joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d8d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x14009da2e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x14009da2e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x14009dabc
movd xmm0, r9d
mov rdx, rax
lea rcx, [rax + rsi]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x14009d9a0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x14009d9b0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x14009d9a0
test ebp, ebp
je 0x14009da9e
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x14009d9f4
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x14009da0e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x14009da0e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x14009da0e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x14009d960
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x14009da8d
test edx, edx
je 0x14009da8d
lea rbp, [rax*8]
lea rdi, [rdx*4]
xor esi, esi
nop dword [rax]
mov rdx, qword [r10 + rsi]
mov r8, qword [r9 + rsi]
xor ecx, ecx
lea rbx, [rdx + rdi]
nop
movsx eax, word [rdx]
movsx r11d, word [rdx + 2]
add r8, 2
add rdx, 4
add eax, r11d
add eax, ecx
xor ecx, 1
sar eax, 1
mov word [r8 - 2], ax
cmp rdx, rbx
jne 0x14009da60
add rsi, 8
cmp rbp, rsi
jne 0x14009da50
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x14009da1b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x14009d975
mov r10d, ebx
xor edx, edx
jmp 0x14009d9c2
Function at 0x14009dad0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x14009dc2e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x14009dc2e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x14009dccc
movd xmm0, r9d
mov rdx, rax
lea rcx, [rsi + rax]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x14009dba0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x14009dbb0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x14009dba0
test ebp, ebp
je 0x14009dcae
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x14009dbf4
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x14009dc0e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x14009dc0e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x14009dc0e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x14009db60
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x14009dc9d
test edx, edx
je 0x14009dc9d
lea rdi, [rax + rax]
lea rsi, [rdx + rdx]
xor ebp, ebp
nop dword [rax]
mov rbx, qword [r9 + rbp*4]
mov r11, qword [r10 + rbp*8]
xor edx, edx
mov ecx, 1
mov r8, qword [r10 + rbp*8 + 8]
nop dword [rax]
movsx r12d, word [r11 + rdx*2 + 2]
movsx eax, word [r11 + rdx*2]
add eax, r12d
movsx r12d, word [r8 + rdx*2]
add eax, r12d
movsx r12d, word [r8 + rdx*2 + 2]
add eax, r12d
add eax, ecx
xor ecx, 3
sar eax, 2
mov word [rbx + rdx], ax
add rdx, 2
cmp rdx, rsi
jne 0x14009dc60
add rbp, 2
cmp rbp, rdi
jne 0x14009dc48
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x14009dc1b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x14009db75
mov r10d, ebx
xor edx, edx
jmp 0x14009dbc2
Function at 0x1400a77d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x1400a792e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x1400a792e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x1400a79bc
movd xmm0, r9d
mov rdx, rax
lea rcx, [rax + rsi]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x1400a78a0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x1400a78b0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x1400a78a0
test ebp, ebp
je 0x1400a799e
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x1400a78f4
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x1400a790e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x1400a790e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x1400a790e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x1400a7860
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x1400a798d
test edx, edx
je 0x1400a798d
lea rbp, [rax*8]
lea rdi, [rdx*4]
xor esi, esi
nop dword [rax]
mov rdx, qword [r10 + rsi]
mov r8, qword [r9 + rsi]
xor ecx, ecx
lea rbx, [rdx + rdi]
nop
movzx eax, word [rdx]
movzx r11d, word [rdx + 2]
add r8, 2
add rdx, 4
add eax, r11d
add eax, ecx
xor ecx, 1
sar eax, 1
mov word [r8 - 2], ax
cmp rdx, rbx
jne 0x1400a7960
add rsi, 8
cmp rbp, rsi
jne 0x1400a7950
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x1400a791b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x1400a7875
mov r10d, ebx
xor edx, edx
jmp 0x1400a78c2
Function at 0x1400a79d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r11, rcx
mov rcx, rdx
mov r10, r8
mov rax, qword [r11 + 0x1a0]
mov edi, dword [r11 + 0x30]
cmp byte [rax + 0x1a], 1
sbb eax, eax
and eax, 7
add eax, 1
imul eax, dword [rdx + 0x1c]
mov edx, eax
lea ebx, [rdx + rdx]
sub ebx, edi
test ebx, ebx
jle 0x1400a7b2e
movsxd rax, dword [r11 + 0x12c]
test eax, eax
jle 0x1400a7b2e
lea r14, [r8 + rax*8]
mov eax, ebx
mov esi, ebx
mov dword [rsp + 0xc], edx
and eax, 0xfffffff8
mov qword [rsp + 0x68], rcx
shr esi, 3
mov ebp, ebx
mov dword [rsp + 8], eax
lea r13, [rdi + rdi]
shl rsi, 4
lea r15, [rax + rax]
mov qword [rsp + 0x70], r8
and ebp, 7
mov qword [rsp + 0x78], r9
nop dword [rax + rax]
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
cmp ebx, 7
jle 0x1400a7bcc
movd xmm0, r9d
mov rdx, rax
lea rcx, [rsi + rax]
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmm1, xmm0
test sil, 0x10
je 0x1400a7aa0
lea rdx, [rax + 0x10]
movups xmmword [rax], xmm0
cmp rcx, rdx
je 0x1400a7ab0
movups xmmword [rdx], xmm1
add rdx, 0x20
movups xmmword [rdx - 0x10], xmm1
cmp rcx, rdx
jne 0x1400a7aa0
test ebp, ebp
je 0x1400a7bae
mov edx, dword [rsp + 8]
add rax, r15
mov r10d, ebp
mov ecx, ebx
sub ecx, edx
lea r12d, [rcx - 1]
cmp r12d, 2
jbe 0x1400a7af4
movd xmm3, r9d
add rdx, rdi
pshuflw xmm2, xmm3, 0
movq qword [r11 + rdx*2], xmm2
test cl, 3
je 0x1400a7b0e
and ecx, 0xfffffffc
mov edx, ecx
sub r10d, ecx
lea rax, [rax + rdx*2]
mov word [rax], r9w
cmp r10d, 1
je 0x1400a7b0e
mov word [rax + 2], r9w
cmp r10d, 2
je 0x1400a7b0e
mov word [rax + 4], r9w
add r8, 8
cmp r8, r14
jne 0x1400a7a60
mov edx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
movsxd rax, dword [rcx + 0xc]
test eax, eax
jle 0x1400a7b9d
test edx, edx
je 0x1400a7b9d
lea rdi, [rax + rax]
lea rsi, [rdx + rdx]
xor ebp, ebp
nop dword [rax]
mov rbx, qword [r9 + rbp*4]
mov r11, qword [r10 + rbp*8]
xor edx, edx
mov ecx, 1
mov r8, qword [r10 + rbp*8 + 8]
nop dword [rax]
movzx r12d, word [r11 + rdx*2 + 2]
movzx eax, word [r11 + rdx*2]
add eax, r12d
movzx r12d, word [r8 + rdx*2]
add eax, r12d
movzx r12d, word [r8 + rdx*2 + 2]
add eax, r12d
add eax, ecx
xor ecx, 3
sar eax, 2
mov word [rbx + rdx], ax
add rdx, 2
cmp rdx, rsi
jne 0x1400a7b60
add rbp, 2
cmp rbp, rdi
jne 0x1400a7b48
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add r8, 8
cmp r8, r14
je 0x1400a7b1b
mov r11, qword [r8]
lea rax, [r11 + r13]
movzx r9d, word [rax - 2]
jmp 0x1400a7a75
mov r10d, ebx
xor edx, edx
jmp 0x1400a7ac2
Function at 0x1400ae010
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x30]
mov rdi, rdx
mov rdx, qword [rcx + 0x1a0]
mov rbx, r8
mov rsi, r9
cmp byte [rdx + 0x1a], 1
sbb r12d, r12d
and r12d, 7
add r12d, 1
imul r12d, dword [rdi + 0x1c]
lea r13d, [r12 + r12]
sub r13d, r14d
test r13d, r13d
jle 0x1400ae08c
movsxd rax, dword [rcx + 0x12c]
test eax, eax
jle 0x1400ae08c
mov rbp, r8
lea r15, [r8 + rax*8]
movsxd r13, r13d
nop dword [rax]
mov rcx, qword [rbp]
mov r8, r13
add rbp, 8
add rcx, r14
movzx edx, byte [rcx - 1]
call sym.memset
cmp rbp, r15
jne 0x1400ae070
mov eax, dword [rdi + 0xc]
test eax, eax
jle 0x1400ae0ed
test r12d, r12d
je 0x1400ae0ed
mov ebp, r12d
xor r11d, r11d
add rbp, rbp
nop dword [rax]
mov rdx, qword [rbx + r11*8]
mov r8, qword [rsi + r11*8]
xor ecx, ecx
lea r10, [rdx + rbp]
nop word cs:[rax + rax]
movzx eax, byte [rdx]
movzx r9d, byte [rdx + 1]
add r8, 1
add rdx, 2
add eax, r9d
add eax, ecx
xor ecx, 1
sar eax, 1
mov byte [r8 - 1], al
cmp rdx, r10
jne 0x1400ae0c0
add r11, 1
cmp dword [rdi + 0xc], r11d
jg 0x1400ae0a8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400ae100
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r14d, dword [rcx + 0x30]
mov rsi, rdx
mov rdx, qword [rcx + 0x1a0]
mov rdi, r8
mov rbx, r9
cmp byte [rdx + 0x1a], 1
sbb r11d, r11d
and r11d, 7
add r11d, 1
imul r11d, dword [rsi + 0x1c]
lea r12d, [r11 + r11]
mov r13d, r11d
sub r12d, r14d
test r12d, r12d
jle 0x1400ae17c
movsxd rax, dword [rcx + 0x12c]
test eax, eax
jle 0x1400ae17c
mov rbp, r8
lea r15, [r8 + rax*8]
movsxd r12, r12d
nop dword [rax]
mov rcx, qword [rbp]
mov r8, r12
add rbp, 8
add rcx, r14
movzx edx, byte [rcx - 1]
call sym.memset
cmp rbp, r15
jne 0x1400ae160
mov eax, dword [rsi + 0xc]
test eax, eax
jle 0x1400ae1e9
test r13d, r13d
je 0x1400ae1e9
xor ebp, ebp
mov r11d, r13d
nop dword [rax]
mov r8, qword [rbx + rbp*8]
mov r10, qword [rdi]
xor edx, edx
mov ecx, 1
mov r9, qword [rdi + 8]
nop word [rax + rax]
movzx r12d, byte [r10 + rdx*2 + 1]
movzx eax, byte [r10 + rdx*2]
add eax, r12d
movzx r12d, byte [r9 + rdx*2]
add eax, r12d
movzx r12d, byte [r9 + rdx*2 + 1]
add eax, r12d
add eax, ecx
xor ecx, 3
sar eax, 2
mov byte [r8 + rdx], al
add rdx, 1
cmp rdx, r11
jne 0x1400ae1a8
add rbp, 1
add rdi, 0x10
cmp dword [rsi + 0xc], ebp
jg 0x1400ae190
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cf000
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 0x8004667e
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x38
ret

Function at 0x1400cf0d0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call sym.SocketBuffer_initialize
call sym.ListInitialize
mov qword [0x140147400], rax
call sym.ListInitialize
pxor xmm0, xmm0
mov dword [0x140147410], 0
mov qword [0x140147408], rax
mov eax, 0xffffffff
mov qword [0x140147428], rax
movups xmmword [0x140147418], xmm0
movaps xmmword [0x140147430], xmm0
add rsp, 0x1c8
ret

Function at 0x1400cf1c0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14012a350]
mov rbx, rcx
mov rcx, qword [rsi]
call sym.Paho_thread_lock_mutex
mov eax, dword [0x140147410]
mov rcx, qword [0x140147418]
lea edx, [rax + 1]
mov dword [0x140147410], edx
test rcx, rcx
je 0x1400cf2e0
shl rdx, 4
call sym.realloc
mov qword [0x140147418], rax
test rax, rax
je 0x1400cf300
mov edx, dword [0x140147410]
mov rcx, qword [0x140147420]
shl rdx, 4
test rcx, rcx
je 0x1400cf2f0
call sym.realloc
mov qword [0x140147420], rax
test rax, rax
je 0x1400cf300
mov edx, dword [0x140147410]
mov r10, qword [0x140147418]
lea r9, [sym.cmpfds]
lea ecx, [rdx - 1]
shl rcx, 4
lea r8, [r10 + rcx]
add rax, rcx
mov ecx, 0x300
mov qword [r8], rbx
mov qword [rax], rbx
mov word [r8 + 8], cx
mov r8d, 0x10
mov rcx, r10
mov word [rax + 8], r8w
mov r8d, 0x10
call sym.qsort
mov edx, dword [0x140147410]
mov rcx, qword [0x140147420]
lea r9, [sym.cmpfds]
mov r8d, 0x10
call sym.qsort
mov rcx, rbx
lea r8, [rsp + 0x2c]
mov dword [rsp + 0x2c], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400cf307
mov rcx, qword [rsi]
call sym.Paho_thread_unlock_mutex
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
mov ecx, edx
shl rcx, 4
call sym.malloc
jmp 0x1400cf200
mov rcx, rdx
call sym.malloc
jmp 0x1400cf22f
mov ebx, 0xffffff9d
jmp 0x1400cf2cb
lea r8, str.addSocket:_setnonblocking
mov edx, 0xffffffff
mov ecx, 5
call sym.Log
jmp 0x1400cf2cb
Function at 0x1400cf3f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
call sym.SocketBuffer_getQueuedChar
mov ebx, eax
cmp eax, 0xffffffea
je 0x1400cf418
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
xor r9d, r9d
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400cf450
test eax, eax
je 0x1400cf4a2
mov ebx, eax
cmp eax, 1
jne 0x1400cf409
movsx edx, byte [rdi]
mov rcx, rsi
xor ebx, ebx
call sym.SocketBuffer_queueChar
jmp 0x1400cf409
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2714
je 0x1400cf4b0
cmp eax, 0x2733
je 0x1400cf4c0
cmp eax, 0x2734
je 0x1400cf4a2
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x30], rsi
mov edx, 0xffffffff
lea r8, str.Socket_error__s__d__in__s_for_socket__d
mov r9, rax
lea rax, str.recv___getch
mov dword [rsp + 0x20], edi
mov ecx, 3
mov qword [rsp + 0x28], rax
call sym.Log
mov ebx, 0xffffffff
jmp 0x1400cf409
cmp eax, 0x2733
jne 0x1400cf4a2
nop word [rax + rax]
xor edx, edx
mov rcx, rsi
call sym.SocketBuffer_interrupted
jmp 0x1400cf409

Function at 0x1400cf4d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov r12, r9
test rdx, rdx
je 0x1400cf570
call sym.SocketBuffer_getQueuedData
mov r8d, ebx
xor r9d, r9d
mov rcx, rdi
mov rbp, rax
mov rax, qword [rsi]
lea rdx, [rbp + rax]
sub r8d, eax
call qword [sym.imp.WS2_32.dll_recv]
mov dword [r12], eax
cmp eax, 0xffffffff
je 0x1400cf5a0
test eax, eax
je 0x1400cf5f8
movsxd rdx, eax
add rdx, qword [rsi]
mov qword [rsi], rdx
mov rcx, rdi
cmp rdx, rbx
je 0x1400cf588
call sym.SocketBuffer_interrupted
mov rax, qword [rsi]
mov r9d, ebx
mov edx, 0xffffffff
lea r8, str._d_bytes_expected_but__d_bytes_now_received
mov ecx, 1
mov dword [rsp + 0x20], eax
call sym.Log
mov rax, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.SocketBuffer_complete
call sym.SocketBuffer_complete
mov rax, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r13d, eax
cmp eax, 0x2714
je 0x1400cf600
cmp eax, 0x2733
je 0x1400cf600
cmp eax, 0x2734
je 0x1400cf618
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x30], rdi
mov edx, 0xffffffff
lea r8, str.Socket_error__s__d__in__s_for_socket__d
mov r9, rax
lea rax, str.recv___getdata
mov dword [rsp + 0x20], r13d
mov ecx, 3
mov qword [rsp + 0x28], rax
call sym.Log
mov dword [r12], r13d
xor ebp, ebp
jmp 0x1400cf55e
mov dword [r12], r13d
cmp r13d, 0x2733
jne 0x1400cf5f8
mov rdx, qword [rsi]
jmp 0x1400cf531
mov dword [r12], 0x2734
xor ebp, ebp
jmp 0x1400cf55e
Function at 0x1400cf660
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov dword [r9], 0
mov rsi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
cmp eax, 0xffffffff
je 0x1400cf6a8
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2714
je 0x1400cf700
cmp eax, 0x2733
je 0x1400cf700
cmp eax, 0x2734
je 0x1400cf698
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x30], rsi
mov edx, 0xffffffff
lea r8, str.Socket_error__s__d__in__s_for_socket__d
mov r9, rax
lea rax, str.WSASend___putdatas
mov dword [rsp + 0x20], edi
mov ecx, 3
mov qword [rsp + 0x28], rax
call sym.Log
jmp 0x1400cf698
cmp edi, 0x2733
mov eax, 0xffffffea
cmove ebx, eax
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400d1980
Capabilities:
Move file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rcx, qword [0x140147728]
mov rbx, rdx
test rcx, rcx
je 0x1400d19dd
mov r8, rdx
lea rdx, [0x140123f70]
call sym.fprintf.constprop.0_1
mov ecx, 1
mov rdi, qword [dbg.__acrt_iob_func]
call rdi
mov rcx, qword [0x140147728]
cmp rcx, rax
je 0x1400d19d8
mov eax, dword [0x140147710]
add eax, 1
cmp eax, dword [0x1400fc964]
mov dword [0x140147710], eax
jge 0x1400d1a10
call sym.fflush
mov rax, qword [0x140147708]
test rax, rax
je 0x1400d1a00
mov rdx, rbx
mov ecx, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sym.fclose
mov rcx, qword [0x140147718]
call qword [sym.imp.msvcrt.dll__unlink]
mov rdx, qword [0x140147718]
mov rcx, qword [0x140147720]
call sym.rename
mov rcx, qword [0x140147720]
lea rdx, [0x140123f74]
call sym.fopen
mov qword [0x140147728], rax
test rax, rax
je 0x1400d1a68
mov dword [0x140147710], 0
jmp 0x1400d19dd
mov ecx, 1
call rdi
mov qword [0x140147728], rax
jmp 0x1400d1a54

Function at 0x1400d1a80
Capabilities:
Move file

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov eax, dword [0x1400fc960]
mov esi, ecx
mov rbx, rdx
cmp eax, 0xffffffff
je 0x1400d1b90
cmp eax, ecx
jg 0x1400d1b9c
mov rdx, qword [0x140147728]
test rdx, rdx
je 0x1400d1ba8
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__localtime64]
lea r8, str._Y_m_d__H_M_S
mov edx, 0x50
lea rcx, [0x140147507]
mov r9, rax
call sym.strftime
movzx r9d, word [rbx + 8]
mov edx, 0x1ea
mov rdi, qword [sym.imp.msvcrt.dll__snprintf]
lea r8, str.._.3hu
lea rcx, [0x140147516]
call rdi
mov r9d, dword [rbx + 0x10]
lea r8, str.__.4d_
mov edx, 0x200
lea rcx, [0x140147500]
call rdi
cmp dword [rbx + 0x128], 2
mov byte [0x140147506], 0x20
je 0x1400d1c10
mov edx, dword [rbx + 0x130]
mov ecx, dword [rbx + 0x14]
call sym.Messages_get
cmp dword [rbx + 0x128], 1
mov r8, rax
mov eax, dword [rbx + 0x1c]
je 0x1400d1bc0
mov edx, dword [rbx + 0x124]
lea rcx, [0x14014751b]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], edx
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x38], rdx
lea rdx, [0x140123f94]
mov qword [rsp + 0x28], rdx
mov edx, 0x1e5
mov r9d, dword [rbx + 0x18]
call rdi
lea rdx, [0x140147507]
mov ecx, esi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
jmp fcn.1400d1980
cmp dword [0x1400fc970], ecx
jle 0x1400d1aa3
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp qword [0x140147708], 0
jne 0x1400d1ab3
jmp 0x1400d1b82
mov edx, dword [rbx + 0x12c]
lea rcx, [0x14014751b]
mov dword [rsp + 0x48], edx
mov edx, dword [rbx + 0x124]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], edx
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x38], rdx
lea rdx, [0x140123f94]
mov qword [rsp + 0x28], rdx
mov edx, 0x1e5
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0x18]
call rdi
jmp 0x1400d1b7b
lea rdx, [rbx + 0x20]
mov r8d, 0x1e5
lea rcx, [0x14014751b]
call sym.strncpy
jmp 0x1400d1b7b