joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045750
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov word [rsp + 0x48], dx
mov eax, 0x10624dd3
imul r8d
movsxd rbx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [0x14027dfc8]
mov word [rsp + 0x4a], dx
test rax, rax
je 0x1400457a4
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x80
mov ecx, ebx
call rax
mov ebx, eax
jmp 0x1400458e9
cmp qword [0x14027e030], 0
mov qword [rsp + 0x40], rdi
je 0x140045800
mov rax, qword gs:[0x58]
mov edx, 0x22cc
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x140045800
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rdi, rbx
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x140045803
mov ebx, 1
jmp 0x140045805
mov rdi, rbx
xor ebx, ebx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
test ebx, ebx
mov rbx, qword [rax + rdi*8]
jne 0x140045872
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x140045844
cmp dword [rbx + 0xc], 2
jne 0x140045844
cmp word [rbx + 0x6c], 0
jne 0x14004588f
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171260
mov rbx, rax
jmp 0x1400458e4
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
movsxd rax, dword [rbx + 0x70]
je 0x1400458b9
cmp dword [rbx + 0xc], 2
jne 0x1400458b9
cmp word [rbx + 0x6c], 0
je 0x1400458b9
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400458ae
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_shutdown
or ebx, 0xffffffff
jmp 0x1400458e4
mov rcx, rax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171260
mov ebx, eax
mov rdi, qword [rsp + 0x40]
test ebx, ebx
je 0x140045905
lea r8, str.SO_LINGER
mov ecx, 0x4b0003
lea rdx, str.failed_setsockopt__s_:__m
call fcn.14002d450
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140045910
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x10], edx
push rsi
sub rsp, 0x30
movsxd rbp, ecx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rsi, [rbp*8]
lea rcx, [0x14027dfa0]
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
test byte [rbx + 0x68], 1
jne 0x140045969
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rax, qword [0x14027dfc8]
mov qword [rsp + 0x40], rdi
or edi, 0xffffffff
test rax, rax
je 0x14004599a
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea edx, [rdi + 7]
mov ecx, ebp
lea r8d, [rdi + 2]
call rax
jmp 0x140045a7b
cmp qword [0x14027e030], 0
je 0x1400459ee
mov rax, qword gs:[0x58]
mov edx, 0x22cc
mov rcx, qword [rax]
cmp dword [rdx + rcx], 0
jne 0x1400459ee
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
test dword [rbx + 0x68], 0x10000000
jne 0x1400459ee
mov ebx, 1
jmp 0x1400459f0
xor ebx, ebx
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
test ebx, ebx
mov rbx, qword [rsi + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
je 0x140045a52
cmp dword [rbx + 0xc], 2
jne 0x140045a52
cmp word [rbx + 0x6c], 0
je 0x140045a52
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140045a48
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_shutdown
mov eax, edi
jmp 0x140045a7b
movsxd rcx, dword [rbx + 0x70]
lea r9, [rsp + 0x48]
mov r8d, 1
mov dword [rsp + 0x20], 4
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
movsxd rcx, eax
call fcn.140171260
test eax, eax
je 0x140045abd
mov rax, qword [0x14027e030]
mov ecx, 3
test rax, rax
mov edx, 7
cmovne ecx, edx
jne 0x140045ab9
cmp ecx, 5
jbe 0x140045aa5
cmp dword [0x14027e44c], ecx
jl 0x140045ab9
or ecx, 0x4b0000
lea rdx, str.failed_setsockopt_TCP_NODELAY_:__m
call fcn.14002d450
mov edi, eax
mov eax, edi
jmp 0x140045abf
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140045ae0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, edx
lea rcx, [0x14027dfa0]
mov dword [rsp + 0x30], edx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rbx, [rbx*8]
lea rcx, [0x14027dfa0]
mov rdi, qword [rbx + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rdi + 0x68]
test al, 1
je 0x140045bd7
test esi, esi
jne 0x140045b73
test al, al
jns 0x140045b73
movsxd rcx, dword [rdi + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x140045b73
lea rdx, str.WSAEventSelect:__m
mov ecx, 0x4b0003
call fcn.14002d450
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rbx + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
movsxd rcx, dword [rbx + 0x70]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movsxd rcx, eax
call fcn.140171260
test eax, eax
je 0x140045bd7
lea rdx, str.failed_ioctl_FIOBIO_:__m
mov ecx, 0x4b0003
call fcn.14002d450
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
and dword [rdi + 0x68], 0xffffff7f
mov rbx, qword [rsp + 0x38]
neg esi
mov rsi, qword [rsp + 0x40]
sbb eax, eax
and eax, 0x80
or dword [rdi + 0x68], eax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400472a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x14027dfa0]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp dword [rbx + 0xc], 2
jne 0x140047410
cmp esi, 0x10
jae 0x140047322
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047309
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x14004733c
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x140047410
cmp word [rbx + 0x6c], 0
je 0x140047410
mov rcx, rbx
call fcn.140048e90
test eax, eax
jne 0x14004730f
mov eax, dword [rdi + 4]
test eax, eax
je 0x1400473ae
cmp eax, dword [rbx + 0x9c]
je 0x1400473ae
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047395
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x1400473f3
movzx eax, word [rdi + 2]
test ax, ax
je 0x1400473f3
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140047490
cmp dword [0x14027e04c], 0
je 0x14004742e
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.1400343b0
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140171260
cmp dword [0x14027e04c], 0
mov rdi, rax
je 0x140047457
call fcn.140034850
test edi, edi
jne 0x14004747d
cmp dword [rbx + 0xc], 2
jne 0x14004747d
cmp word [rbx + 0x94], di
jne 0x14004747d
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140047490
test eax, eax
jne 0x14004730f
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x1400474ca
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140047490
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, ecx
mov esi, r8d
lea rcx, [0x14027dfa0]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp dword [rbx + 0xc], 2
jne 0x140047410
cmp esi, 0x10
jae 0x140047322
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047309
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rdi + 2]
mov word [rbx + 0x94], ax
test ax, ax
je 0x14004733c
mov dword [rbx + 0x178], 1
cmp qword [rbx + 0x40], 0
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
je 0x140047410
cmp word [rbx + 0x6c], 0
je 0x140047410
mov rcx, rbx
call fcn.140048e90
test eax, eax
jne 0x14004730f
mov eax, dword [rdi + 4]
test eax, eax
je 0x1400473ae
cmp eax, dword [rbx + 0x9c]
je 0x1400473ae
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047395
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_send
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, dword [rbx + 0x90]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x1400473f3
movzx eax, word [rdi + 2]
test ax, ax
je 0x1400473f3
mov word [rbx + 0x94], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0x98], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, dword [rbx + 0x90]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140047490
cmp dword [0x14027e04c], 0
je 0x14004742e
lea r8, str.bind_slow
xor edx, edx
lea rcx, str.vsock_bind
call fcn.1400343b0
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140171260
cmp dword [0x14027e04c], 0
mov rdi, rax
je 0x140047457
call fcn.140034850
test edi, edi
jne 0x14004747d
cmp dword [rbx + 0xc], 2
jne 0x14004747d
cmp word [rbx + 0x94], di
jne 0x14004747d
mov edx, dword [rbx + 0x70]
mov rcx, rbx
call 0x140047490
test eax, eax
jne 0x14004730f
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
movsxd rcx, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x1400474ca
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
movzx eax, word [rsp + 0x22]
mov word [rbx + 0x94], ax
mov eax, dword [rsp + 0x24]
mov dword [rbx + 0x98], eax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140047d70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x68]
or rdi, 0xffffffffffffffff
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
bt eax, 0x1a
jae 0x140047dc5
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x140047dba
call fcn.1401762d4
mov dword [rax], 0x2746
jmp 0x140047f72
cmp word [rcx + 0x6c], 0
je 0x140047e85
mov rcx, qword [rcx + 0x80]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.14005a110
movsxd rax, dword [rsp + 0x50]
mov r9d, r14d
movsxd rcx, dword [rbx + 0x70]
cmp rsi, rax
mov rdx, qword [rsp + 0x28]
cmovb rax, rsi
mov r8d, eax
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
call fcn.140171260
mov rsi, rax
test eax, eax
jns 0x140047f72
mov rcx, qword gs:[0x58]
mov eax, 0x2f80
mov rdx, qword [rcx]
mov rax, qword [rax + rdx]
test rax, rax
jne 0x140047e3e
call fcn.1401762d4
cmp dword [rax], 0x2738
jne 0x140047f72
mov rcx, qword [rbx + 0x80]
mov edx, esi
call fcn.14005a180
cmp dword [rsp + 0x70], 0
jne 0x140047e7d
mov rcx, qword [rbx + 0x80]
mov r8d, esi
mov rdx, rbp
call fcn.140043550
mov rcx, qword [rbx + 0x80]
call fcn.14005a1e0
movsxd rax, esi
jmp 0x140047f75
test eax, 0x4080
jne 0x140047ec7
bt eax, 0xa
jb 0x140047e9f
call fcn.140043930
test eax, eax
jne 0x140047d9b
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jae 0x140047ec7
nop dword [rax + rax]
mov edx, 1
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [rbx + 0x68]
bt eax, 0xa
jb 0x140047eb0
bt eax, 0xe
jae 0x140047f37
mov rcx, qword [rbx + 0x80]
call fcn.14005a390
test eax, eax
je 0x140047f15
cmp dword [rsp + 0x70], 0
mov edi, eax
jne 0x140047f15
mov rcx, qword [rbx + 0x80]
mov rdx, rbp
cdqe
cmp rax, rsi
cmovb rsi, rax
mov r8d, esi
call fcn.140043550
test byte [rbx + 0x68], 0x20
mov edi, eax
jne 0x140047f1b
mov rcx, qword [rbx + 0x80]
call fcn.14005a1e0
test byte [rbx + 0x68], 0x20
je 0x140047f2b
mov rcx, qword [rbx + 0x80]
call fcn.14005a390
test eax, eax
jne 0x140047f32
and dword [rbx + 0x68], 0xffffbfff
movsxd rax, edi
jmp 0x140047f75
test al, al
mov edx, 0x2f80
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
jns 0x140047f62
test rax, rax
jne 0x140047f5a
call fcn.1401762d4
mov dword [rax], 0x2733
jmp 0x140047f72
test rax, rax
jne 0x140047f6c
call fcn.1401762d4
mov dword [rax], 0x2714
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140048480
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rdi
sub rsp, 0x70
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov r13d, r9d
mov qword [rax - 0x38], r15
call fcn.14005a070
mov r10, qword [rsp + 0xb0]
mov rdi, rax
movzx ebx, word [rsi + 0x94]
mov ebp, 0x1c
mov r12d, dword [rsi + 0x9c]
mov dword [rsp + 0x90], reloc.WS2_32.dll_recv
movzx eax, word [r10 + 2]
mov r15d, dword [r10 + 4]
mov word [rsp + 0xb0], ax
test bx, bx
jne 0x14004858f
xor eax, eax
mov qword [rsp + 0x58], r14
movsxd r14, dword [rsi + 0x90]
lea r8d, [rbp - 0xc]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov eax, 2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov rcx, r14
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], ebx
call qword [sym.imp.WS2_32.dll_bind]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x140048552
lea rdx, str.bind_failed__m
mov ecx, 0x4b0003
call fcn.14002d450
jmp 0x14004858a
lea r8, [rsp + 0x30]
mov rcx, r14
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, eax
call fcn.140171260
test rax, rax
je 0x140048585
lea rdx, str.getsockname_failed__m
mov ecx, 0x4b0003
call fcn.14002d450
jmp 0x14004858a
movzx ebx, word [rsp + 0x42]
mov r14, qword [rsp + 0x58]
mov r8d, dword [rsp + 0xa0]
mov rcx, rdi
mov rdx, qword [rsp + 0x98]
mov word [rsi + 0x94], bx
call fcn.140059f60
movzx r8d, word [rsp + 0xb0]
mov r9d, r12d
movzx edx, bx
mov dword [rsp + 0x20], r15d
mov rcx, rdi
call fcn.14005adb0
mov r9b, reloc.WS2_32.dll_recvfrom
mov r8d, r15d
mov edx, r12d
mov rcx, rdi
call fcn.14005acb0
cmp word [rsi + 0x6c], 0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x68]
je 0x140048605
mov edx, dword [rsi + 0x68]
mov rcx, rdi
and edx, 0x200000
shl edx, 4
call fcn.140059ff0
mov ebp, 0x20
lea r8, [rsp + 0x90]
mov rcx, rdi
lea rdx, [rsp + 0x38]
call fcn.14005a0c0
movsxd r8, dword [rsp + 0x90]
mov r9d, r13d
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
call fcn.140048090
mov r13, qword [rsp + 0x60]
mov ebx, eax
mov rsi, qword [rsp + 0xa8]
test eax, eax
jle 0x140048647
sub ebx, ebp
mov rcx, rdi
call fcn.140059f30
movsxd rax, ebx
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
Function at 0x140048660
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rbx, ecx
mov rsi, r8
lea rcx, [0x14027dfa0]
mov rdi, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea r14, [rbx*8]
lea rcx, [0x14027dfa0]
mov rbx, qword [r14 + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
je 0x14004871b
cmp dword [rbx + 0xc], 2
jne 0x14004871b
cmp word [rbx + 0x6c], 0
je 0x14004871b
cmp dword [rsi], 0x10
jae 0x1400486ec
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x1400486e1
call fcn.1401762d4
mov dword [rax], reloc.WS2_32.dll_shutdown
or eax, 0xffffffff
jmp 0x140048762
mov dword [rsi], reloc.WS2_32.dll_recv
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov eax, 2
mov word [rdi], ax
mov eax, dword [rbx + 0x9c]
mov dword [rdi + 4], eax
movzx eax, word [rbx + 0x94]
mov word [rdi + 2], ax
xor eax, eax
jmp 0x140048762
lea rcx, [0x14027dfa0]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [r14 + rax]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp qword [rbx + 0x40], 0
jne 0x140048757
movsxd rcx, dword [rbx + 0x70]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x14004875a
or eax, 0xffffffff
movsxd rcx, eax
call fcn.140171260
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400487c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x14027dfa0]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x1400488e7
test al, 1
je 0x140048857
cmp qword [rbx + 0x40], 0
je 0x140048826
cmp dword [rbx + 0xc], 2
jne 0x140048826
cmp word [rbx + 0x6c], 0
jne 0x140048857
mov rax, qword [rsp + 0x68]
mov r9d, edi
movsxd rcx, dword [rbx + 0x70]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
movsxd rcx, eax
call fcn.140171260
jmp 0x1400488d2
test eax, 0x80000004
jne 0x140048898
cmp qword [rbx + 0x40], 0
je 0x140048872
cmp dword [rbx + 0xc], 2
jne 0x140048872
cmp word [rbx + 0x6c], 0
jne 0x140048898
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x76d
lea rdx, str.vsock_recvfrom
mov ecx, 0x4b0202
call fcn.14002d680
cdqe
jmp 0x1400488d2
cmp dword [rbx + 0xc], 0
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x1400488b9
mov dword [rsp + 0x20], 0
call fcn.140047d70
jmp 0x1400488d2
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140047f90
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.recvfrom_from_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d920
int3
Function at 0x140048910
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movsxd rbx, ecx
mov edi, r9d
lea rcx, [0x14027dfa0]
mov rsi, r8
mov rbp, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
jne 0x14004897f
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x72e
lea rdx, str.vsock_send
mov ecx, 0x4b0202
call fcn.14002d680
mov eax, dword [rbx + 0x68]
mov rcx, qword [rbx + 0x40]
test eax, 0x80000004
jne 0x1400489e4
test rcx, rcx
je 0x14004899c
cmp dword [rbx + 0xc], 2
jne 0x14004899c
cmp word [rbx + 0x6c], 0
jne 0x1400489e4
test al, 1
je 0x1400489c0
movsxd rcx, dword [rbx + 0x70]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rcx, eax
call fcn.140171260
jmp 0x140048a43
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x733
lea rdx, str.vsock_send
mov ecx, 0x4b0202
call fcn.14002d680
jmp 0x140048a41
test rcx, rcx
je 0x140048a30
cmp dword [rbx + 0xc], 2
jne 0x140048a30
cmp word [rbx + 0x6c], 0
je 0x140048a30
bt eax, 0x18
jae 0x140048a58
cmp dword [rbx + 0x14], 0x11
lea rax, [rbx + 0xb0]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov r9d, edi
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
jne 0x140048a29
call fcn.140048480
jmp 0x140048a41
call fcn.140048390
jmp 0x140048a41
mov r9d, edi
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.140048090
cdqe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rdx, str.cannot_use_send_when_socket_not_connected
mov ecx, 0x4b0000
call fcn.14002d920
int3
Function at 0x140048a70
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
movsxd rbx, ecx
mov esi, r9d
lea rcx, [0x14027dfa0]
mov rbp, r8
mov r14, rdx
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, qword [0x14027e020]
lea rcx, [0x14027dfa0]
mov rbx, qword [rax + rbx*8]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rbx + 0x68]
test al, 0x40
je 0x140048bd1
test eax, 0x80000004
jne 0x140048b33
cmp qword [rbx + 0x40], 0
je 0x140048ada
cmp dword [rbx + 0xc], 2
jne 0x140048ada
cmp word [rbx + 0x6c], 0
jne 0x140048b33
test al, 1
je 0x140048b0d
mov eax, dword [rsp + 0x68]
mov r9d, esi
movsxd rcx, dword [rbx + 0x70]
mov r8d, ebp
mov dword [rsp + 0x28], eax
mov rdx, r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
movsxd rcx, eax
call fcn.140171260
jmp 0x140048b57
lea r9, str.invalid_type:__d
mov dword [rsp + 0x20], eax
mov r8d, 0x783
lea rdx, str.vsock_sendto
mov ecx, 0x4b0202
call fcn.14002d680
cdqe
jmp 0x140048b57
mov qword [rsp + 0x40], rdi
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x140048b6d
mov ecx, dword [rbx]
mov r9d, esi
mov r8, rbp
mov rdx, r14
call fcn.140048910
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
cmp dword [rbx + 0xc], 2
jne 0x140048be3
cmp dword [rbx + 0x14], 0x11
jne 0x140048bab
mov rcx, rbx
call fcn.140048e90
test eax, eax
je 0x140048b8b
or rax, 0xffffffffffffffff
jmp 0x140048b52
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140048480
jmp 0x140048b52
cmp dword [rbx + 0x10], 3
jne 0x140048be3
mov eax, dword [rsp + 0x68]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.140048390
jmp 0x140048b52
lea rdx, str.sendto_to_non_packet_socket
mov ecx, 0x4b0000
call fcn.14002d920
int3
lea rdx, str.invalid_socket_address
mov ecx, 0x4b0000
call fcn.14002d920
int3