joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140100050
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 1]
lea rcx, str.MBSetup
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
test rax, rax
jne 0x14010018e
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x58]
call fcn.1402d24a8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.1402d04e0
lea r9, [rsp + 0x60]
lea r8, str._F__T__UTC__z_
mov edx, 0x100
lea rcx, [rsp + 0x90]
call fcn.1402d248c
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140030cb0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, [0x1404a9a40]
call fcn.14005efa0
lea rdx, str.D:JenkinsworkspaceN_SUCommon_srcSUCommonSetupUtilities.cpp
mov rcx, rax
call fcn.140047ea0
mov rcx, rax
lea rdx, [0x14041313c]
call fcn.140047ea0
mov edx, 0x231
mov rcx, rax
call fcn.140045730
mov rcx, rax
lea rdx, str.:_Error_on_WinHttpOpen:
call fcn.140047ea0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001df00
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002ea70
movzx edx, ax
mov rcx, rbx
call fcn.140070ff0
mov rcx, rbx
call fcn.14002ddd0
nop
lea rcx, [rsp + 0x30]
call fcn.1400166f0
xor eax, eax
jmp 0x140100230
mov dword [rsp + 0x50], 0x2a0
mov dword [rsp + 0x54], 0xaa0
mov r9d, 4
lea r8, [rsp + 0x54]
lea edx, [r9 + 0x50]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x14010022d
lea r9d, [rax + 4]
lea r8, [rsp + 0x50]
lea edx, [rax + 0x54]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x14010022d
lea rdx, str.Error_on_WinHttpSetOption_SECURE_PROTOCOLS_:
lea rcx, [0x1404a9a40]
call fcn.140047ea0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.14001df00
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002ea70
movzx edx, ax
mov rcx, rbx
call fcn.140070ff0
mov rcx, rbx
call fcn.14002ddd0
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x140100230
mov rax, rdi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rdi
ret
Function at 0x14010a600
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x238
mov ecx, 0x202
lea rdx, [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14010a626
add rsp, 0x238
ret
lea rdx, str.Failed_to_initialize_network_subsystem
lea rcx, [rsp + 0x20]
call fcn.140015470
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14010fee0
lea rdx, [0x140488320]
lea rcx, [rsp + 0x40]
call fcn.1402b8690
int3

Function at 0x14010ba10
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x180
mov rbx, rdx
mov rdi, rcx
mov r14, rcx
mov qword [rsp + 0x1b0], rcx
call fcn.14010afe0
lea rcx, [r14 + 0x88]
call fcn.14010e650
cmp byte [r14 + 0x1e3], 0
jne 0x14010bada
lea rsi, vtable.std::ios_base.0
mov rcx, rbx
call fcn.14010e650
mov r8d, 1
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.14011b660
nop
mov rax, qword [rbx]
lea rdx, [rsp + 0x108]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp 0x14010bab0
lea rcx, [rsp + 0x120]
call fcn.14011bac0
nop
mov qword [rsp + 0x120], rsi
lea rcx, [rsp + 0x120]
call fcn.1402b4dfc
nop
cmp dword [rbx + 0x50], 0x64
je 0x14010ba61
cmp byte [rdi + 0x30], 0
je 0x14010baf0
mov rcx, rbx
call fcn.14010dfb0
test al, al
jne 0x14010baf0
mov al, 1
jmp 0x14010baf2
xor al, al
mov byte [rdi + 0x1e1], al
cmp byte [rdi + 0x1e2], 0
je 0x14010bc04
mov eax, dword [rbx + 0x50]
cmp eax, 0xc8
jl 0x14010bc04
cmp eax, 0xcc
je 0x14010bc04
cmp eax, 0x130
je 0x14010bc04
mov rcx, rbx
call fcn.14010df40
test al, al
je 0x14010bb78
mov ecx, 0x140
call fcn.14011d730
mov qword [rsp + 0x1a0], rax
test rax, rax
je 0x14010bb68
lea r8, [rdi + 0x88]
mov r9d, 1
mov rdx, rdi
mov rcx, rax
call fcn.14011d1a0
xor ecx, ecx
jmp 0x14010bb6c
xor ecx, ecx
mov eax, ecx
lea rdx, [rax + 0xc8]
jmp 0x14010bc3e
lea rdx, str.Content_Length
mov rcx, rbx
call fcn.14010e930
test al, al
je 0x14010bbcb
mov ecx, 0x118
call fcn.14011ce30
mov rsi, rax
mov qword [rsp + 0x1a0], rax
test rax, rax
je 0x14010bbc5
mov rcx, rbx
call fcn.14010df70
mov r9d, 1
mov r8, rax
mov rdx, rdi
mov rcx, rsi
call fcn.14011c950
xor ecx, ecx
jmp 0x14010bbc9
xor ecx, ecx
mov eax, ecx
jmp 0x14010bc37
mov ecx, 0x110
call fcn.14011c650
mov qword [rsp + 0x1a0], rax
test rax, rax
je 0x14010bbf7
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call fcn.14011c180
xor ecx, ecx
jmp 0x14010bbfb
xor ecx, ecx
mov eax, ecx
lea rdx, [rax + 0x98]
jmp 0x14010bc3e
mov ecx, 0x118
call fcn.14011ce30
mov qword [rsp + 0x1a0], rax
test rax, rax
je 0x14010bc33
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.14011c950
xor ecx, ecx
jmp 0x14010bc37
xor ecx, ecx
mov eax, ecx
lea rdx, [rax + 0xa0]
test rax, rax
cmove rdx, rcx
lea rcx, [r14 + 0x1f8]
call fcn.14010ae30
mov rax, qword [r14 + 0x200]
test rax, rax
je 0x14010bc71
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140131fa0
lea rdx, [0x140489f00]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3
Function at 0x1401152d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xf0
mov rcx, qword [rcx + 0x10]
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x14011533c
lea r8, [rax + 8]
mov dword [rax + 8], 0x80
lea rdx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x140115323
mov r8d, dword [rsp + 0x100]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140114740
mov rax, rbx
add rsp, 0xf0
pop rbx
ret
call fcn.1401163f0
mov rcx, rbx
call fcn.1401147c0
mov rax, rbx
add rsp, 0xf0
pop rbx
ret
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x28]
call fcn.1402b8690
int3

Function at 0x140115360
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov edx, 0x4004667f
mov rbp, rcx
call fcn.1401166e0
cmp dword [rsp + 0x58], 0
je 0x140115464
lea r9, [rsp + 0x60]
mov edx, 0xffff
mov r8d, 0x1008
mov rcx, rbp
call fcn.1401164a0
cmp dword [rsp + 0x60], 2
jne 0x140115464
movsxd r8, dword [rsp + 0x58]
xor ebx, ebx
xor edi, edi
mov rsi, r8
test r8d, r8d
je 0x140115407
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x140115475
mov rcx, r8
cmp r8, 0x1000
jb 0x1401153eb
call fcn.1400161e0
jmp 0x1401153f0
call fcn.1402b5c5c
lea rdi, [rsi + rax]
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call fcn.140024360
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rbp + 0x10]
mov r9d, 2
mov qword [rsp + 0x28], 0
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rsp + 0x58], eax
test rbx, rbx
je 0x140115464
sub rdi, rbx
cmp rdi, 0x1000
jb 0x140115459
mov rcx, qword [rbx - 8]
add rdi, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14011547b
mov rbx, rcx
mov rdx, rdi
mov rcx, rbx
call fcn.1402b5c4c
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
call fcn.14001fd70
int3
call fcn.1402c5d0c
int3

Function at 0x140115780
Capabilities:
Check os version

Disassembly:
sub rsp, 0xc8
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1401157b8
cmp dword [rsp + 0x24], 6
jb 0x1401157b8
jne 0x1401157ae
cmp dword [rsp + 0x28], 2
jb 0x1401157b8
xor al, al
add rsp, 0xc8
ret
mov al, 1
add rsp, 0xc8
ret
Function at 0x140115810
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x140115845
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.140114a00
mov edx, eax
mov rcx, rsi
call rbx
mov rcx, rdi
call fcn.140114e60
mov ebx, eax
mov rcx, rdi
call fcn.140114980
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x1401158d2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140115845
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140115030
nop
mov rdx, rax
mov ecx, ebx
call fcn.140115c00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401158d2
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401158cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401158e2
call fcn.1402b5c4c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1402c5d0c
int3

Function at 0x1401158f0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0xb0
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x140115936
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.140114a00
mov edx, eax
mov rcx, rdi
call rbx
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x138]
nop
mov rcx, rsi
call fcn.140114e60
mov ebx, eax
mov rcx, rsi
call fcn.140114980
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140115a04
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2734
je 0x1401159d7
cmp eax, 0x2733
je 0x1401159d7
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140115030
nop
mov rdx, rax
mov ecx, ebx
call fcn.140115c00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401159d7
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401159d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140115a2c
call fcn.1402b5c4c
mov rax, qword [rdi]
mov r8d, 7
mov rdx, r14
mov rcx, rdi
call qword [rax + 0xc8]
test al, al
je 0x140115a32
mov rcx, rdi
call fcn.140117890
test eax, eax
je 0x140115a04
mov ecx, eax
call fcn.140115b90
nop
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp qword [rax + 0x138]
call fcn.1402c5d0c
nop
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140115030
mov rbx, rax
lea rdx, str.connect_timed_out
lea rcx, [rsp + 0x20]
call fcn.140015470
nop
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1401324b0
lea rdx, [0x14048a2e0]
lea rcx, [rsp + 0x60]
call fcn.1402b8690
int3
Function at 0x140115a80
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
jne 0x140115ab5
mov rax, qword [rcx]
mov rbx, qword [rax + 0x150]
mov rcx, rdx
call fcn.140114a00
mov edx, eax
mov rcx, rdi
call rbx
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x138]
mov rcx, rsi
call fcn.140114e60
mov ebx, eax
mov rcx, rsi
call fcn.140114980
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x140115b51
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2734
je 0x140115b51
cmp eax, 0x2733
je 0x140115b51
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140115030
nop
mov rdx, rax
mov ecx, ebx
call fcn.140115c00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140115b51
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140115b4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140115b61
call fcn.1402b5c4c
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1402c5d0c
int3

Function at 0x1401166e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x1401166fb
add rsp, 0x28
jmp fcn.1401163f0
add rsp, 0x28
ret

Function at 0x140116a30
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [rcx]
mov ebp, r8d
mov rdi, rdx
xor esi, esi
mov rdx, r9
mov rbx, rcx
lea r8d, [rsi + 1]
call qword [rax + 0xc8]
test al, al
je 0x140116afc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc0]
movsxd rdx, eax
cmp qword [rdi + 8], rdx
jae 0x140116a90
mov r8b, 1
mov rcx, rdi
call fcn.140117120
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140116b14
mov r8d, dword [rdi + 8]
mov r9d, ebp
mov rdx, qword [rdi + 0x10]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
test eax, eax
jns 0x140116ae8
cmp byte [rbx + 0x28], 0
je 0x140116ac5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140116a90
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140116ada
cmp byte [rbx + 0x28], 0
jne 0x140116b32
jmp 0x140116ae8
cmp eax, 0x274c
je 0x140116b32
mov ecx, eax
call fcn.140115b90
mov rdx, rsi
cmp rsi, qword [rdi + 8]
jae 0x140116afc
mov r8b, 1
mov rcx, rdi
call fcn.140117120
lea r11, [rsp + 0x70]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140132510
lea rdx, [0x14048a2e0]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3
Function at 0x140116b50
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rsi, rdx
mov ebp, r8d
mov edx, 1
mov rdi, rcx
call fcn.1401156f0
xor r14d, r14d
nop word [rax + rax]
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140116c3f
mov rdx, qword [rsi]
lea rax, [rsp + 0xc8]
mov r8, qword [rsi + 8]
lea r9, [rsp + 0xb0]
sub r8, rdx
mov qword [rsp + 0x30], r14
sar r8, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0xb0], r14d
mov dword [rsp + 0xc8], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x140116bda
call fcn.1401163f0
cmp byte [rdi + 0x28], r14b
je 0x140116bf7
cmp dword [rsp + 0xb0], r14d
jge 0x140116c24
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140116b80
cmp dword [rsp + 0xb0], r14d
jge 0x140116c24
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140116c16
cmp byte [rdi + 0x28], r14b
jne 0x140116c5d
jmp 0x140116c24
cmp eax, 0x274c
je 0x140116c5d
mov ecx, eax
call fcn.140115b90
mov eax, dword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x40]
call fcn.1402b8690
int3
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140132510
lea rdx, [0x14048a2e0]
lea rcx, [rsp + 0x40]
call fcn.1402b8690
int3

Function at 0x140116c80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov r14, rdx
mov esi, r9d
mov edx, 1
mov ebp, r8d
mov rbx, rcx
call fcn.1401156f0
mov qword [rsp + 0x80], rdi
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140116d29
mov r9d, esi
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jns 0x140116d08
cmp byte [rbx + 0x28], 0
je 0x140116ce5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140116cb3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140116cfa
cmp byte [rbx + 0x28], 0
jne 0x140116d47
jmp 0x140116d08
cmp eax, 0x274c
je 0x140116d47
mov ecx, eax
call fcn.140115b90
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x80]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140132510
lea rdx, [0x14048a2e0]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3
Function at 0x140116d70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
mov r14, r9
mov edx, 1
mov r15, r8
mov rdi, rcx
call fcn.1401156f0
mov ebp, dword [rsp + 0xe0]
xor r12d, r12d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140116e87
mov rax, qword [r14]
mov r9, qword [r15]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x40], r12
sub r8, rdx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r9
lea r9, [rsp + 0xc0]
sar r8, 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xc0], r12d
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x140116e14
call fcn.1401163f0
cmp byte [rdi + 0x28], r12b
je 0x140116e35
cmp dword [rsp + 0xc0], r12d
jge 0x140116e62
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140116db0
cmp dword [rsp + 0xc0], r12d
jge 0x140116e62
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140116e54
cmp byte [rdi + 0x28], r12b
jne 0x140116ea5
jmp 0x140116e62
cmp eax, 0x274c
je 0x140116ea5
mov ecx, eax
call fcn.140115b90
mov eax, dword [rsp + 0xc0]
lea r11, [rsp + 0xa0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x58]
call fcn.1402b8690
int3
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140132510
lea rdx, [0x14048a2e0]
lea rcx, [rsp + 0x58]
call fcn.1402b8690
int3

Function at 0x140116ed0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x80
mov r14, rdx
mov rsi, r9
mov edx, 1
mov ebp, r8d
mov rbx, rcx
call fcn.1401156f0
mov r15d, dword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
mov qword [rsp + 0xa0], rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140116fb2
mov rax, qword [r12]
mov r9d, r15d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov rax, qword [rsi]
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
jns 0x140116f8a
cmp byte [rbx + 0x28], 0
je 0x140116f67
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140116f20
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140116f7c
cmp byte [rbx + 0x28], 0
jne 0x140116fd0
jmp 0x140116f8a
cmp eax, 0x274c
je 0x140116fd0
mov ecx, eax
call fcn.140115b90
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [rsp + 0xa0]
mov rsp, r11
pop r15
pop r14
pop r12
ret
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x30]
call fcn.1402b8690
int3
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140132510
lea rdx, [0x14048a2e0]
lea rcx, [rsp + 0x30]
call fcn.1402b8690
int3
Function at 0x1401171e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x90
mov rsi, rdx
mov ebp, r8d
mov edx, 2
mov rdi, rcx
call fcn.1401156f0
xor r14d, r14d
nop
mov rcx, qword [rdi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1401172a7
mov rdx, qword [rsi]
lea r9, [rsp + 0xa0]
mov r8, qword [rsi + 8]
sub r8, rdx
mov qword [rsp + 0x30], r14
sar r8, 4
mov qword [rsp + 0x28], r14
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x14011725a
call fcn.1401163f0
cmp byte [rdi + 0x28], r14b
je 0x140117277
cmp dword [rsp + 0xa0], r14d
jge 0x140117286
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140117210
cmp dword [rsp + 0xa0], r14d
jge 0x140117286
call fcn.1401163f0
mov eax, dword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x40]
call fcn.1402b8690
int3

Function at 0x1401172d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x70
mov r14, rdx
mov esi, r9d
mov edx, 2
mov ebp, r8d
mov rbx, rcx
call fcn.1401156f0
mov qword [rsp + 0x80], rdi
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14011735b
mov r9d, esi
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.WS2_32.dll_send]
mov edi, eax
test eax, eax
jns 0x14011733a
cmp byte [rbx + 0x28], 0
je 0x140117335
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140117303
call fcn.1401163f0
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [rsp + 0x80]
mov rsp, r11
pop r14
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14010fdf0
lea rdx, [0x1404885e8]
lea rcx, [rsp + 0x20]
call fcn.1402b8690
int3