joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x470
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
mov esi, edx
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
jne 0x14009c575
mov eax, ecx
jmp 0x14009c6e2
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x490], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x400
mov qword [rsp + 0x38], 0
movdqu xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009c60c
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14009c69a
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14009c5fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x10000
jmp 0x14009c6da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
je 0x14009c645
cmp eax, 0xe8
je 0x14009c645
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14009c63a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0xffffffffffffffff
lea eax, [rdi + 0x20000]
jmp 0x14009c6da
mov rcx, qword [rbx + 8]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
test eax, eax
jne 0x14009c6d2
lea r9d, [rax + 1]
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14009c69a
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14009c68d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x30000
jmp 0x14009c6da
mov rcx, qword [rbx]
test rcx, rcx
je 0x14009c6b2
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov r8d, dword [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, 2
call fcn.14027addc
mov r8d, dword [rsp + 0x30]
lea rdx, str.Client_Read:__d_n
mov rcx, rax
call fcn.140088fb0
jmp 0x14009c6d8
call qword [sym.imp.KERNEL32.dll_CancelIo]
xor eax, eax
mov rdi, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14025e930
mov rbx, qword [rsp + 0x498]
add rsp, 0x470
pop rsi
ret

Function at 0x14009c710
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x10]
xor eax, eax
mov dword [rsp + 0x40], eax
cmp rcx, 0xffffffffffffffff
je 0x14009c741
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14009c741
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400a87a0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov ebx, edx
mov r11, rcx
test dl, 3
jne 0x1400a8851
xor r9d, r9d
mov r10d, r9d
test edx, edx
je 0x1400a8843
lea rdi, [0x1402f4540]
nop dword [rax]
movzx ecx, byte [r11]
cmp cl, 0x3d
je 0x1400a8843
lea eax, [rcx - 0x2b]
cmp al, 0x4f
ja 0x1400a8851
movzx edx, byte [rcx + rdi]
cmp dl, 0xff
je 0x1400a8851
mov eax, r10d
and eax, 3
je 0x1400a8831
sub eax, 1
je 0x1400a881d
sub eax, 1
je 0x1400a8809
cmp eax, 1
jne 0x1400a8838
or byte [r9 + r8], dl
inc r9d
jmp 0x1400a8838
movzx eax, dl
shr al, 2
and al, 0xf
or byte [r9 + r8], al
inc r9d
shl dl, 6
jmp 0x1400a8834
movzx eax, dl
shr al, 4
and al, 3
or byte [r9 + r8], al
inc r9d
shl dl, 4
jmp 0x1400a8834
shl dl, 2
mov byte [r9 + r8], dl
inc r10d
inc r11
cmp r10d, ebx
jb 0x1400a87d0
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
xor eax, eax
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1400a8860
Capabilities:
Encode data using base64

Disassembly:
push rbx
mov r11, r8
xor r9d, r9d
xor r8b, r8b
xor eax, eax
mov rbx, rcx
test edx, edx
je 0x1400a896b
mov qword [rsp + 0x10], rsi
lea rsi, [0x1402f4500]
mov qword [rsp + 0x18], rdi
mov edi, edx
nop dword [rax + rax]
movzx r10d, byte [rbx]
mov edx, r9d
test r9d, r9d
je 0x1400a88f5
sub edx, 1
je 0x1400a88d2
cmp edx, 1
jne 0x1400a890c
movzx r8d, r8b
mov ecx, r10d
shr rcx, 6
and r8d, 0xf
shl r8, 2
xor r9d, r9d
or r8, rcx
movzx ecx, byte [r8 + rsi]
mov byte [rax + r11], cl
inc eax
mov ecx, r10d
and ecx, 0x3f
jmp 0x1400a8902
movzx r8d, r8b
mov rcx, r10
and r8d, 3
shr rcx, 4
shl r8, 4
mov r9d, 2
or r8, rcx
movzx ecx, byte [r8 + rsi]
jmp 0x1400a8906
mov rcx, r10
mov r9d, 1
shr rcx, 2
movzx ecx, byte [rcx + rsi]
mov byte [rax + r11], cl
inc eax
inc rbx
mov edx, eax
mov r8, r10
sub rdi, 1
jne 0x1400a8890
mov rdi, qword [rsp + 0x18]
mov eax, edx
sub r9d, 1
je 0x1400a8944
cmp r9d, 1
jne 0x1400a8966
mov rax, r10
and eax, 0xf
movzx eax, byte [rsi + rax*4]
mov byte [rdx + r11], al
lea eax, [rdx + 1]
jmp 0x1400a895f
mov rax, r10
and eax, 3
add rax, rax
movzx eax, byte [rsi + rax*8]
mov byte [rdx + r11], al
lea eax, [rdx + 1]
mov byte [rax + r11], 0x3d
inc eax
mov byte [rax + r11], 0x3d
inc eax
mov rsi, qword [rsp + 0x10]
mov ecx, eax
mov byte [rcx + r11], 0
pop rbx
ret
Function at 0x1400ac5e0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov rcx, qword [rcx + 0x10]
call fcn.1400b6670
mov r14d, eax
test eax, eax
jns 0x1400ac7f0
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
mov ecx, eax
call fcn.1400b6100
test al, al
jne 0x1400ac7f0
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10050]
mov r15, qword [rdx + 0x30]
mov edi, dword [rdx + 0x48]
call fcn.14025cafc
imul rcx, rax, 0x64
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov ecx, esi
call fcn.1400b4cd0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, str._yasio___lld__index:__d__write_udp_socket_failed__ec_d__detail:_s_n
lea edx, [r12 + 0x7f]
lea rcx, [rbp - 0x29]
call fcn.140089000
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400ac706
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac701
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac817
call fcn.14025e328
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
mov rcx, qword [r15 + 0x940]
test rcx, rcx
je 0x1400ac74b
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 3
mov rax, qword [rcx]
lea r8, [rbp - 0x51]
lea rdx, [rbp - 0x59]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400ac7b9
lea r9, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r9, qword [rbp - 0x49]
lea r8, [0x1402f3734]
mov edx, reloc.WLDAP32.dll_Ordinal_127
lea rcx, [rbp - 9]
call fcn.140089000
cmp qword [rax + 0x18], 0x10
jb 0x1400ac778
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x1400ac7b9
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac7b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac81d
call fcn.14025e328
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x1400ac7f0
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac7eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac811
call fcn.14025e328
mov eax, r14d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14025e930
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14026d254
nop
call fcn.14026d254
nop
call fcn.14026d254
int3
mov r9, qword [r9]
add rcx, 8
mov r8d, dword [r8]
mov rdx, qword [rdx]
jmp 0x1400ac5e0
Function at 0x1400ad1f0
Capabilities:
Print debug messages

Disassembly:
mov rax, qword [rcx + 8]
mov r9, rdx
movzx eax, byte [rax + 0x26]
nop
cmp al, 3
je 0x1400ad212
mov rdx, qword [rcx + 8]
mov r8d, 0x274c
mov rcx, r9
jmp fcn.1400b0d80
ret
Function at 0x1400ad2f0
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, rcx
mov rcx, qword [rcx]
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov rcx, qword [rcx + 0x10]
call fcn.1400b6670
mov r14d, eax
test eax, eax
jns 0x1400ac7f0
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
mov ecx, eax
call fcn.1400b6100
test al, al
jne 0x1400ac7f0
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10050]
mov r15, qword [rdx + 0x30]
mov edi, dword [rdx + 0x48]
call fcn.14025cafc
imul rcx, rax, 0x64
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov ecx, esi
call fcn.1400b4cd0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, str._yasio___lld__index:__d__write_udp_socket_failed__ec_d__detail:_s_n
lea edx, [r12 + 0x7f]
lea rcx, [rbp - 0x29]
call fcn.140089000
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400ac706
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac701
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac817
call fcn.14025e328
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
mov rcx, qword [r15 + 0x940]
test rcx, rcx
je 0x1400ac74b
lea rax, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rax, qword [rbp - 0x49]
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 3
mov rax, qword [rcx]
lea r8, [rbp - 0x51]
lea rdx, [rbp - 0x59]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400ac7b9
lea r9, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r9, qword [rbp - 0x49]
lea r8, [0x1402f3734]
mov edx, reloc.WLDAP32.dll_Ordinal_127
lea rcx, [rbp - 9]
call fcn.140089000
cmp qword [rax + 0x18], 0x10
jb 0x1400ac778
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x1400ac7b9
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac7b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac81d
call fcn.14025e328
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x1400ac7f0
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac7eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ac811
call fcn.14025e328
mov eax, r14d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14025e930
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14026d254
nop
call fcn.14026d254
nop
call fcn.14026d254
int3
mov r9, qword [r9]
add rcx, 8
mov r8d, dword [r8]
mov rdx, qword [rdx]
jmp 0x1400ac5e0
Function at 0x1400ad810
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x88
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
mov rsi, rdx
movups xmmword [rcx], xmm0
mov rbx, rcx
mov edx, 0x3a
movups xmmword [rcx + 0x10], xmm0
mov rcx, rsi
movzx r14d, r8w
call fcn.14025f3dc
test rax, rax
je 0x1400ad8fd
mov qword [rsp + 0x80], rbp
mov rcx, rsi
xor ebp, ebp
lea edx, [rbp + 0x25]
call fcn.14025f3dc
mov rdi, rax
test rax, rax
je 0x1400ad8a7
lea rcx, [rax + 1]
call fcn.14027ac0c
sub rdi, rsi
lea rcx, [rsp + 0x20]
mov ebp, eax
mov rdx, rsi
mov eax, 0x40
cmp rdi, rax
cmova rdi, rax
mov r8, rdi
call fcn.140260c10
mov byte [rsp + rdi + 0x20], 0
lea rsi, [rsp + 0x20]
mov edi, reloc.WS2_32.dll_socket
lea r8, [rbx + 8]
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400ad8d8
movzx ecx, r14w
mov word [rbx], di
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbx + 2], ax
mov dword [rbx + 0x18], ebp
mov byte [rbx + 0x1c], 0x1c
mov rbp, qword [rsp + 0x80]
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14025e930
add rsp, 0x88
pop r14
pop rdi
pop rsi
pop rbx
ret
mov edi, 2
lea r8, [rbx + 4]
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400ad92b
movzx ecx, r14w
mov word [rbx], di
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbx + 2], ax
mov byte [rbx + 0x1c], reloc.WS2_32.dll_recv
mov rax, rbx
jmp 0x1400ad8e3

Function at 0x1400ada30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
call fcn.1400afe90
test al, al
jne 0x1400adb66
lea rbx, [rbp + 0x198]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call fcn.14025d0d0
test eax, eax
jne 0x1400adb79
mov rsi, qword [rbp + 0x188]
mov rdi, qword [rbp + 0x180]
cmp rdi, rsi
je 0x1400adb5e
cmp qword [rdi], r14
je 0x1400ada9b
add rdi, 0x48
cmp rdi, rsi
jne 0x1400ada88
jmp 0x1400adb5e
cmp rdi, rsi
je 0x1400adb5e
add rdi, 0x48
cmp rdi, rsi
je 0x1400adad4
nop dword [rax]
mov rax, qword [rdi]
mov qword [rdi - 0x48], rax
lea rdx, [rdi + 8]
lea rcx, [rdi - 0x40]
call fcn.1400abd60
add rdi, 0x48
cmp rdi, rsi
jne 0x1400adab0
mov rsi, qword [rbp + 0x188]
add rsi, 0xffffffffffffffc0
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1400adaf5
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
call qword [rax + 0x20]
mov qword [rsi + 0x38], 0
mov rdx, qword [rbp + 0x188]
add rdx, 0xffffffffffffffb8
mov qword [rbp + 0x188], rdx
mov rcx, qword [rbp + 0x180]
cmp rcx, rdx
je 0x1400adb5e
sub rdx, rcx
movabs rax, 0xe38e38e38e38e39
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea r9, [0x1400a9670]
mov r8d, Ordinal_73
call fcn.14027e690
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x1402f466c]
mov rcx, qword [rbp + 0x178]
call sub.WS2_32.dll_send
nop
mov rcx, rbx
call fcn.14025d0f4
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.14025d438
int3
Function at 0x1400adc90
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140398b38]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx r8d, dl
xor r8d, 1
add r8d, 0xc
cmp word [rcx + 0x120], 2
jne 0x1400adcde
mov eax, dword [rcx + 0x144]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
xor edx, edx
mov eax, dword [rcx + 0x124]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], 8
jmp 0x1400add06
movups xmm0, xmmword [rcx + 0x128]
mov eax, dword [rcx + 0x158]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x48], eax
mov edx, reloc.WLDAP32.dll_Ordinal_41
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14025e930
add rsp, 0x68
ret
Function at 0x1400afa60
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [rcx]
mov rdi, rcx
cmp eax, 1
jle 0x1400afb5d
cmp byte [rcx + 0x94a], 0
jne 0x1400afb53
mov byte [rcx + 0x94a], dl
cmp eax, 2
jne 0x1400afb5d
mov qword [rsp + 0x38], rbp
mov rbp, qword [rcx + 0xc8]
mov qword [rsp + 0x40], rsi
mov rsi, qword [rcx + 0xc0]
cmp rsi, rbp
je 0x1400afb22
mov qword [rsp + 0x30], rbx
mov rax, qword [rsi]
mov rcx, qword [rdi + 0xc0]
movsxd rbx, dword [rax + 0x48]
mov rax, qword [rdi + 0xc8]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jae 0x1400afb14
mov rbx, qword [rcx + rbx*8]
test rbx, rbx
je 0x1400afb14
movzx eax, byte [rbx + 0x27]
test al, 2
jne 0x1400afb14
mov rcx, qword [rbx + 0x10]
and al, 0xfe
mov byte [rbx + 0x27], al
call fcn.1400b6070
test al, al
je 0x1400afb14
or byte [rbx + 0x27], 2
lea rdx, [0x1402f466c]
mov rcx, qword [rdi + 0x178]
xor r9d, r9d
lea r8d, [r9 + 1]
call sub.WS2_32.dll_send
add rsi, 8
cmp rsi, rbp
jne 0x1400afab2
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rdi + 0x178]
lea rdx, [0x1402f466c]
xor r9d, r9d
lea r8d, [r9 + 1]
call sub.WS2_32.dll_send
mov rcx, rdi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400b15f0
add rsp, 0x20
pop rdi
jmp fcn.1400b15f0
add rsp, 0x20
pop rdi
ret

Function at 0x1400b1180
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rdx + 0x10050]
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov byte [rbx + 0x3b], 0
test byte [rbx + 0x38], 1
mov dword [rbx + 0x20], eax
je 0x1400b11d1
mov qword [rbx + 0x178], rax
mov eax, 3
xchg byte [rbx + 0x26], al
test byte [rbx + 0x38], 8
je 0x1400b11eb
mov rdx, qword [rbx + 0x108]
mov rcx, rsi
call fcn.1400adc30
jmp 0x1400b11eb
mov rcx, qword [rdx + 0x10]
call fcn.1400b60d0
mov rdx, rax
mov r8d, 1
mov rcx, rdi
call fcn.1400b2ee0
test byte [rbx + 0x38], 4
je 0x1400b121c
mov edx, dword [rdi + 0x870]
test edx, edx
je 0x1400b121c
mov eax, dword [rdi + 0x87c]
mov r9d, dword [rdi + 0x878]
mov r8d, dword [rdi + 0x874]
mov rcx, qword [rsi + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400b66a0
mov rdx, rsi
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400b1fb0
Function at 0x1400b2450
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
mov edi, 2
lea r9d, [rdi + 4]
lea r8d, [rdi - 1]
mov edx, edi
lea rcx, [rbp + 0x28]
call fcn.1400b5a70
nop
mov dword [rbp + 0x20], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x20]
mov edx, 0xffff
lea r8d, [rdi + 2]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WS2_32.dll_setsockopt]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], di
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbp - 0x3c], eax
mov byte [rbp - 0x24], reloc.WS2_32.dll_recv
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x3e], ax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.1400b5c10
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x28]
call fcn.1400b6090
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax]
movups xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm0
movd eax, xmm1
cmp ax, di
jne 0x1400b2519
mov rcx, qword [rbp - 0x40]
shr rcx, 0x20
call qword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
jne 0x1400b252f
mov word [rbp - 0x40], di
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbp - 0x3c], eax
mov byte [rbp - 0x24], reloc.WS2_32.dll_recv
mov edx, 0x7fffffff
lea rcx, [rbp + 0x28]
call fcn.1400b6080
mov r9d, 6
lea r8d, [r9 - 5]
mov edx, edi
lea rcx, [rbp + 0x30]
call fcn.1400b5a70
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x30]
call fcn.1400b5c90
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x28]
call fcn.1400b5b70
nop
mov dl, 1
lea rcx, [rbp + 0x30]
call fcn.1400b6730
mov dword [rbp + 0x20], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x20]
mov edx, 6
lea r8d, [rdx - 5]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dl, 1
lea rcx, [rbp + 0x38]
call fcn.1400b6730
mov dword [rbp + 0x20], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp + 0x20]
mov edx, 6
lea r8d, [rdx - 5]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.WS2_32.dll_setsockopt]
lea rcx, [rbp + 0x38]
call fcn.1400b6210
mov qword [rbx], rax
lea rcx, [rbp + 0x30]
call fcn.1400b6210
mov qword [rbx + 8], rax
lea rcx, [rbp + 0x38]
call fcn.1400b5ac0
nop
lea rcx, [rbp + 0x30]
call fcn.1400b5ac0
nop
lea rcx, [rbp + 0x28]
call fcn.1400b5ac0
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400b35c0
Capabilities:
Send data
Send data on socket

Disassembly:
test rdx, rdx
je 0x1400b3746
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r13
push r15
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r13, rcx
lea rbx, [rcx + 0x198]
mov qword [rsp + 0x68], rbx
mov rcx, rbx
call fcn.14025d0d0
test eax, eax
jne 0x1400b3747
mov rdx, qword [r13 + 0x188]
lea r15, [r13 + 0x180]
mov rax, qword [r15]
cmp rax, rdx
je 0x1400b3635
nop dword [rax]
cmp qword [rax], rsi
je 0x1400b3630
add rax, 0x48
cmp rax, rdx
jne 0x1400b3620
jmp 0x1400b3635
cmp rax, rdx
jne 0x1400b366b
cmp rdx, qword [r15 + 0x10]
je 0x1400b3659
mov qword [rdx], rsi
lea rcx, [rdx + 8]
mov qword [rcx + 0x38], 0
mov rdx, rdi
call fcn.1400ad330
add qword [r15 + 8], 0x48
jmp 0x1400b36cf
mov r9, rdi
lea r8, [rsp + 0x58]
mov rcx, r15
call fcn.1400a9680
jmp 0x1400b36cf
lea rbp, [rax + 8]
cmp rbp, rdi
je 0x1400b36cf
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400b3691
mov rax, qword [rcx]
cmp rcx, rbp
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x38], 0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400b36cf
cmp rcx, rdi
jne 0x1400b36c3
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rbp + 0x38], rax
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400b36cf
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
jmp 0x1400b36c7
mov qword [rbp + 0x38], rcx
mov qword [rdi + 0x38], 0
mov rcx, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rcx
movabs rax, 0xe38e38e38e38e39
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea r9, [0x1400a9670]
mov r8d, Ordinal_73
call fcn.14027e690
mov rax, qword [r13 + 0x188]
cmp rsi, qword [rax - 0x48]
jne 0x1400b372e
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x1402f466c]
mov rcx, qword [r13 + 0x178]
call sub.WS2_32.dll_send
nop
mov rcx, rbx
call fcn.14025d0f4
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.14025d438
int3