joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180035250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x180035281
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180034880
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x1800352dc
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x180035289
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x1800352f8
lea rcx, str.zlib_corrupt
call fcn.180028010
jmp 0x18003543c
cmp dword [rsp + 0x20], 4
jge 0x18003531e
mov rcx, qword [rsp + 0x50]
call fcn.180034770
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1800352f8
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x18003538e
lea rcx, [0x1800c2f78]
call fcn.180028010
jmp 0x18003543c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x1800353b7
lea rcx, str.read_past_buffer
call fcn.180028010
jmp 0x18003543c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x1800353f0
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.180034b10
test eax, eax
jne 0x1800353f0
xor eax, eax
jmp 0x18003543c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x180046af0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800c63c0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x180046b7e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x180046b22
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x180046b90
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800c63c0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x180046c94
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x180046c8f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x180046c64
cmp qword [rsp + 0x38], 2
jb 0x180046c64
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180046c64
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180046c64
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180046bd7
jmp 0x180046d26
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x180046d26
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x180046cfc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180046cfc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x180046cfc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x180046c94
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x18008ffc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1800e4020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [0x180cc3a38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x1988]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x1990]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
call fcn.18000dc40
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
cmp qword [rsp + 0x30], rax
jae 0x18009010f
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1800900d1
movss xmm1, dword [rsp + 0x20]
movss xmm0, dword [rsp + 0x60]
call fcn.1800674f0
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x1800900cf
jmp 0x18009010f
jmp 0x180090053
cmp dword [rsp + 0x28], 0xd
jne 0x1800900dd
jmp 0x180090053
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1800882a0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x180090053
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rsp + 0x60]
jbe 0x180090128
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x60], xmm0
cmp qword [rsp + 0xa0], 0
je 0x180090160
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000dc40
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1800ddecc]
ja 0x180090180
movss xmm0, dword [rsp + 0x64]
ucomiss xmm0, dword [0x1800ddecc]
jp 0x180090192
jne 0x180090192
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
cmp qword [rsp + 0x98], 0
je 0x1800901ad
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800bdf40
add rsp, 0x78
ret
Function at 0x1800afea0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [0x180cc3ef0]
call fcn.180002e20
mov qword [rsp + 0x30], rax
mov rcx, qword [0x180cc3ef0]
call fcn.180002e20
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x1800afefc
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rcx, qword [0x180cc3ef0]
call fcn.180002e20
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x1800aff9c
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
call fcn.18000aa70
mov rcx, qword [rsp + 0x40]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x1800aff5e
inc rcx
test dl, dl
jne 0x1800aff4b
xor eax, eax
jmp 0x1800aff63
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800aff97
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [0x180cc3ef0]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov al, 1
jmp 0x1800aff9e
jmp 0x1800afef2
xor al, al
add rsp, 0x58
ret

Function at 0x1800ba880
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800e4020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180002fd0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180002e60
lea rcx, [rsp + 0x30]
call fcn.180002ed0
movzx eax, al
test eax, eax
je 0x1800ba917
lea rcx, [rsp + 0x30]
call fcn.180002f10
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1800ba917
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002f30
mov rcx, rax
call fcn.180003a20
cmp eax, 0x2fa62ca8
jne 0x1800ba915
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002f70
jmp 0x1800ba92e
jmp 0x1800ba8cf
lea rcx, [rsp + 0x28]
call fcn.180002ff0
movzx eax, al
test eax, eax
jne 0x1800ba89d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800bdf40
add rsp, 0x58
ret

Function at 0x1800bdf20
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x50
syscall
ret
Function at 0x180db30a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdx
push r13
rdtsc
mov r11b, 0x88
cbw
push r9
push rbx
cbw
cmovb rbx, rbp
push rcx
lahf
push rbp
mov r11b, 0x3b
movsx eax, r15w
movzx edi, r12w
push r10
movzx bx, bpl
movsx ebp, sp
push r15
movsx ebp, ax
bswap rdi
pushfq
shl dil, cl
rdtsc
not r11w
movabs rdx, 0
movzx r9w, sil
push rdx
or dil, r9b
mov ebx, dword [rsp + 0x90]
and di, 0x1fab
adc bpl, al
sar r10w, cl
neg ebx
sbb dil, cl
rol bpl, cl
movsx di, r12b
add ebx, 0xef1fec80
ror ebx, 2
not ebx
inc ebx
bsr eax, edi
sar r11b, 0x17
mov r11d, eax
not ebx
add ebx, 0x1412b70b
add rdi, r8
add rbx, rdx
bsf r11w, r14w
xchg al, dil
movabs r10, 0x100000000
lea rbx, [rbx + r10]
mov r9, rsp
xor r10w, 0xb52d
movsx eax, dx
cbw
lea rdi, [r9 - 0x200]
btr bp, r15w
and rdi, 0xfffffffffffffff0
xadd rax, r11
mov rsp, rdi
shr r11b, 0x19
test r13w, cx
mov r11, rbx
xor r10w, dx
movabs rax, 0
movsx r10, r10w
sar r10b, cl
sub r11, rax
shl r10b, 0x9f
lea rbp, [0x180d2f999]
sbb r10w, 0xb18b
shl r10b, 0x15
mov r10d, dword [rbx]
add rbx, 4
test ah, 0x93
xor r10d, r11d
dec r10d
clc
bswap r10d
stc
clc
rol r10d, 2
inc r10d
clc
stc
ror r10d, 1
push r11
rol r11b, 0x86
btr r11w, 0xb3
mov r11w, 0x69b6
xor dword [rsp], r10d
pop r11
clc
stc
jmp 0x180e2b3b7
push r8
jmp 0x180d2f89f
jmp rbp
push rax
movsx eax, r8w
mov eax, 0xb11e760b
movzx ax, r13b
push rsi
movsxd rax, ecx
cmovge ax, ax
movzx eax, r9w
push rdi
cmovns edi, ebx
movzx ax, bpl
push r14
jmp 0x180e1f468
push r11
movzx di, r9b
mov eax, ebx
push r12
jmp 0x180d5f5f2
movsxd r10, r10d
add rbp, r10
jmp 0x180d83358
Function at 0x14001b950
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140065040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140066f38], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x14001b9c9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140031000
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.14001b7f0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140031000
add rsp, 0x40
pop rbx
ret
Function at 0x14001d1d0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140065040]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14001d3cb
mov qword [rsp + 0xe0], rbx
test r8b, r8b
je 0x14001d250
movzx eax, byte [rdx]
test al, 8
je 0x14001d250
or al, 8
mov dword [rbp + 0xf], r12d
mov byte [rdx], al
lea r9, [rbp + 0xf]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x21]
setne dl
call fcn.14001d110
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14001d110
test ebx, ebx
je 0x14001d3c7
mov qword [rsp + 0x98], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x140065120]
add rcx, rsi
mov qword [rsp + 0x90], r13
mov dword [rbp - 0x35], r12d
lea r13, [0x140065118]
cmp rcx, 1
jbe 0x14001d2c0
mov rax, qword [0x140065118]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov rsi, qword [0x140065120]
jmp 0x14001d2c2
mov al, 1
movzx eax, al
lea rdx, [rbp - 9]
add rax, 2
mov dword [rbp - 0x39], 0x2733
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp + 7], xmm1
movups xmmword [rbp - 9], xmm0
call fcn.14001a970
test al, al
jne 0x14001d35f
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x35], r12d
add rax, rsi
cmp rax, 1
jbe 0x14001d325
mov rax, qword [0x140065118]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x14001d327
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x21]
add rax, 2
mov dword [rbp - 0x39], 0x4d5
mov qword [rbp - 0x29], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x29]
mov qword [rbp - 0x31], r13
movups xmm0, xmmword [rbp - 0x39]
movsd qword [rbp - 0x11], xmm1
movups xmmword [rbp - 0x21], xmm0
call fcn.14001a970
test al, al
je 0x14001d391
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14001d110
mov rsi, qword [rsp + 0x98]
mov eax, ebx
mov r13, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140031000
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x14001d3a3
mov eax, r12d
jmp 0x14001d3ab
Function at 0x14001d700
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140065040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x140065120]
lea r14, [0x140065118]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x14001d788
mov rcx, qword [0x140065118]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x14001d78d
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14001d7cb
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14001d7fb
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14001d83a
mov rcx, qword [0x140065120]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14001d82f
mov rax, qword [0x140065118]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x14001d8a7
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x14001d8a7
cmp r9, 1
jne 0x14001d86d
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14001d8c7
mov rcx, qword [0x140065120]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14001d89e
mov rax, qword [0x140065118]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14001d8a0
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14001d8d2
mov eax, 0xffffffff
jmp 0x14001d8e9
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031000
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001db60
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140065040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9, qword [rbp + 0x60]
xor r15d, r15d
mov eax, dword [rbp + 0x68]
mov rbx, qword [rbp + 0x70]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r9
lea r9, [rbp - 0x18]
mov dword [rbp - 0x18], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x140065120]
lea r14, [0x140065118]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x14001dbfb
mov rcx, qword [0x140065118]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x14001dc00
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14001dc3e
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14001dc6e
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x14001dcad
mov rcx, qword [0x140065120]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14001dca2
mov rax, qword [0x140065118]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x14001dd1a
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x14001dd1a
cmp r9, 1
jne 0x14001dce0
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14001dd3a
mov rcx, qword [0x140065120]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x14001dd11
mov rax, qword [0x140065118]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14001dd13
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14001dd45
mov eax, 0xffffffff
jmp 0x14001dd5c
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031000
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001dfd0
Capabilities:
Get socket status

Disassembly:
push rbx
push rdi
sub rsp, 0x278
mov rax, qword [0x140065040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
mov rbx, r9
cmp rcx, 0xffffffffffffffff
jne 0x14001e068
mov rcx, qword [0x140065120]
movabs rdx, 0x4d54ee85da812030
add rcx, rdx
mov dword [rsp + 0x34], edi
lea rdi, [0x140065118]
cmp rcx, 1
jbe 0x14001e030
mov rax, qword [0x140065118]
mov edx, 0x2719
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x14001e032
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x30], 0x2719
mov qword [rsp + 0x40], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], rdi
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x14001e138
mov qword [rsp + 0x58], rcx
lea r8, [rsp + 0x50]
inc ecx
mov qword [rsp + 0x298], rbp
xor r9d, r9d
mov dword [rsp + 0x50], 1
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_select]
mov ebp, eax
test eax, eax
js 0x14001e0b2
xorps xmm0, xmm0
mov qword [rsp + 0x40], rdi
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rbx + 0x10], xmm0
jmp 0x14001e12e
mov qword [rsp + 0x270], rsi
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movabs rdx, 0x4d54ee85da812030
mov dword [rsp + 0x34], edi
add rdx, qword [0x140065120]
lea rdi, [0x140065118]
mov esi, eax
cmp rdx, 1
jbe 0x14001e0f9
mov rcx, qword [0x140065118]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, rdi
call r8
jmp 0x14001e0fe
test esi, esi
setne al
mov dword [rsp + 0x30], esi
mov rsi, qword [rsp + 0x270]
movzx eax, al
mov qword [rsp + 0x38], rdi
add rax, 2
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov eax, ebp
mov rbp, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140031000
add rsp, 0x278
pop rdi
pop rbx
ret