joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5bb0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400c5d58
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400c5c15
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400c5c15
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400c5c15
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400c5c4c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400c5ca2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400c5ca2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400c5ca2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400c5ca2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400c5ca2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400c5660
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400c5d04
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400a1bf0
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400c5a30
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400c5d50
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1400a1bf0
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c74c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400c7555
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400c75b6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400a1bf0
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400da5d0
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400c7671
sub ecx, 1
je 0x1400c76e4
sub ecx, 1
je 0x1400c7620
cmp ecx, 1
je 0x1400c7603
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1400f09d8]
call fcn.1400a1bf0
jmp 0x1400c76e4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400c71f0
test eax, eax
je 0x1400c76e4
jmp 0x1400c758a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400c76e4
sub rax, rsi
cmp rax, rbp
jae 0x1400c76e4
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400a1d70
jmp 0x1400c76e4
cmp r8d, 4
jle 0x1400c76e4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400c76e4
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400a1b10
mov esi, eax
test eax, eax
je 0x1400c76c3
mov edx, 5
mov rcx, rbx
call fcn.1400c81b0
mov eax, esi
jmp 0x1400c758a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400b05e0
mov rcx, r14
call fcn.1400b08c0
test eax, eax
je 0x1400c7588
mov edx, 5
mov rcx, rbx
call fcn.1400c81b0
mov eax, Ordinal_45
jmp 0x1400c758a
Function at 0x1400da480
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400da4c2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400da509
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400da562
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400da520
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400da5a3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400ef7c2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400ef7c3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400da570
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400db590
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400db5da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400db5da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400db5da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400db5da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400db5da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400db5dc
xor al, al
add rsp, 0x28
ret
Function at 0x1400db810
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400db84a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400db84f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400db898
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400db898
dec r8
sub rdx, 1
jne 0x1400db87e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x100075150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100080558], rdi
je 0x1000751b0
cmp rax, rdi
jne 0x1000751a3
mov r12d, 1
jmp 0x1000751b0
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x100075189
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x1000751c5
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10007522c
mov eax, dword [0x100080550]
cmp eax, ebx
jne 0x100075222
mov dword [0x100080550], 1
lea r13, [0x100001b48]
lea rdi, [0x100001b30]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x100075214
cmp eax, ebx
jne 0x100075214
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100075209
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000751f2
cmp eax, ebx
je 0x10007522c
mov eax, 0xff
jmp 0x100075374
mov dword [0x10007f924], 1
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x100075254
lea rdx, [0x100001b28]
lea rcx, [0x100001ab8]
call sub.msvcrt.dll__initterm
mov dword [0x100080550], 2
cmp r12d, ebx
jne 0x100075263
mov rax, rbx
xchg qword [0x100080558], rax
cmp qword [0x100080570], rbx
je 0x10007528b
lea rcx, [0x100080570]
call fcn.1000756ac
cmp eax, ebx
je 0x10007528b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100080570]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1000752a1
mov eax, 0xff
jmp 0x100075374
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x100075326
cmp word [rcx], bx
je 0x1000752bc
cmp edx, ebx
jne 0x100075326
cmp word [rcx], bx
je 0x1000752d2
cmp word [rcx], 0x20
ja 0x1000752d2
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752bc
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.1000337b8
mov dword [0x10007f920], eax
cmp dword [0x10007f904], ebx
jne 0x100075310
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007f924], ebx
jne 0x100075324
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10007f920]
jmp 0x100075374
cmp word [rcx], 0x22
jne 0x100075339
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752ad
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call 0x1001f9000
add rsp, 0x28
jmp 0x100075150
Function at 0x1800013b0
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp dword [0x180005678], 0
mov rbp, rdx
mov rsi, rcx
jne 0x18000150d
mov dword [0x180005678], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1000
mov r8d, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18000141a
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
je 0x180001504
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x180001504
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x180001462
cmp rcx, 1
jbe 0x180001504
lea r8, [rax + 1]
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea rdx, str.OneDriveUpdaterService.exe
lea rcx, [rsp + 0x150]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x18000150d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x180001390]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1800014f6
mov r9d, 0x40
lea r8, str.Error
lea rdx, str.Failed_to_create_thread.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x18000150d
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:WindowsSystem32_version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
jne 0x180001545
mov r9d, 0x40
lea r8, str.Info
lea rdx, str.Failed_to_load_the_DLL_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
jmp 0x1800015a3
lea rdx, [0x180003510]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180001583
mov r9d, 0x40
lea r8, str.Info
lea rdx, str.Failed_to_get_the_address_of_function_GetFileVersionInfoSizeW
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x1800015a3
mov rdx, rbp
mov rcx, rsi
call rax
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800015f0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x140359b8a
Capabilities:
Encode data using xor

Disassembly:
test dword [rbx], ebx
xchg esp, eax
out 0x71, eax
retf 0xe8f2
loop 0x140359ae8
or ch, al
outsb dx, byte [rsi]
invalid
jns 0x140359b3c
jle 0x140359bf4
mov esp, 0x48719648
invalid
outsb dx, byte [rsi]
invalid

Function at 0x1404594b2
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffe068a548
retf
add dword [rax + 0x49], ebp
movsd dword [rdi], dword [rsi]
movabs al, byte [0x6867676777374323]
in eax, dx
stosd dword [rdi], eax
xchg ebp, eax
cwde
cwde
push 0xffffffff9895a1e2
cwde
out 0x85, eax
push 0xdae3
xchg ebp, eax
cwde
cwde
mov fs, ecx
mov byte [rax - 0x7797fe68], bl
scasb al, byte [rdi]
add dword [rax + 0x49], ebp
cmpsb byte [rsi], byte [rdi]
push 0x66dea5fd
in al, dx
in al, dx
sbb eax, dword [rbx + 3]
push 0x2268b5d1
mov dh, 0xe4
movabs al, byte [0x6385a633431bee66]
out dx, al
xor eax, dword [rbx + 0x37]
mov gs, esp
xchg ebp, eax
cwde
cwde
in al, dx
and eax, dword [rbx + 0x3f]
loop 0x140459480
push 0xffffffff989fd4ef
cwde
in al, dx
or dh, byte [rbx - 0x60]
and eax, dword [rbx + 3]
loop 0x140459477
push 0xffffffff989423ee
cwde
mov cs, edi
lahf
cwde
cwde
sub ebp, edx
add byte [rsi + 0x2f], ah
out dx, al
mov byte [rbx], ch
out dx, al
mov ah, byte [rsi]
movabs eax, dword [0x909c8e81ee2a5e65]
cwde
cwde
movabs al, byte [0x8e67676767034323]
rcl dword [rax + rbx*4 - 0x58a9dd68], 0x2f
out dx, al
mov ds, ebp
insd dword [rdi], dx
invalid
Function at 0x14004bb40
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x68
mov r8d, 1
lea rax, [rsp + 0x4b]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x4b], 0
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
nop
add rsp, 0x68
ret

Function at 0x14004bba0
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rsi, rcx
mov rdi, rdx
mov rbx, r9
cmp rcx, 0xffffffffffffffff
je 0x14004bbef
test r8b, r8b
je 0x14004bbc9
movzx eax, byte [rdx]
test al, 8
jne 0x14004bca0
mov rbp, qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rsi
call rbp
test eax, eax
jne 0x14004bc00
mov dword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call fcn.14004b220
lea rdx, [0x14054d5e0]
mov rcx, rbx
mov dword [rsp + 0x60], 0x2733
mov qword [rsp + 0x68], rdx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], 3
call fcn.140477f40
test al, al
jne 0x14004bc57
lea r12, [rsp + 0x40]
mov edx, 0x4d5
mov rcx, r12
call fcn.140416590
mov rdx, r12
mov rcx, rbx
call fcn.140477f40
test al, al
je 0x14004bbef
mov rcx, rsi
lea r8, [rsp + 0x3c]
mov edx, 0x8004667e
mov dword [rsp + 0x3c], 0
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rdi], 0xfc
mov rcx, rsi
call rbp
test eax, eax
jne 0x14004bce8
xor ecx, ecx
xor r8d, r8d
mov dword [rbx], eax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], r8
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
or eax, 8
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
mov byte [rdx], al
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14004bbc9
lea rcx, [rsp + 0x60]
call fcn.14004b220
jmp 0x14004bbc9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 2
lea rcx, [0x14054d5e0]
cmp eax, 1
sbb r8, 0xffffffffffffffff
jmp 0x14004bc83

Function at 0x140055100
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
mov rbx, rcx
or r8d, edx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret
Function at 0x1400569c0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
mov rbx, rcx
or r8d, edx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret

Function at 0x1400582f0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
mov rbx, rcx
or r8d, edx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret
Function at 0x14005b3b0
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
cmp byte [rax + 0x20], 6
mov rbp, rcx
jne 0x14005b605
mov rbx, qword [rax + 8]
lea rsi, [rax + 8]
lea rdi, [0x140552bd0]
lea r12, [0x14054bb20]
lea r13, [0x140558b80]
jmp 0x14005b40a
cmp rbx, rdi
je 0x14005b440
mov rbx, qword [rsi]
cmp qword [rbx + 8], 0
jne 0x14005b5f8
add rbx, 0x10
mov qword [rsi], rbx
movzx edx, byte [0x14054bb20]
test dl, dl
jne 0x14005b3f0
mov rcx, r12
call fcn.14053f5e0
test eax, eax
je 0x14005b3f0
mov rcx, r12
mov qword [0x140552bc0], r13
mov qword [0x140552bc8], 2
call fcn.14053f720
cmp rbx, rdi
jne 0x14005b3f5
mov rdi, qword [rbp]
mov rcx, qword [rdi]
lea rdx, [rdi + 8]
lea rsi, [rcx + 0x60]
movzx ecx, byte [rdi + 0x20]
call fcn.140058700
mov qword [rdi + 8], rsi
mov byte [rdi + 0x20], 7
mov rsi, qword [rbp]
movzx ecx, byte [rsi + 0x20]
cmp cl, 7
jne 0x14005b605
mov r10, qword [rsi]
mov r9, qword [rsi + 8]
lea r8, [rsi + 8]
lea rbx, [r10 + 0x70]
cmp rbx, r9
je 0x14005b5d1
mov r11, rbx
sub r11, r9
sub r11, 0x10
shr r11, 4
add r11, 1
and r11d, 7
je 0x14005b550
cmp r11, 1
je 0x14005b539
cmp r11, 2
je 0x14005b527
cmp r11, 3
je 0x14005b515
cmp r11, 4
je 0x14005b503
cmp r11, 5
je 0x14005b4f1
cmp r11, 6
je 0x14005b4df
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp qword [r9 + 8], 0
jne 0x14005b5f8
add r9, 0x10
mov qword [r8], r9
cmp r9, rbx
je 0x14005b5cd
cmp qword [r9 + 8], 0
jne 0x14005b5f8
lea rax, [r9 + 0x10]
cmp qword [r9 + 0x18], 0
mov qword [r8], rax
jne 0x14005b5f8
lea r12, [r9 + 0x20]
cmp qword [r9 + 0x28], 0
mov qword [r8], r12
jne 0x14005b5f8
lea r13, [r9 + 0x30]
cmp qword [r9 + 0x38], 0
mov qword [r8], r13
jne 0x14005b5f8
lea rdx, [r9 + 0x40]
cmp qword [r9 + 0x48], 0
mov qword [r8], rdx
jne 0x14005b5f8
lea rdi, [r9 + 0x50]
cmp qword [r9 + 0x58], 0
mov qword [r8], rdi
jne 0x14005b5f8
lea rcx, [r9 + 0x60]
cmp qword [r9 + 0x68], 0
mov qword [r8], rcx
jne 0x14005b5f8
lea r10, [r9 + 0x70]
cmp qword [r9 + 0x78], 0
mov qword [r8], r10
jne 0x14005b5f8
sub r9, 0xffffffffffffff80
mov qword [r8], r9
cmp r9, rbx
jne 0x14005b550
movzx ecx, byte [rsi + 0x20]
mov rdx, r8
call fcn.140058700
mov rcx, rbp
mov qword [rsi + 8], rbx
mov byte [rsi + 0x20], 8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140059de0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0xd2
lea rdx, str.C:include_boost_beast_core_detail_variant.hpp
lea rcx, str.i___I
call qword [sym.imp.msvcrt.dll__assert]
nop
Function at 0x14005b620
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
cmp byte [rax + 0x18], 5
mov rbp, rcx
jne 0x14005b86d
mov rbx, qword [rax + 8]
lea rsi, [rax + 8]
lea rdi, [0x140552bd0]
lea r12, [0x14054bb20]
lea r13, [0x140558b80]
jmp 0x14005b67a
cmp rbx, rdi
je 0x14005b6b0
mov rbx, qword [rsi]
cmp qword [rbx + 8], 0
jne 0x14005b860
add rbx, 0x10
mov qword [rsi], rbx
movzx edx, byte [0x14054bb20]
test dl, dl
jne 0x14005b660
mov rcx, r12
call fcn.14053f5e0
test eax, eax
je 0x14005b660
mov rcx, r12
mov qword [0x140552bc0], r13
mov qword [0x140552bc8], 2
call fcn.14053f720
cmp rbx, rdi
jne 0x14005b665
mov rcx, qword [rbp]
mov r8, qword [rcx]
cmp byte [rcx + 0x18], 9
lea r9, [r8 + 0x58]
ja 0x14005b8a1
mov qword [rcx + 8], r9
mov byte [rcx + 0x18], 6
mov r9, qword [rbp]
cmp byte [r9 + 0x18], 6
jne 0x14005b86d
mov rax, qword [r9]
mov r11, qword [r9 + 8]
lea r10, [r9 + 8]
lea r8, [rax + 0x68]
cmp r8, r11
je 0x14005b83e
mov rsi, r8
sub rsi, r11
sub rsi, 0x10
shr rsi, 4
add rsi, 1
and esi, 7
je 0x14005b7ba
cmp rsi, 1
je 0x14005b7a3
cmp rsi, 2
je 0x14005b791
cmp rsi, 3
je 0x14005b77f
cmp rsi, 4
je 0x14005b76d
cmp rsi, 5
je 0x14005b75b
cmp rsi, 6
je 0x14005b749
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp qword [r11 + 8], 0
jne 0x14005b860
add r11, 0x10
mov qword [r10], r11
cmp r11, r8
je 0x14005b837
cmp qword [r11 + 8], 0
jne 0x14005b860
lea rdi, [r11 + 0x10]
cmp qword [r11 + 0x18], 0
mov qword [r10], rdi
jne 0x14005b860
lea r12, [r11 + 0x20]
cmp qword [r11 + 0x28], 0
mov qword [r10], r12
jne 0x14005b860
lea r13, [r11 + 0x30]
cmp qword [r11 + 0x38], 0
mov qword [r10], r13
jne 0x14005b860
lea rdx, [r11 + 0x40]
cmp qword [r11 + 0x48], 0
mov qword [r10], rdx
jne 0x14005b860
lea rbx, [r11 + 0x50]
cmp qword [r11 + 0x58], 0
mov qword [r10], rbx
jne 0x14005b860
lea rcx, [r11 + 0x60]
cmp qword [r11 + 0x68], 0
mov qword [r10], rcx
jne 0x14005b860
lea rax, [r11 + 0x70]
cmp qword [r11 + 0x78], 0
mov qword [r10], rax
jne 0x14005b860
sub r11, 0xffffffffffffff80
mov qword [r10], r11
cmp r11, r8
jne 0x14005b7ba
cmp byte [r9 + 0x18], 9
ja 0x14005b887
mov rcx, rbp
mov qword [r9 + 8], r8
mov byte [r9 + 0x18], 7
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14005a040
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0xd2
lea rdx, str.C:include_boost_beast_core_detail_variant.hpp
lea rcx, str.i___I
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x172
lea rdx, str.C:include_boost_mp11_detail_mp_with_index.hpp
lea rcx, str.i___N
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x172
lea rdx, str.C:include_boost_mp11_detail_mp_with_index.hpp
lea rcx, str.i___N
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]