joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019f0
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x20f0
call fcn.140062340
sub rsp, rax
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x20e0], rax
mov r9d, 0x400
lea rdx, [0x140065a45]
mov r8d, r9d
lea rcx, [rsp + 0x30]
call fcn.1400224c0
lea rdx, str.UPDATE_t1_SET
lea rcx, [rsp + 0x30]
call fcn.1400223d0
mov eax, dword [0x1401c2028]
test eax, eax
je 0x140001acc
mov ebx, 1
cmp eax, ebx
jb 0x140001acc
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, ebx
lea r8, str.intcol_d___ld
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0x20], eax
mov edx, 0x2004
call fcn.140001010
cmp eax, 0x2004
jg 0x140001c0e
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.1400223d0
mov eax, dword [0x1401c2028]
cmp ebx, eax
jb 0x140001aa9
cmp dword [0x1401c202c], 0
jbe 0x140001ac6
mov r8d, 1
lea rdx, [0x140065cdc]
lea rcx, [rsp + 0x30]
call fcn.1400223f0
mov eax, dword [0x1401c2028]
inc ebx
cmp ebx, eax
jbe 0x140001a53
mov eax, dword [0x1401c202c]
test eax, eax
je 0x140001b6e
mov ebx, 1
cmp eax, ebx
jb 0x140001b6e
nop word [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.140003440
lea rcx, [rsp + 0x50]
mov r9d, ebx
mov qword [rsp + 0x28], rcx
lea r8, str.charcol_d___.s
lea rcx, [rsp + 0xd0]
mov dword [rsp + 0x20], eax
mov edx, 0x2004
call fcn.140001010
cmp eax, 0x2004
jg 0x140001c34
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.1400223d0
mov eax, dword [0x1401c202c]
cmp ebx, eax
jae 0x140001b68
mov r8d, 1
lea rdx, [0x140065cdc]
lea rcx, [rsp + 0x30]
call fcn.1400223f0
mov eax, dword [0x1401c202c]
inc ebx
cmp ebx, eax
jbe 0x140001af0
cmp byte [0x14037ad68], 0
jne 0x140001b80
cmp byte [0x14037ad69], 0
je 0x140001b91
lea rdx, str._WHERE_id_
lea rcx, [rsp + 0x30]
call fcn.1400223d0
mov edx, 0x38
lea ecx, [rdx - 8]
call fcn.140021590
mov rcx, qword [rsp + 0x38]
mov edx, 0x38
inc rcx
mov rbx, rax
call fcn.140021590
mov qword [rbx], rax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rbx + 8], rax
cmp byte [0x14037ad68], 0
jne 0x140001bd6
cmp byte [0x14037ad69], 0
mov al, 1
je 0x140001bd8
mov al, 3
mov byte [rbx + 0x10], al
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbx]
call fcn.140031950
lea rcx, [rsp + 0x30]
call fcn.140022490
mov rax, rbx
mov rcx, qword [rsp + 0x20e0]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x20f0
pop rbx
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Memory_Allocation_error_in_creating_update_n
call fcn.1400023b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Memory_Allocation_error_in_creating_update_n
call fcn.1400023b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400022f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x2050
call fcn.140062340
sub rsp, rax
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rdi, rdx
lea r8, str.DROP_SCHEMA_IF_EXISTS___s_
mov rbx, rcx
mov r9, rdx
mov edx, 0x2004
lea rcx, [rsp + 0x30]
call fcn.140001010
movsxd r8, eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140004100
test eax, eax
je 0x140002388
mov rcx, rbx
call fcn.1400059a0
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1403835b8]
lea rdx, str._s:_Cannot_drop_database__s_ERROR_:__s_n
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov r9, rdi
call fcn.1400023b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.1400623a0
mov rbx, qword [rsp + 0x2070]
add rsp, 0x2050
pop rdi
ret

Function at 0x140002400
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [0x14037acc5], 0
mov rax, rdx
mov rbx, rcx
jne 0x140002562
test rdx, rdx
je 0x14000243a
mov rcx, qword [rax]
lea rdx, str.blackhole
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140002562
mov r8d, select
lea rdx, str.SELECT_id_from_t1
mov rcx, rbx
call fcn.140004100
mov rcx, rbx
test eax, eax
je 0x14000248e
call fcn.1400059a0
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1403835b8]
lea rdx, str._s:_Cannot_select_GUID_primary_keys.___s__n
mov rcx, rax
mov r9, rbx
call fcn.1400023b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140006fb0
mov rdi, rax
test rax, rax
jne 0x1400024e5
mov rcx, rbx
call fcn.1400059a0
mov rcx, rbx
mov rdi, rax
call fcn.140005990
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1403835b8]
lea rdx, str._s:_Error_when_storing_result:__d__s_n
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9d, ebx
call fcn.1400023b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rdi
call fcn.140005790
mov qword [0x1403840f0], rax
test rax, rax
je 0x14000254d
lea ecx, [rax*8]
mov edx, 0x38
call fcn.140021590
mov rcx, rdi
mov qword [0x1403840f8], rax
call fcn.1400073a0
xor ebx, ebx
cmp qword [0x1403840f0], rbx
jbe 0x14000254d
mov rcx, qword [rax]
xor edx, edx
call fcn.1400217a0
mov rcx, qword [0x1403840f8]
mov qword [rcx + rbx*8], rax
mov rcx, rdi
inc rbx
call fcn.1400073a0
cmp rbx, qword [0x1403840f0]
jb 0x140002524
mov rcx, rdi
call fcn.1400072c0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edx, 0x38
mov qword [0x1403840f0], 1
lea ecx, [rdx - 0x30]
call fcn.140021590
xor edx, edx
mov qword [0x1403840f8], rax
lea rcx, str.796c4422_1d94_102a_9d6d_00e0812d
call fcn.1400217a0
mov rcx, qword [0x1403840f8]
mov rbx, qword [rsp + 0x40]
mov qword [rcx], rax
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140004180
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], r9
mov rbp, r9
mov edi, r8d
call fcn.140020f80
xor ecx, ecx
call fcn.140021040
lea rcx, [0x140384160]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140384120]
mov dword [0x140384188], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140384120]
mov dword [0x140384148], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
test edi, edi
je 0x14000422f
lea r9, [rsp + 0x38]
lea r8, [0x140004430]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140020e20
test eax, eax
jne 0x14000434e
inc dword [0x140384188]
inc ebx
cmp ebx, edi
jb 0x140004200
lea rcx, [0x140384160]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x20]
call fcn.140020f80
lea rcx, [0x140384120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x140384100]
mov dword [0x140384148], 0
call fcn.140020f90
lea rcx, [0x140384120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400034c0
lea rcx, [0x140384160]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140384188], 0
je 0x1400042fe
movabs rbx, 0x12e0be826d694b2f
call fcn.1400225b0
add rax, 0x2dc6c0
lea rcx, [0x140384150]
imul r8, rax, 0x3e8
mov rax, rbx
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
lea rdx, [0x140384160]
shr rax, 0x1d
mov qword [rsp + 0x48], rax
imul eax, eax, 0x3b9aca00
sub r8d, eax
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x48]
call fcn.140020ff0
cmp dword [0x140384188], 0
jne 0x1400042a2
lea rcx, [0x140384160]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400034c0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.140004b00
mov dword [rsi], eax
xor eax, eax
mov dword [rsi + 4], edi
mov qword [rsi + 8], rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400623a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1403835b8]
lea rdx, str._s:_Could_not_create_thread_n
mov rcx, rax
call fcn.1400023b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140004380
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400043d2
mov r8, qword [rbx + 8]
test r8, r8
je 0x1400043d2
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140004100
mov rcx, rdi
test eax, eax
jne 0x1400043df
call fcn.140005800
test eax, eax
je 0x1400043c9
mov rcx, rdi
call fcn.140006fb0
mov rcx, rax
call fcn.1400072c0
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140004395
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
call fcn.1400059a0
mov ecx, 2
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [rbx + 8]
lea rdx, str._s:_Cannot_run_query__.s_ERROR_:__s_n
mov r8, qword [0x1403835b8]
mov rcx, rax
mov rax, qword [rbx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400023b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14000b5e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
call fcn.140012530
call fcn.140015e30
call fcn.140017980
xor edx, edx
lea rcx, str.latin1
call fcn.140018040
call fcn.140014f70
test eax, eax
je 0x14000b614
mov eax, 1
add rsp, 0x28
ret
cmp dword [0x14037b038], 0
jne 0x14000b674
lea rdx, [0x140066b98]
mov dword [0x14037b038], 0xcea
lea rcx, str.mysql
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
je 0x14000b653
movzx ecx, word [rax + 0x18]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [0x14037b038], eax
lea rcx, str.MYSQL_TCP_PORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000b674
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x14037b038], eax
cmp qword [0x14037b040], 0
jne 0x14000b6b7
lea rax, str.MySQL
lea rcx, str.MYSQL_UNIX_PORT
mov qword [0x14037b040], rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14000b6b0
lea rcx, str.MARIADB_UNIX_PORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000b6b7
mov qword [0x14037b040], rax
cmp byte [0x14037b06a], 0
jne 0x14000b6c5
call fcn.140013c20
xor edx, edx
xor ecx, ecx
call fcn.140016400
xor eax, eax
mov byte [0x14037b048], 1
add rsp, 0x28
ret

Function at 0x14000b840
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rdx, str.ODBC
mov r8d, 0x200
test rax, rax
mov rcx, rbx
cmovne rdx, rax
add rsp, 0x20
pop rbx
jmp fcn.1400120f0
Function at 0x140012530
Capabilities:
Initialize winsock library

Disassembly:
cmp byte [0x14037b069], 0
jne 0x140012545
mov byte [0x14037b069], 1
jmp 0x140012550
ret
sub rsp, 0x1d8
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400125b5
movzx ecx, word [rsp + 0x20]
movzx eax, cl
lea edx, [rax + rax*4]
mov eax, ecx
shr eax, 8
lea eax, [rax + rdx*2]
cmp eax, 0x16
jae 0x1400125b5
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov al, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x1d8
ret

Function at 0x140012550
Capabilities:
Initialize winsock library

Disassembly:
cmp byte [0x14037b069], 0
jne 0x140012545
mov byte [0x14037b069], 1
jmp 0x140012550
ret
sub rsp, 0x1d8
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400125b5
movzx ecx, word [rsp + 0x20]
movzx eax, cl
lea edx, [rax + rax*4]
mov eax, ecx
shr eax, 8
lea eax, [rax + rdx*2]
cmp eax, 0x16
jae 0x1400125b5
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov al, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x1d8
ret

Function at 0x140014d10
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x20
mov rbp, rcx
lea rcx, str.LIBMYSQL_PLUGINS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140014ded
xor r8d, r8d
mov rdx, rax
cmp byte [rdx], 0
je 0x140014d7b
cmp byte [rdx + 1], 0
je 0x140014d6f
cmp byte [rdx + 2], 0
je 0x140014d69
cmp byte [rdx + 3], 0
je 0x140014d63
add rdx, 4
add r8d, 4
cmp r8d, 0x400
jb 0x140014d35
add rsp, 0x20
pop rbp
ret
add r8d, 3
jmp 0x140014d72
add r8d, 2
jmp 0x140014d72
inc r8d
cmp r8d, 0x400
jae 0x140014ded
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rsi, rax
mov rbx, rax
nop dword [rax]
mov edx, 0x3b
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
xor r9d, r9d
mov rdx, rbx
mov rcx, rbp
lea rdi, [rax + 1]
lea r8d, [r9 - 1]
test rax, rax
je 0x140014dd0
mov byte [rax], r9b
call fcn.1400150a0
mov rbx, rdi
jmp 0x140014da0
call fcn.1400150a0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rbp
ret
Function at 0x140016230
Capabilities:
Get remote cert context via schannel

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x20
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x30]
mov rbx, rdx
mov qword [rsp + 0x30], 0
add rcx, 0x30
mov edx, 0x53
call sub.Secur32.dll_QueryContextAttributesA
test eax, eax
je 0x140016269
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov r8, rbx
mov edx, 3
call qword [sym.imp.CRYPT32.dll_CertGetCertificateContextProperty]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov eax, dword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret

Function at 0x140017980
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub rsp, 0x238
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov edx, 0x38
lea ecx, [rdx - 0x37]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [0x14037b108], rax
test rax, rax
je 0x140017ac3
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
je 0x140017ac1
mov rcx, qword [0x14037b108]
lea rdx, [rsp + 0x20]
call fcn.140017900
test eax, eax
jne 0x140017ac1
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140017ac1
mov rcx, qword [0x14037b108]
lea rdx, [rsp + 0x20]
call fcn.140017900
test eax, eax
jne 0x140017ac1
mov rcx, qword [0x14037b108]
lea rdx, [0x1400721ac]
call fcn.140017900
test eax, eax
jne 0x140017ac1
mov r8d, 0x200
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140017a6b
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov rcx, qword [0x14037b108]
lea rdx, [rsp + 0x20]
call fcn.140017900
test eax, eax
jne 0x140017ac1
lea rcx, str.MARIADB_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140017a8f
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140017aa2
mov rcx, qword [0x14037b108]
mov rdx, rax
call fcn.140017900
test eax, eax
jne 0x140017ac1
mov rax, qword [0x14037b108]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x238
ret
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400623a0
add rsp, 0x238
ret
Function at 0x140018c30
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rcx + 0x40]
mov rsi, rdx
lea rdx, [rsp + 0x38]
mov ebp, r9d
mov edi, r8d
mov rbx, rcx
mov r10, qword [rax + 0x440]
mov r14, qword [r10 + 0x28]
call fcn.140016b50
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140016980
mov dword [r14], 0
mov r8d, edi
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x140018d46
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140018d42
mov eax, dword [r14]
or eax, 6
mov dword [r14], eax
test ebp, ebp
js 0x140018cbe
or eax, 8
mov dword [r14], eax
jmp 0x140018cc0
xor ebp, ebp
mov dword [r14 + 0x10], ebp
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x140018cd5
mov rdx, qword [r14 + 0x28]
mov cl, 1
call rax
lea rcx, [r14 + 0x30]
call fcn.140015e10
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x140018cef
mov rdx, qword [r14 + 0x28]
xor ecx, ecx
call rax
test byte [r14 + 4], 8
jne 0x140018d3b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x30], 4
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140018d3b
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140018d46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rsp + 0x60]
mov dword [rax], ecx
mov eax, 0xffffffff
jmp 0x140018d46
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
mov rax, qword [rax + 0x440]
test rax, rax
je 0x14001c166
mov rax, qword [rax + 0x28]
test rax, rax
je 0x14001c166
cmp byte [rax + 0x14], 0
je 0x14001c166
xor r8d, r8d
mov qword [rax + 0x18], rcx
xor edx, edx
call fcn.14001b7b0
mov r9d, dword [rbx + 0x24]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140018c30
mov r8, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14001c180
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x14001c213
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001c213
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov r14d, dword [rcx + 0x24]
xor edx, edx
call fcn.14001b7b0
mov rcx, qword [rdi]
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_connect]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001c20f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14001c20f
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call fcn.14001b5e0
test eax, eax
jns 0x14001c20d
mov eax, edi
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor edi, edi
mov eax, edi
jmp 0x14001c1f3
mov eax, 1
jmp 0x14001c1f8
Function at 0x14001b5e0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x480
mov rax, qword [0x14037ac60]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r9d, r9d
mov edi, r8d
mov qword [rsp + 0x38], r9
movzx ebp, dl
test rcx, rcx
je 0x14001b78a
mov rbx, qword [rcx]
test rbx, rbx
je 0x14001b78a
mov rax, qword [rcx + 0x40]
mov r8, qword [rax + 0x440]
test r8, r8
je 0x14001b665
mov rsi, qword [r8 + 0x140]
test rsi, rsi
je 0x14001b665
lea rdx, [rsp + 0x40]
call fcn.14001be80
test al, al
jne 0x14001b78a
mov rcx, qword [rsp + 0x40]
mov r8d, edi
movzx edx, bpl
call rsi
jmp 0x14001b78c
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
mov rax, qword [rbx]
mov qword [rsp + 0x268], rax
mov dword [rsp + 0x260], 1
test edi, edi
js 0x14001b6b1
mov eax, 0x10624dd3
mov ecx, edi
mul edi
shr edx, 6
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x3c], eax
test edi, edi
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x50]
cmovs rax, r9
lea rdx, [rsp + 0x50]
test bpl, bpl
mov qword [rsp + 0x20], rax
cmovne r8, r9
cmove rdx, r9
lea r9, [rsp + 0x260]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001b705
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rbx], eax
mov eax, edi
jmp 0x14001b78c
test eax, eax
jne 0x14001b727
mov ecx, 0x274c
lea edi, [rax - 1]
call qword [sym.imp.WS2_32.dll_WSASetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x8a
mov eax, edi
jmp 0x14001b78c
mov rcx, qword [rbx]
lea rdx, [rsp + 0x260]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x14001b786
mov rcx, qword [rbx]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x40], 4
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x14001b781
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSASetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rsp + 0x30]
mov dword [rax], ecx
mov edi, 0xffffffff
mov eax, edi
jmp 0x14001b78c
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400623a0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001b7b0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14001b837
mov rbx, qword [rcx]
test rbx, rbx
je 0x14001b837
movzx eax, byte [rbx + 8]
not al
and al, 1
test r8, r8
je 0x14001b7d3
mov byte [r8], al
cmp al, dl
jne 0x14001b7df
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov edi, dword [rbx + 8]
mov eax, edi
or eax, 1
and edi, 0xfffffffe
test dl, dl
cmove edi, eax
xor eax, eax
test dl, dl
mov edx, 0x8004667e
sete al
mov dword [rsp + 0x30], eax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14001b827
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 8], edi
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14001c060
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
call qword [sym.imp.WS2_32.dll_recv]
cdqe
add rsp, 0x28
ret

Function at 0x14001c080
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
call qword [sym.imp.WS2_32.dll_send]
cdqe
add rsp, 0x28
ret

Function at 0x14001c0a0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
xor r8d, r8d
test rcx, rcx
je 0x14001c0f8
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001c0f8
sub edx, 1
je 0x14001c0cb
cmp edx, 1
jne 0x14001c0ef
mov r8d, 0x1005
jmp 0x14001c0d1
mov r8d, 0x1006
mov rcx, qword [rcx]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
movzx eax, r8b
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret