joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015f62
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call sym.__pthread_self_lite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x140015fcf
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x14001f4d0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140016113
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14001606c
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140016027
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x14001f4d0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140016113
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400160a6
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x140016113
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x14001f4d0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140016d55
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x14001f4e0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x140028d90]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x14001f4d0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x140016e6a
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x14001f4e0]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140016e38
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x14001f4e0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x140016e79
lea rax, [0x14001f4e0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140016eb5
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140016f23
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x14001f4d0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140016f6d
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x140016f6d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x14001f4e0]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x140016f5f
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140003b80
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
mov rbx, qword [0x140018100]
mov r8, rcx
mov r9, rdx
test rbx, rbx
je 0x140003da8
lea r11, [rcx + 0x24]
mov r10, rcx
mov edi, 0x9e3779b9
mov esi, 0x9e3779b9
mov ecx, 0xfeedbeef
movzx edx, byte [r10 + 5]
movzx eax, byte [r10 + 6]
shl edx, 8
shl eax, 0x10
add edx, eax
movzx eax, byte [r10 + 4]
add edx, eax
movzx eax, byte [r10 + 7]
shl eax, 0x18
add edx, eax
movzx eax, byte [r10 + 9]
add edx, edi
movzx edi, byte [r10 + 0xa]
shl eax, 8
shl edi, 0x10
add eax, edi
movzx edi, byte [r10 + 8]
add eax, edi
movzx edi, byte [r10 + 0xb]
shl edi, 0x18
add eax, edi
movzx edi, byte [r10 + 2]
add eax, ecx
movzx ecx, byte [r10 + 1]
shl edi, 0x10
shl ecx, 8
add ecx, edi
movzx edi, byte [r10]
add ecx, edi
movzx edi, byte [r10 + 3]
shl edi, 0x18
add ecx, edi
sub ecx, edx
sub edx, eax
sub ecx, eax
add ecx, esi
mov esi, eax
shr esi, 0xd
xor ecx, esi
mov esi, edx
mov edx, ecx
sub esi, ecx
sub eax, ecx
shl edx, 8
xor edx, esi
sub eax, edx
mov esi, eax
mov eax, edx
shr eax, 0xd
xor eax, esi
sub ecx, edx
add r10, 0xc
mov esi, ecx
mov ecx, eax
sub edx, eax
sub esi, eax
shr ecx, 0xc
xor ecx, esi
mov esi, edx
mov edx, ecx
sub esi, ecx
sub eax, ecx
shl edx, 0x10
xor edx, esi
sub eax, edx
sub ecx, edx
mov esi, eax
mov eax, edx
shr eax, 5
xor eax, esi
mov esi, eax
sub ecx, eax
sub edx, eax
shr esi, 3
xor esi, ecx
mov edi, esi
sub edx, esi
sub eax, esi
shl edi, 0xa
xor edi, edx
mov ecx, edi
sub eax, edi
shr ecx, 0xf
xor ecx, eax
cmp r11, r10
jne 0x140003baf
movzx eax, byte [r8 + 0x24]
add ecx, 0x25
mov edx, ecx
add eax, esi
shr edx, 0xd
sub eax, edi
sub edi, ecx
sub eax, ecx
xor edx, eax
mov eax, edx
sub edi, edx
sub ecx, edx
shl eax, 8
xor eax, edi
sub ecx, eax
sub edx, eax
mov r10d, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, r10d
mov r10d, ecx
sub edx, ecx
sub eax, ecx
shr r10d, 0xc
xor r10d, edx
mov edx, r10d
sub eax, r10d
sub ecx, r10d
shl edx, 0x10
xor edx, eax
mov eax, edx
sub ecx, edx
sub r10d, edx
shr eax, 5
xor eax, ecx
mov ecx, eax
sub r10d, eax
sub edx, eax
shr ecx, 3
xor r10d, ecx
mov ecx, r10d
sub edx, r10d
shl ecx, 0xa
sub eax, r10d
xor r10d, r10d
xor edx, ecx
mov rcx, qword [rbx + 0x38]
sub eax, edx
shr edx, 0xf
xor edx, eax
mov eax, dword [rcx + 8]
sub eax, 1
and eax, edx
shl rax, 4
add rax, qword [rcx]
mov rax, qword [rax]
test rax, rax
je 0x140003d9b
mov r10, qword [rcx + 0x20]
mov rcx, r10
sub rax, r10
neg rcx
jmp 0x140003d4c
mov rax, qword [rax + 0x58]
test rax, rax
je 0x140003da8
add rax, rcx
cmp dword [rax + 0x6c], edx
jne 0x140003d40
cmp dword [rax + 0x68], 0x25
jne 0x140003d40
mov rbx, qword [rax + 0x60]
mov r10, qword [rbx]
mov r11, qword [rbx + 8]
xor r10, qword [r8]
xor r11, qword [r8 + 8]
or r10, r11
jne 0x140003d40
mov r10, qword [rbx + 0x10]
mov r11, qword [rbx + 0x18]
xor r10, qword [r8 + 0x10]
xor r11, qword [r8 + 0x18]
or r10, r11
jne 0x140003d40
mov rdi, qword [r8 + 0x1d]
cmp qword [rbx + 0x1d], rdi
jne 0x140003d40
test r9, r9
je 0x140003d95
mov qword [r9], rax
mov r10d, 1
mov eax, r10d
pop rbx
pop rsi
pop rdi
ret
xor r10d, r10d
mov eax, r10d
pop rbx
pop rsi
pop rdi
ret
Function at 0x140005a20
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140014660]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140005a40
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140005a48
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140005a40
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140005a9d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140005a94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140005a40
add rax, 0x28
cmp rax, r9
jne 0x140005a80
xor eax, eax
ret

Function at 0x140005aa0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140014660]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140005abf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140005ac8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140005abf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140005b60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140014660]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140005b7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140005b88
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002580
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x1400025a0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, 6
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140002660
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 0
test edx, edx
jne 0x140002688
lea r9, [rsp + 0x50]
jmp 0x140002692
cmp edx, 1
jne 0x1400026db
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov ebx, eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
jne 0x14000272e
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov ebx, eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret

Function at 0x140002b00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x44]
mov rcx, rbx
mov rbp, r9
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, dword [rsp + 0x60]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x40]
cmp rax, rsi
cmovb rax, rsi
xor edx, edx
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x40]
shr rax, 0x20
mov dword [rsp + 0x20], ecx
mov rcx, rbx
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140002b7e
call fcn.140001210
jmp 0x140002be6
test rsi, rsi
jne 0x140002b91
mov rax, qword [rsp + 0x40]
sub rax, rbp
mov qword [rdi + 8], rax
jmp 0x140002b95
mov qword [rdi + 8], rsi
mov edx, dword [rsp + 0x68]
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rbp
mov r8d, dword [rdi + 0x1c]
mov r9d, ebp
mov qword [rsp + 0x28], 0
mov dword [rdi + 0x20], edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov qword [rdi], rax
test rax, rax
jne 0x140002be4
call fcn.140001210
mov rcx, qword [rdi + 0x10]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], 0
mov eax, ebx
jmp 0x140002be6
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140002cd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r12, r9
mov dword [rax - 0x38], 0x1c
lea r8, [rax - 0x38]
mov word [rax - 0x30], bx
lea rdx, [rax - 0x30]
cmp dword [rsp + 0x80], ebx
je 0x140002d14
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x140002d1a
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x140002d22
xor eax, eax
jmp 0x140002d9d
movzx ecx, word [rsp + 0x2a]
mov qword [rsp + 0x60], rbp
movzx ebp, word [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_ntohs]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov word [r12], ax
movzx eax, word [rsp + 0x28]
movsxd r9, dword [rdi]
cmp eax, 2
mov r8, rsi
cmovne rdx, rcx
mov ecx, eax
call sub.WS2_32.dll_InetNtopW
test rax, rax
je 0x140002d78
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 1
inc eax
mov dword [rdi], eax
jmp 0x140002d96
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x57
jne 0x140002d96
mov ecx, 0x41
mov eax, reloc.WS2_32.dll_shutdown
cmp bp, 2
cmove ecx, eax
mov dword [rdi], ecx
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret

Function at 0x140002de0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, rcx
mov rcx, qword [rdx + 8]
mov rbx, rdx
xor edx, edx
mov edi, r9d
mov rsi, r8
test rcx, rcx
je 0x140002e34
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 0x80
lea r9d, [rdx + 1]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdx
mov r8d, 0x80000000
mov rdx, rax
call fcn.1400028e0
jmp 0x140002e5e
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov rcx, rax
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140002e7d
call fcn.140001210
test eax, eax
jns 0x140002e80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rbx], rax
mov rcx, qword [rbx]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x58], eax
cmp eax, 0xffffffff
jne 0x140002ea0
call fcn.140001210
test eax, eax
js 0x140002ef2
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140002ee0
cmp rax, rdi
ja 0x140002ee0
mov rdx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 2
call fcn.140002b00
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
test rax, rax
mov ecx, 0x800700df
mov edx, 0x800703ee
cmove ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140002fd0
Capabilities:
Get socket status

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r8d, edx
mov eax, 0x10624dd3
mov rbx, rcx
mov qword [rsp + 0x258], rcx
mov qword [rsp + 0x48], rcx
lea r9, [rsp + 0x40]
mul edx
shr edx, 6
lea rax, [rsp + 0x38]
xor ecx, ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x250], 1
mov dword [rsp + 0x40], 1
imul edx, edx, 0x3e8
sub r8d, edx
xor edx, edx
mov qword [rsp + 0x20], rax
imul r8d, r8d, 0x3e8
mov dword [rsp + 0x3c], r8d
lea r8, [rsp + 0x250]
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x140003062
jne 0x1400030af
mov eax, 0x5b4
jmp 0x1400030d0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
mov rcx, rbx
test eax, eax
je 0x1400030c1
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1007
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400030af
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x1400030af
cmp eax, 0xffffffff
jne 0x1400030d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x22a
test eax, eax
cmove eax, ecx
jmp 0x1400030d0
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140254f60
add rsp, 0x470
pop rbx
ret
Function at 0x1400032c0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [r8]
mov rdi, r8
movzx ebx, dx
mov r10, rcx
cmp ax, 2
je 0x140002c42
cmp ax, 0x17
je 0x140002c3b
mov ecx, 0x2741
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x1c
jmp 0x140002c47
mov ecx, reloc.WS2_32.dll_recv
movzx edx, ax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], ecx
mov r9, r8
mov rcx, r10
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
jne 0x140002c2e
test bx, bx
je 0x140002c7d
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rdi + 2], ax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
mov rsi, r8
mov rbx, rcx
mov qword [r8 + 2], rax
mov qword [r8 + 0xa], rax
mov qword [r8 + 0x12], rax
mov word [r8 + 0x1a], ax
movzx ebp, dx
lea rcx, [rsp + 0x2c]
lea r8d, [rax + 0x2c]
xor edi, edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.1402547c0
movzx eax, word [rsi]
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x68]
lea r8d, [rdi + 3]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov dword [rsp + 0x28], 0xc00
mov qword [rsp + 0x60], rax
call fcn.140003180
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x14000336b
call fcn.1402540ac
test ebx, ebx
je 0x14000337b
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x1400033de
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
test rbx, rbx
je 0x1400033b5
mov eax, dword [rdx + 4]
cmp eax, 2
je 0x1400033a0
cmp eax, 0x17
je 0x1400033a0
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x140003388
jmp 0x1400033b5
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rsi
call fcn.1402550b0
mov edi, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x1400033d1
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsi + 2], ax
jmp 0x1400033dc
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
movzx esi, dx
mov rdi, rcx
call fcn.140002490
mov r8, rbx
movzx edx, si
mov word [rbx], ax
mov rcx, rdi
test ax, ax
je 0x140003452
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140002c00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400032c0
Function at 0x140003410
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [r8]
mov rdi, r8
movzx ebx, dx
mov r10, rcx
cmp ax, 2
je 0x140002c42
cmp ax, 0x17
je 0x140002c3b
mov ecx, 0x2741
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x1c
jmp 0x140002c47
mov ecx, reloc.WS2_32.dll_recv
movzx edx, ax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], ecx
mov r9, r8
mov rcx, r10
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
jne 0x140002c2e
test bx, bx
je 0x140002c7d
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rdi + 2], ax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
mov rsi, r8
mov rbx, rcx
mov qword [r8 + 2], rax
mov qword [r8 + 0xa], rax
mov qword [r8 + 0x12], rax
mov word [r8 + 0x1a], ax
movzx ebp, dx
lea rcx, [rsp + 0x2c]
lea r8d, [rax + 0x2c]
xor edi, edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.1402547c0
movzx eax, word [rsi]
mov dword [rsp + 0x2c], eax
lea rax, [rsp + 0x68]
lea r8d, [rdi + 3]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov dword [rsp + 0x28], 0xc00
mov qword [rsp + 0x60], rax
call fcn.140003180
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x14000336b
call fcn.1402540ac
test ebx, ebx
je 0x14000337b
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x1400033de
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
test rbx, rbx
je 0x1400033b5
mov eax, dword [rdx + 4]
cmp eax, 2
je 0x1400033a0
cmp eax, 0x17
je 0x1400033a0
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x140003388
jmp 0x1400033b5
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rsi
call fcn.1402550b0
mov edi, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x1400033d1
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsi + 2], ax
jmp 0x1400033dc
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140254f60
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
movzx esi, dx
mov rdi, rcx
call fcn.140002490
mov r8, rbx
movzx edx, si
mov word [rbx], ax
mov rcx, rdi
test ax, ax
je 0x140003452
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140002c00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400032c0