joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e230
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
call sym.Curl_pollset_reset
cmp qword [rbx + 0x20], 0
je case.0x14000e264.0
mov r8d, dword [rbx + 0x58]
cmp r8d, 0x11
ja case.default.0x14000e264
lea rdx, [0x1400f3224]
movsxd rax, dword [rdx + r8*4]
add rax, rdx
jmp rax
lea r8, [sym.doing_getsock]
mov rdx, rsi
mov rcx, rbx
call sym.Curl_pollset_add_socks
mov rdx, rsi
mov rcx, rbx
call sym.Curl_conn_adjust_pollset
mov edx, dword [rsi + 0x28]
test edx, edx
jne case.0x14000e264.0
test byte [rbx + 0x140], 0x30
jne case.0x14000e264.0
xor edx, edx
mov rcx, rbx
call sym.Curl_conn_is_ip_connected
test al, al
jne 0x14000e328
add rsp, 0x28
pop rbx
pop rsi
ret
lea r8, [sym.perform_getsock]
jmp 0x14000e277
lea r8, [sym.connecting_getsock]
jmp 0x14000e277
lea r8, [sym.protocol_getsock]
jmp 0x14000e277
lea r8, [sym.Curl_resolv_getsock]
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.Curl_pollset_add_socks
lea r8, [sym.domore_getsock]
jmp 0x14000e277
lea rdx, str.multi_getsock:_unexpected_multi_state__d
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.Curl_failf
test byte [rbx + 0xa37], 0x10
je case.0x14000e264.0
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14000e34c
mov eax, dword [rax + 8]
test eax, eax
jle case.0x14000e264.0
lea rdx, str.WARNING:_no_socket_in_pollset__transfer_may_stall_
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.Curl_infof
Function at 0x140015ea0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r8, rdx
xor edx, edx
call sym.memset
xor ecx, ecx
mov r9d, 2
mov r8d, ebx
mov rdx, rax
call sym.BCryptGenRandom
test eax, eax
setne al
movzx eax, al
add eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140015ee0
Capabilities:
Generate random numbers via winapi

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov r12, rdx
mov rbx, r8
test r8, r8
je 0x140015fed
lea rbp, [rsp + 0x2c]
jmp 0x140015f52
test eax, eax
jne 0x140015fcb
mov eax, dword [rsp + 0x2c]
mov edx, eax
mov byte [r12], al
shr edx, 8
cmp rbx, 1
je 0x140015f46
mov byte [r12 + 1], dl
mov edx, eax
shr edx, 0x10
cmp rbx, 2
je 0x140015f46
mov byte [r12 + 2], dl
shr eax, 0x18
cmp rbx, 3
je 0x140015f46
mov byte [r12 + 3], al
add r12, rsi
sub rbx, rsi
je 0x140015fe0
mov esi, 4
mov r8d, 4
mov rdx, rbp
mov rcx, rdi
cmp rbx, rsi
cmovbe rsi, rbx
call sym.Curl_ssl_random
cmp eax, 4
jne 0x140015f08
cmp byte [0x14013b094], 0
je 0x140015fa0
imul eax, dword [0x14013b090], 0x41c64e6d
add eax, 0x3039
mov dword [0x14013b090], eax
rol eax, 0x10
jmp 0x140015f14
xor ecx, ecx
mov r9d, 2
mov rdx, rbp
mov r8d, 4
mov dword [rsp + 0x2c], 0
call sym.BCryptGenRandom
test eax, eax
je 0x140015f10
mov eax, 2
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, 0x2b
jmp 0x140015fcb

Function at 0x140016080
Capabilities:
Generate random numbers via winapi

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
mov rbp, r8
cmp r8, 1
je 0x140016138
mov r12, rdx
lea rbx, [rsp + 0x2c]
jmp 0x1400160c1
test eax, eax
jne 0x14001617b
mov eax, dword [rsp + 0x2c]
cmp eax, 0xfffffffb
jbe 0x140016101
mov r8d, 4
mov rdx, rbx
mov rcx, rsi
call sym.Curl_ssl_random
cmp eax, 4
jne 0x1400160b0
cmp byte [0x14013b094], 0
je 0x140016150
imul eax, dword [0x14013b090], 0x41c64e6d
add eax, 0x3039
mov dword [0x14013b090], eax
rol eax, 0x10
mov dword [rsp + 0x2c], eax
cmp eax, 0xfffffffb
ja 0x1400160c1
mov edx, eax
mov ecx, 0x84210843
add r12, 1
shr edx, 1
imul rdx, rcx
shr rdx, 0x24
imul edx, edx, 0x3e
sub eax, edx
lea rdx, [0x1400f3e80]
movzx eax, byte [rdx + rax]
mov byte [r12 - 1], al
lea rax, [rdi + rbp - 1]
cmp r12, rax
jne 0x1400160c1
mov rdi, r12
xor eax, eax
mov byte [rdi], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor ecx, ecx
mov r9d, 2
mov rdx, rbx
mov r8d, 4
mov dword [rsp + 0x2c], 0
call sym.BCryptGenRandom
test eax, eax
je 0x1400160b8
mov eax, 2
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140016190
Capabilities:
Move file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
lea rbx, [rsp + 0x30]
mov rdi, rcx
lea r12, [rsp + 0x20]
mov rsi, rdx
mov rcx, rbx
call sym.Curl_now
mov rcx, rdi
movdqu xmm6, xmmword [rsp + 0x30]
call sym.curlx_convert_UTF8_to_wchar
mov rcx, rsi
mov rdi, rax
call sym.curlx_convert_UTF8_to_wchar
mov rbp, qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov rsi, rax
jmp 0x140016210
mov rcx, rbx
call sym.Curl_now
mov rdx, r12
mov rcx, rbx
movaps xmmword [rsp + 0x20], xmm6
call sym.Curl_timediff
cmp rax, 0x3e8
ja 0x140016250
mov ecx, 1
call r13
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call rbp
test eax, eax
je 0x1400161e8
test rdi, rdi
je 0x14001622f
mov rcx, rdi
call sym.free
test rsi, rsi
je 0x14001623c
mov rcx, rsi
call sym.free
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test rdi, rdi
je 0x14001625d
mov rcx, rdi
call sym.free
test rsi, rsi
je 0x14001626a
mov rcx, rsi
call sym.free
mov eax, 1
jmp 0x14001623e
Function at 0x1400174a0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1400174e0
test edx, edx
je 0x1400174e0
mov r9d, edx
mov rax, rcx
shl r9, 4
add r9, rcx
jmp 0x1400174c9
add rax, 0x10
cmp rax, r9
je 0x1400174e0
cmp qword [rax], 0xffffffffffffffff
je 0x1400174c0
add rsp, 0x28
jmp sym.Curl_poll.part.0
test r8, r8
je 0x1400174fc
js 0x140017503
mov eax, 0xfffffffe
cmp r8, rax
cmovle rax, r8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 0xffffffff
jmp 0x1400174fe

Function at 0x140020060
Capabilities:
Get common file path

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140020100
lea rdx, str.LoadLibraryExW
mov rcx, rax
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call r12
lea rdx, [0x1400f7b92]
mov rcx, rsi
mov rdi, rax
call sym.wcspbrk
mov rbp, rax
test rax, rax
je 0x1400200d8
test rdi, rdi
je 0x140020118
mov r8d, 8
xor edx, edx
mov rcx, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp rax
test rdi, rdi
je 0x140020130
lea rdx, str.AddDllDirectory
mov rcx, rbx
call r12
test rax, rax
je 0x140020130
mov r8d, 0x800
jmp 0x1400200bd
xor ebp, ebp
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
xor ecx, ecx
call r13
mov ebx, eax
test eax, eax
je 0x140020100
mov rcx, rsi
call sym.wcslen
lea ecx, [rbx + 1]
add rcx, rax
mov rax, qword [0x14011e810]
add rcx, rcx
call qword [rax]
mov r12, rax
test rax, rax
je 0x1400201b8
mov edx, ebx
mov rcx, rax
call r13
test eax, eax
je 0x1400201b8
mov rcx, r12
call sym.wcslen
lea rdx, [0x1400f7ba8]
lea rcx, [r12 + rax*2]
call sym.wcscpy
mov rcx, r12
call sym.wcslen
mov rdx, rsi
lea rcx, [r12 + rax*2]
call sym.wcscpy
test rdi, rdi
je 0x1400201c9
mov r8d, 8
xor edx, edx
mov rcx, r12
call rdi
mov rbp, rax
nop dword [rax + rax]
mov rax, qword [0x14011e7f0]
mov rcx, r12
call qword [rax]
jmp 0x140020102
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
jmp 0x1400201b8
Function at 0x1400201e0
Capabilities:
Initialize winsock library

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x1d0
and ecx, 2
je 0x140020222
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140020336
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x140020330
shr ax, 8
cmp ax, 2
jne 0x140020330
call sym.Curl_sspi_global_init
mov ebx, eax
test eax, eax
je 0x140020240
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
lea rcx, [0x1400f7bac]
call sym.Curl_load_library
mov qword [0x14013b0d0], rax
test rax, rax
je 0x140020274
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140020274
mov qword [0x14013b0b8], rax
lea rcx, str.ws2_32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x1400202c9
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeAddrInfoExW
mov rcx, rax
call rdi
lea rdx, str.GetAddrInfoExCancel
mov rcx, rsi
mov qword [0x14013b0b0], rax
call rdi
lea rdx, str.GetAddrInfoExW
mov rcx, rsi
mov qword [0x14013b0a8], rax
call rdi
mov qword [0x14013b0a0], rax
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
mov edx, 2
mov ecx, 6
mov byte [0x14013b0c1], al
call sym.curlx_verify_windows_version
lea rcx, [0x14013b0c8]
mov byte [0x14013b0c0], al
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 2
mov eax, ebx
add rsp, 0x1d0
pop rbx
pop rsi
pop rdi
ret
Function at 0x14002b3b0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sym.read
cdqe
add rsp, 0x28
ret
Function at 0x14002f850
Capabilities:
Convert ip address from string

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx]
mov edx, dword [rdx + 8]
not edx
mov rbx, rcx
mov esi, r8d
and edx, 0xa
je 0x14002f950
mov rbp, qword [rax + 0x50]
mov r13, qword [rax + 0x58]
mov r12d, dword [rax + 0x79c]
test rbp, rbp
je 0x14002f930
mov rdi, qword [rbx]
test rdi, rdi
je 0x14002f8ae
mov rdx, rdi
mov rcx, rbp
call sym.strcmp
test eax, eax
je 0x14002f930
mov rcx, qword [rbx + 8]
mov r14, qword [0x14011e7f0]
cmp rdi, rcx
je 0x14002f8c1
call qword [r14]
mov rcx, qword [rbx + 0x10]
call qword [r14]
mov rcx, qword [rbx]
call qword [r14]
mov r15, qword [0x14011e830]
pxor xmm0, xmm0
mov rcx, rbp
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
call qword [r15]
mov qword [rbx], rax
mov rdi, rax
test rax, rax
je 0x14002fa60
test r13, r13
je 0x14002f914
mov rdx, r13
mov rcx, rbp
call sym.strcmp
test eax, eax
jne 0x14002f970
mov qword [rbx + 8], rdi
cmp byte [rdi], 0
jne 0x14002f9e0
mov dword [rbx + 0x18], 0
cmp byte [rdi], 0
jne 0x14002f990
nop dword [rax]
mov dword [rbx + 0x1c], r12d
xor eax, eax
mov dword [rbx + 0x20], esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, qword [rax + 0xd8]
mov r13, qword [rax + 0xe0]
mov r12d, dword [rax + 0xe8]
jmp 0x14002f88a
mov rcx, r13
call qword [r15]
mov qword [rbx + 8], rax
test rax, rax
je 0x14002fabf
mov rdi, qword [rbx]
test rdi, rdi
je 0x14002f921
jmp 0x14002f918
mov rcx, rdi
call sym.strlen
mov rbp, rax
test rax, rax
jne 0x14002fa10
mov edx, 1
mov rax, qword [0x14011e790]
mov ecx, 1
call qword [rax]
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
je 0x14002faaa
mov rdx, qword [rbx]
mov r8, rbp
call sym.Curl_strntolower
mov rax, qword [rbx + 0x10]
mov byte [rax + rbp], 0
jmp 0x14002f930
lea r13, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
mov rbp, qword [sym.imp.WS2_32.dll_inet_pton]
mov r8, r13
call rbp
mov edx, 1
test eax, eax
je 0x14002fa38
mov dword [rbx + 0x18], edx
jmp 0x14002f930
lea rax, [rax - 1]
cmp byte [rdi + rbp - 1], 0x2e
cmovne rax, rbp
cmp rax, 0xfffe
ja 0x14002f930
lea rdx, [rax + 1]
mov rbp, rax
jmp 0x14002f9a5
mov r8, r13
mov rdx, rdi
mov ecx, 0x17
call rbp
test eax, eax
jne 0x14002faa0
mov dword [rbx + 0x18], 0
mov rdi, qword [rbx]
jmp 0x14002f928
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002fa6c
call qword [r14]
mov rcx, qword [rbx + 0x10]
call qword [r14]
mov rcx, qword [rbx]
call qword [r14]
pxor xmm0, xmm0
mov qword [rbx + 0x10], 0
mov eax, 0x1b
mov dword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
jmp 0x14002f939
mov edx, 2
jmp 0x14002fa02
mov rax, qword [rbx + 8]
cmp rax, qword [rbx]
je 0x14002fa70
mov rcx, rax
call qword [r14]
mov rcx, qword [rbx + 0x10]
jmp 0x14002fa70
cmp qword [rbx], 0
je 0x14002fa6c
xor ecx, ecx
jmp 0x14002fa69
Function at 0x140031ee0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r8, [0x1400f9426]
mov edx, 0xc
mov r9d, dword [rcx + 0x84]
mov rbp, qword [rcx + 0xe8]
lea rsi, [rsp + 0x24]
mov rbx, rcx
mov rcx, rsi
call sym.curl_msnprintf
mov rcx, qword [rbx + 0x88]
mov rdx, rsi
lea r9, [rbx + 0xb0]
lea r8, [rbx + 0xb8]
call sym.Curl_getaddrinfo_ex
mov esi, eax
test eax, eax
jne 0x140032040
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rbx + 0x80]
test eax, eax
jne 0x140031fb0
mov rcx, qword [rbx + 0xa0]
cmp rcx, 0xffffffffffffffff
jne 0x140031f80
mov dword [rbx + 0x80], 1
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r9d, r9d
mov byte [rsp + 0x23], 1
lea rdx, [rsp + 0x23]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140031f5a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx + 0xa8], eax
jmp 0x140031f5a
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x78]
mov rsi, qword [0x14011e7f0]
test rcx, rcx
je 0x140031fd6
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x78]
call qword [rsi]
mov rcx, qword [rbx + 0x88]
call qword [rsi]
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x140031ff0
call sym.Curl_freeaddrinfo
mov rcx, qword [rbx + 0xa0]
cmp rcx, 0xffffffffffffffff
jne 0x140032060
lea rdi, [rbx + 8]
mov qword [rbx], 0
xor eax, eax
mov qword [rbx + 0xe8], 0
and rdi, 0xfffffffffffffff8
sub rbx, rdi
lea ecx, [rbx + 0xf0]
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, rbp
call qword [rsi]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdi, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rdi
test eax, eax
jne 0x140032070
mov dword [rbx + 0xa8], esi
jmp 0x140031f39
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140031ffd
call rdi
mov edx, 8
test eax, eax
cmove eax, edx
mov dword [rbx + 0xa8], eax
jmp 0x140031f39
Function at 0x140034a00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
mov r12, qword [rcx + 0x10]
mov r13, qword [rsp + 0x1b0]
mov dword [r13], 0
mov rbp, r9
mov rdi, rcx
mov rbx, rdx
xor r9d, r9d
mov rdx, r8
mov rcx, qword [r12 + 0x98]
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_recv]
movsxd r14, eax
mov rsi, r14
cmp r14d, 0xffffffff
je 0x140034ad0
test rbx, rbx
je 0x140034a61
test byte [rbx + 0xa37], 0x10
jne 0x140034a90
test r14, r14
jle 0x140034a75
test byte [r12 + 0x150], 1
je 0x140034b18
mov rax, r14
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x140034aa3
mov edx, dword [rax + 8]
test edx, edx
jle 0x140034a61
mov rax, qword [rdi]
mov eax, dword [rax + 0xc]
test eax, eax
jle 0x140034a61
mov eax, dword [r13]
mov dword [rsp + 0x20], esi
mov r9, rbp
mov rdx, rdi
lea r8, str.recv_len_zu______d__err_d
mov rcx, rbx
mov dword [rsp + 0x28], eax
call sym.Curl_trc_cf_infof
jmp 0x140034a61
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r15d, eax
cmp eax, 0x2733
jne 0x140034b40
mov dword [r13], 0x51
test rbx, rbx
je 0x140034a75
test byte [rbx + 0xa37], 0x10
je 0x140034a75
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x140034b80
mov ecx, dword [rax + 8]
test ecx, ecx
jg 0x140034aa3
jmp 0x140034a75
lea rcx, [rsp + 0x30]
call sym.Curl_now
movdqu xmm0, xmmword [rsp + 0x30]
or byte [r12 + 0x150], 1
movups xmmword [r12 + 0x128], xmm0
jmp 0x140034a75
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Recv_failure:__s
mov rcx, rbx
mov r8, rax
call sym.Curl_failf
mov dword [rbx + 0xc64], r15d
mov dword [r13], 0x38
jmp 0x140034aed
mov rax, qword [rdi]
mov r8d, dword [rax + 0xc]
test r8d, r8d
jle 0x140034a75
jmp 0x140034aad
Function at 0x140034ba0
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
movaps xmmword [rsp + 0x190], xmm6
mov r12, qword [rsp + 0x210]
mov r13, qword [rcx + 0x10]
mov dword [r12], 0
movsxd rax, dword [rcx + 0x20]
mov rbx, rcx
mov rsi, rdx
mov rdx, r8
mov r8, qword [rcx + 0x18]
mov rcx, qword [r13 + 0x98]
add rax, 0x44
mov rbp, r9
xor r9d, r9d
mov r14, qword [r8 + rax*8]
mov qword [r8 + rax*8], rcx
mov r8d, ebp
call qword [sym.imp.WS2_32.dll_send]
movsxd r15, eax
mov rdi, r15
cmp r15d, 0xffffffff
je 0x140034d38
mov ecx, dword [r12]
test ecx, ecx
je 0x140034c80
test rsi, rsi
je 0x140034c49
test byte [rsi + 0xa37], 0x10
je 0x140034c49
mov rax, qword [rsi + 0x11e8]
test rax, rax
je 0x140034c3b
mov edx, dword [rax + 8]
test edx, edx
jle 0x140034c49
mov rax, qword [rbx]
mov eax, dword [rax + 0xc]
test eax, eax
jg 0x140034d58
mov rax, qword [rbx + 0x18]
movsxd rdx, dword [rbx + 0x20]
mov qword [rax + rdx*8 + 0x220], r14
movaps xmm6, xmmword [rsp + 0x190]
mov rax, r15
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
call sym.Curl_now
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
movdqu xmm0, xmmword [r13 + 0x138]
movdqu xmm6, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x60], xmm0
call sym.Curl_timediff
cmp rax, 0x3e8
jle 0x140034c1a
lea r10, [rsp + 0x8c]
mov rcx, qword [r13 + 0x98]
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 4
mov edx, 0x4004747b
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x58], r10
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x140034d27
mov eax, dword [rsp + 0x8c]
cmp dword [r13 + 0x148], eax
jne 0x140034dc0
movups xmmword [r13 + 0x138], xmm6
jmp 0x140034c1a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, eax
cmp eax, 0x2733
jne 0x140034d80
mov dword [r12], 0x51
jmp 0x140034c1a
mov eax, dword [r12]
mov dword [rsp + 0x20], edi
mov r9, rbp
mov rdx, rbx
lea r8, str.send_len_zu______d__err_d
mov rcx, rsi
mov dword [rsp + 0x28], eax
call sym.Curl_trc_cf_infof
jmp 0x140034c49
lea rdx, [rsp + 0x90]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Send_failure:__s
mov rcx, rsi
mov r8, rax
call sym.Curl_failf
mov dword [rsi + 0xc64], r13d
mov dword [r12], 0x37
jmp 0x140034c1f
mov r9, qword [rsp + 0x58]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [r13 + 0x98]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x140034d27
mov eax, dword [rsp + 0x8c]
mov dword [r13 + 0x148], eax
jmp 0x140034d27
Function at 0x140034f50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x428
mov rax, rcx
mov rbx, r8
mov rcx, rdx
test byte [rax + 0x24], 1
je 0x140034fc2
mov rsi, qword [rax + 0x10]
test rdx, rdx
je 0x140034fb0
test byte [rdx + 0xa37], 0x10
je 0x140034fb0
mov rdx, qword [rdx + 0x11e8]
test rdx, rdx
je 0x140034f8f
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x140034fb0
mov rdx, qword [rax]
mov edx, dword [rdx + 0xc]
test edx, edx
jle 0x140034fb0
mov r9, qword [rsi + 0x98]
lea r8, str.cf_socket_shutdown__zd_
mov rdx, rax
call sym.Curl_trc_cf_infof
nop
mov rcx, qword [rsi + 0x98]
cmp rcx, 0xffffffffffffffff
je 0x140034fc2
cmp dword [rsi], 3
je 0x140034fd8
xor eax, eax
mov byte [rbx], 1
add rsp, 0x428
pop rbx
pop rsi
ret
mov edx, 1
call sym.curlx_nonblock
test eax, eax
js 0x140034fc2
mov rcx, qword [rsi + 0x98]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recv]
jmp 0x140034fc2

Function at 0x140035010
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x140
mov r8d, 1
mov rbx, rcx
mov dword [rsp + 0x3c], 1
mov rcx, rdx
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
test rbx, rbx
je 0x14003504d
test eax, eax
js 0x140035060
add rsp, 0x140
pop rbx
ret
test byte [rbx + 0xa37], 0x10
je 0x14003504d
mov rax, qword [rbx + 0x11e8]
test rax, rax
je 0x14003507c
mov eax, dword [rax + 8]
test eax, eax
jle 0x14003504d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, 0x100
mov ecx, eax
call sym.Curl_strerror
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
mov r8, rax
call sym.Curl_infof
jmp 0x14003504d
Function at 0x140035b60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov r9, qword [rcx + 0x98]
mov rbx, rcx
mov rsi, rdx
cmp r9, 0xffffffffffffffff
je 0x140035b92
mov rax, qword [rdx + 0x20]
mov rax, qword [rax + 0x3a8]
test byte [rax + 0x8d], 8
je 0x140035ba0
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x30]
xor eax, eax
mov ecx, 0x10
mov dword [rsp + 0x2c], pe_nt_image_headers64
mov rdi, rbp
lea r8, [rsp + 0x2c]
mov rdx, rbp
rep stosq qword [rdi], rax
mov rcx, r9
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140035c30
mov edx, dword [rsp + 0x2c]
lea r9, [rbx + 0x100]
lea r8, [rbx + 0xce]
mov rcx, rbp
call sym.Curl_addr2string
test al, al
jne 0x140035b92
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, dword [rax]
call sym.Curl_strerror
mov rbx, rax
call rdi
mov r9, rbx
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov rcx, rsi
mov r8d, dword [rax]
call sym.Curl_failf
jmp 0x140035b92
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov ecx, eax
mov ebx, eax
call sym.Curl_strerror
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
mov rcx, rsi
mov r9, rax
call sym.Curl_failf
jmp 0x140035b92

Function at 0x1400363f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [0x14013b200]
mov dword [rsp + 0x34], 0x4020
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 4
test eax, eax
je 0x140036480
cmp eax, 2
je 0x140036472
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x38]
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140036450
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x38], eax
jg 0x140036472
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov rcx, rbx
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
nop
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
xor edx, edx
mov r9d, 2
mov ecx, 6
mov dword [rsp + 0x20], 3
call sym.curlx_verify_windows_version
test al, al
je 0x1400364b8
mov dword [0x14013b200], 2
add rsp, 0x40
pop rbx
ret
mov dword [0x14013b200], 1
jmp 0x14003641f
Function at 0x14003f7a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14003f7b8
call sym.Curl_host_is_ipnum
test al, al
je 0x14003f7c8
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call sym.strlen
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
mov rsi, rax
call sym.Curl_memrchr
test rax, rax
je 0x14003f810
sub rax, rbx
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
call sym.Curl_memrchr
test rax, rax
je 0x14003f810
add rax, 1
mov rdx, rax
sub rdx, rbx
mov rbx, rax
sub rsi, rdx
add rsi, rbx
cmp rbx, rsi
jae 0x14003f880
mov edi, 0x1505
nop dword [rax]
movsx ecx, byte [rbx]
add rbx, 1
call sym.Curl_raw_toupper
mov rdx, rdi
shl rdx, 5
movsx rax, al
add rdx, rdi
xor rax, rdx
mov rdi, rax
cmp rsi, rbx
jne 0x14003f820
movabs rdx, 0x410410410410411
mul rdx
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
mov rdx, rax
shl rdx, 6
sub rdx, rax
mov rax, rdi
sub rax, rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, 0x1a
jmp 0x14003f7ba