joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010a7e0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.14010d260
jmp fcn.14010f3b0

Function at 0x14010a800
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x14010a990
sub edx, 0x40
je 0x14010a8a2
sub edx, 0x20
je 0x14010a950
sub edx, 0x80
je 0x14010a8e0
cmp edx, 0x80
jne 0x14010a9b7
mov rax, qword [0x1402c1ab0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1402c1ab8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1402c1ac0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1402c1ac8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402c1ad0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1402c1ad8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1402c1ae0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1402c1ae8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x1402c17f0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1402c17f8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1402c1800]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1402c1808]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402c1810]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1402c1818]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1402c1820]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1402c1828]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x14010c7c0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.1401d788c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14010c9cc
mov rcx, rax
call fcn.14002e890
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.140010d30
mov byte [0x1402b9fd0], al
call fcn.14010c2d0
test edi, edi
jle 0x14010c9c7
mov ecx, edi
sub ecx, 0xa0
je 0x14010c9a0
sub ecx, 0x40
je 0x14010c960
sub ecx, 0x20
je 0x14010c920
sub ecx, 0x80
je 0x14010c8b0
cmp ecx, 0x80
jne 0x14010c9c7
mov rax, qword [0x1402c1ab0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1402c1ab8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1402c1ac0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1402c1ac8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1402c1ad0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1402c1ad8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1402c1ae0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1402c1ae8]
jmp 0x14010c904
mov rax, qword [0x1402c17f0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1402c17f8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1402c1800]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1402c1808]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1402c1810]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1402c1818]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1402c1820]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1402c1828]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x14010c9c7
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x14010c9c3
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x14010c9c3
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x14010c9cf
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14010ca00
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, pe_nt_image_headers64
jmp fcn.14010c7c0
Function at 0x140112ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140112cd8
xor al, al
jmp 0x140112db0
lea rcx, [rsp + 0x20]
call fcn.1401121e0
test edi, edi
je 0x140112cfe
test rbx, rbx
je 0x140112cfe
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140113590
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x140112d4d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140112d60
lea rcx, [rsp + 0x30]
call fcn.1401122e0
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable._ckSha3.0
mov qword [rsp + 0x20], rax
call fcn.14002e9a0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d75d0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140112e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140112e58
xor al, al
jmp 0x140112f27
lea rcx, [rsp + 0x20]
call fcn.1401121e0
test edi, edi
je 0x140112e7e
test rbx, rbx
je 0x140112e7e
mov r9b, send
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140113590
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x140112ecd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, send
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140112ee0
lea rcx, [rsp + 0x30]
call fcn.1401122e0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.14002e9a0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d75d0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140112f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140112fc8
xor al, al
jmp 0x1401130a0
lea rcx, [rsp + 0x20]
call fcn.1401121e0
test edi, edi
je 0x140112fee
test rbx, rbx
je 0x140112fee
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140113590
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x14011303d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, recv
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140113050
lea rcx, [rsp + 0x30]
call fcn.1401122e0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.14002e9a0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d75d0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140113110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140113148
xor al, al
jmp 0x140113229
lea rcx, [rsp + 0x20]
call fcn.1401121e0
test edi, edi
je 0x14011316e
test rbx, rbx
je 0x14011316e
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140113590
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x1401131bd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401131d0
lea rcx, [rsp + 0x30]
call fcn.1401122e0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.14002e9a0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401d75d0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401134c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x140113535
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x140113520
test r8b, r8b
je 0x140113555
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140113541
mov rcx, rdi
call fcn.1401122e0
test sil, sil
je 0x140113580
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x140113570
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140113590
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x40], rbp
movzx ecx, byte [rcx + 0x1a0]
mov esi, r8d
mov qword [rsp + 0x50], r14
mov rdi, rdx
movzx r14d, r9b
test cl, cl
je 0x140113657
movzx eax, r14b
movzx r9d, sil
shl al, 3
sub al, cl
movzx r8d, al
cmp r8d, esi
cmovbe r9d, r8d
xor dl, dl
lea r8, [rbx + rcx]
test r9b, r9b
je 0x1401135f7
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + r8 + 0xd8], al
cmp dl, r9b
jb 0x1401135e1
add byte [rbx + 0x1a0], dl
movzx ecx, byte [rbx + 0x1a0]
movzx eax, dl
add rdi, rax
movzx eax, dl
sub esi, eax
mov eax, r14d
shl eax, 3
cmp ecx, eax
jne 0x140113657
test r14b, r14b
je 0x140113644
lea rcx, [rbx + 0x10]
mov rdx, r14
nop word [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140113630
mov rcx, rbx
add rcx, 0x10
call fcn.1401122e0
mov byte [rbx + 0x1a0], 0
mov ebp, r14d
shl ebp, 3
cmp esi, ebp
jb 0x1401136be
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov r12d, ebp
nop
test r14b, r14b
je 0x1401136a2
mov r8, rdi
lea rax, [rbx + 0x10]
sub r8, rbx
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + rax - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140113690
lea rcx, [rbx + 0x10]
call fcn.1401122e0
sub esi, ebp
add rdi, r12
cmp esi, ebp
jae 0x140113670
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test esi, esi
je 0x1401136e7
nop
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + rbx + 0xd8], al
movzx eax, dl
cmp eax, esi
jb 0x1401136d0
add byte [rbx + 0x1a0], dl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x140116200
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x14011620c
mov al, 1
ret
jmp fcn.1400cd600

Function at 0x140117840
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x2a0], 2
je fcn.1401187a0
jmp fcn.1401188b0
Function at 0x140118060
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x14011808f
xor al, al
jmp 0x140118120
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x140118100
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x140118105
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401d75d0
add rsp, 0x80
pop rbx
ret

Function at 0x1401185a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x140118641
mov r8d, dword [rcx + 0xdc]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14011863c
and r8d, 0xfffff000
mov dword [rcx + 0xdc], r8d
cmp byte [rdx + 0x169], 0
je 0x140118615
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_RCVBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xdc]
lea rdx, str.recvBufSize
mov rcx, rsi
call fcn.140051f90
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xdc]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140118650
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x1401186f1
mov r8d, dword [rcx + 0xd8]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x1401186ec
and r8d, 0xfffff000
mov dword [rcx + 0xd8], r8d
cmp byte [rdx + 0x169], 0
je 0x1401186c5
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_SNDBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd8]
lea rdx, str.sendBufSize
mov rcx, rsi
call fcn.140051f90
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xd8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401187a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea r8, str.ck_getsockname_ipv4
mov rdx, r9
lea rcx, [rsp + 0x38]
call fcn.140051790
nop
mov rcx, rsi
call fcn.14003cec0
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x14011886f
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x14011884b
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov rcx, rsi
call fcn.140038b60
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x140118881
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.14011b100
jmp 0x14011887f
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.1400518b0
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401d75d0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401188b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea r8, str.ck_getsockname_ipv6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140051790
nop
mov rcx, rsi
call fcn.14003cec0
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x14011897f
mov dword [rsp + 0x20], 0x1c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x14011895b
mov rcx, rsi
call fcn.14003cec0
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14011a070
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x140118991
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname_ipv6
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.14011b100
jmp 0x14011898f
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.1400518b0
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401d75d0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14011af30
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.1401d7ed0
sub rsp, rax
mov rax, qword [0x1402bc7c0]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140079e50
mov rdx, rbx
mov rcx, rdi
call fcn.140079fd0
test al, al
je 0x14011af9d
mov byte [rdi + 0x29], 1
mov rax, qword [rbx]
lea rdx, str.Wait_for_data_on_socket_aborted_by_app
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x14011b05f
cmp qword [rsi + 0x298], 0xffffffffffffffff
jne 0x14011afc2
mov rax, qword [rbx]
lea rdx, str.Cannot_wait_for_socket_data:_not_connected__invalid_socket_
mov rcx, rbx
call qword [rax + 0x28]
mov byte [rdi + 0x2a], 1
xor al, al
jmp 0x14011b05f
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
call fcn.14002e8c0
lea r15, vtable.ckFdSet.0
mov qword [rsp + 0x40], r15
mov ebx, 0x3004bc8d
mov dword [rsp + 0x50], ebx
mov dword [rbp + 0xfe0], ebx
mov dword [rsp + 0x58], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf60], xmm0
movups xmmword [rbp + 0xf70], xmm0
movups xmmword [rbp + 0xf80], xmm0
movups xmmword [rbp + 0xf90], xmm0
movups xmmword [rbp + 0xfa0], xmm0
movups xmmword [rbp + 0xfb0], xmm0
movups xmmword [rbp + 0xfc0], xmm0
movups xmmword [rbp + 0xfd0], xmm0
movsxd r9, dword [rsi + 0x298]
test r9d, r9d
jns 0x14011b085
mov byte [rdi + 0x2a], 1
xor bl, bl
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x50], r14d
mov dword [rbp + 0xfe0], r14d
lea rcx, [rsp + 0x40]
call fcn.14002e9a0
movzx eax, bl
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.1401d75d0
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + r14*8 + 0x60], r9
inc dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14011b03f
jne 0x14011b0b7
mov byte [rdi + 0x28], 1
jmp 0x14011b03f
mov bl, 1
jmp 0x14011b041

Function at 0x14011b0c0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xdc]
je 0x14011b0da
mov dword [rcx + 0xdc], edx
test edx, edx
je 0x14011b0da
mov rdx, r8
jmp fcn.1401185a0
ret

Function at 0x14011b0e0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd8]
je 0x14011b0fa
mov dword [rcx + 0xd8], edx
test edx, edx
je 0x14011b0fa
mov rdx, r8
jmp fcn.140118650
ret