9d, r9d
mov qword [rsp + 0x38], rsi
mov r8, r14
mov qword [rsp + 0x30], rbx
mov rdx, rbp
mov dword [rsp + 0x28], 0x90
mov dword [rsp + 0x20], 0x90
call rdi
mov rdi, qword [rsp + 0x110]
cmp eax, 1
jne 0x140030617
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [rsi + 0x54], 1
xor eax, eax
mov rbp, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140078840
add rsp, 0xe0
pop r14
pop rsi
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1400305ea
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400303e0
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rsi
lea rcx, str.acceptEx___AcceptEx___ERROR:_d__io:_p
mov edx, eax
call fcn.140046c70
or eax, 0xffffffff
jmp 0x1400305f3
Function at 0x140030680
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov esi, r8d
mov dword [rsp + 0x60], eax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400306a5
mov dword [rdx], eax
mov rcx, qword [rcx + 0x40]
mov eax, 0x11800
mov dword [rsp + 0x40], eax
test rcx, rcx
jne 0x140030709
mov ecx, eax
call fcn.140088334
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400306fc
call fcn.140084fc0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
call fcn.140084fc0
mov r8, rdi
lea rcx, str.WSARecv___ERROR:_d__io:_p
mov edx, dword [rax]
call fcn.140046c70
or eax, 0xffffffff
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rdi + 0x40], rax
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x48], eax
jmp 0x14003070e
mov qword [rsp + 0x48], rcx
test esi, esi
je 0x14003071b
cmp esi, eax
cmovb eax, esi
mov dword [rsp + 0x40], eax
mov rcx, qword [rdi + 0x90]
lea rax, [0x140030660]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 1]
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x140030775
mov dword [rdi + 0x54], 1
test rbx, rbx
je 0x140030789
mov dword [rbx], 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x14003079b
mov dword [rdi + 0x54], 1
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1400303e0
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, rdi
lea rcx, str.WSARecv___WSARecv___ERROR:_io:_p__d
mov r8d, eax
call fcn.140046c70
mov rbx, qword [rsp + 0x68]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140031750
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x74], 0
mov rbx, rcx
jne 0x140031771
call fcn.1400314a0
cmp eax, 0xffffffff
jne 0x140031771
or eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x8c]
mov edx, 1
shr eax, 2
mov rcx, rbx
not eax
mov qword [rsp + 0x30], rdi
test dl, al
je 0x1400317da
call fcn.1400318c0
test eax, eax
jne 0x1400317c8
nop word [rax + rax]
or r8d, 0xffffffff
lea rcx, [rbx + 0x38]
mov edx, 1
call fcn.140033c70
cmp eax, 0xffffffff
je 0x1400317ee
mov edx, 1
mov rcx, rbx
call fcn.1400318c0
test eax, eax
je 0x1400317a0
mov rcx, rbx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp fcn.140031800
call fcn.1400318c0
test eax, eax
jne 0x1400317c8
call fcn.140084fc0
mov dword [rax], WSAStartup
or eax, 0xffffffff
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140031800
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x78]
xor edi, edi
mov rbx, rcx
test eax, eax
je 0x14003181f
lea rcx, str.finish_connect___ERROR:_async_io_completed_with_error:__d__io:_p
jmp 0x14003184f
mov rcx, qword [rcx + 0x90]
xor r9d, r9d
mov edx, 0xffff
mov dword [rsp + 0x20], edi
mov r8d, 0x7010
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14003185b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, str.finish_connect___ERROR:_setsockopt_failed:_d__io:_p
mov r8, rbx
mov edx, eax
mov edi, eax
call fcn.140046c70
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x38], 0
mov dword [rbx + 0x74], 0
test edi, edi
je 0x140031892
mov dword [rbx + 0x58], edi
mov dword [rbx + 0x78], edi
call fcn.140084fc0
mov ecx, edi
mov r9, rax
call fcn.1400303e0
mov dword [r9], eax
jmp 0x1400318a4
xor eax, eax
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x78], rax
neg edi
mov dword [rbx + 0xb0], 3
mov rbx, qword [rsp + 0x40]
sbb eax, eax
add rsp, 0x30
pop rdi
ret