joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002530
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002568
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002570
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002540
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002568
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002570
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140002568
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002570
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002670
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400097e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002690
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002698
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002690
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400026ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400026e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002690
add rax, 0x28
cmp rax, r9
jne 0x1400026d0
xor eax, eax
ret

Function at 0x1400026f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400097e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000270f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002718
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000270f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400027b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400097e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400027cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400027d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1405b7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1405b71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405b7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b706f
add dl, dl
jne 0x1405b7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b70f6
xor eax, eax
add dl, dl
jne 0x1405b70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405b71ad
add dl, dl
jne 0x1405b70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405b70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405b707e
mov eax, 1
add dl, dl
jne 0x1405b7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405b7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b70fb
sub eax, ebx
mov ebx, 1
jne 0x1405b714c
mov ecx, 1
add dl, dl
jne 0x1405b712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405b7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405b7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405b715d
cmp eax, 0x7d00
jae 0x1405b719b
cmp eax, 0x500
jb 0x1405b7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b707e
cmp eax, 0x7f
ja 0x1405b719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405b707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405b71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405b707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400062c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov rdi, r8
mov r10d, edx
mov rsi, rcx
mov ebp, edx
test edx, edx
je 0x14000633c
mov ebx, 0x1000
nop dword [rax + rax]
cmp r9d, ebx
jae 0x140006362
mov dword [rdi + r9*4], r10d
mov eax, r10d
mov rcx, qword [rsi + 0xb8]
inc r9d
shr eax, 9
mov r11, qword [rcx]
mov rdx, qword [r11 + rax*8]
test rdx, rdx
je 0x14000633c
mov r8d, r10d
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 0x18
cmp rcx, r8
je 0x140006354
inc eax
and eax, 0x7fff
mov rdx, qword [r11 + rax*8]
test rdx, rdx
jne 0x140006320
mov eax, r9d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r10d, edx
and r10d, 0xffffff
jne 0x1400062f0
jmp 0x14000633c
mov eax, r9d
dec r9d
test eax, eax
je 0x140006372
cmp dword [rdi + r9*4], r10d
jne 0x140006362
mov eax, r9d
not eax
test eax, eax
je 0x140006398
sub ebx, r9d
lea rcx, str.illegal__4d_cycle_from_node__d_n
mov edx, ebx
mov r8d, ebp
call fcn.1400063b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.maximum_path_length_exceeded_n
call fcn.1400063b0
xor eax, eax
jmp 0x14000633f
Function at 0x14000cc60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor eax, eax
mov dword [r8], esi
mov rbx, r8
mov r11, qword [rcx + 8]
mov rdi, rcx
mov r10d, edx
cmp dword [r11 + rsi*4], 0x8000000
jae 0x14000ccc6
mov r8d, eax
mov r9d, 0x1000
nop word [rax + rax]
inc r8
mov ecx, r10d
inc eax
mov r10d, dword [r11 + rcx*4]
lea rdx, [rbx + r8*4]
cmp r8, r9
jge 0x14000cce0
mov dword [rdx], r10d
mov r11, qword [rdi + 8]
cmp dword [r11 + r10*4], 0x8000000
jb 0x14000cca0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, eax
lea rdx, [rdx - 4]
dec eax
test ecx, ecx
je 0x14000ccf1
cmp dword [rdx], r10d
jne 0x14000cce0
test eax, eax
jns 0x14000cd03
lea rcx, str.maximum_path_length_exceeded_n
call fcn.1400080e0
jmp 0x14000cd18
sub r9d, eax
lea rcx, str.illegal___4d_cycle_from_node__d_n
mov edx, r9d
mov r8d, esi
call fcn.1400080e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14000d1c0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1400b44c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov eax, dword [0x1400b4150]
mov ebx, 0x40
mov dword [r11 - 0x60], eax
mov esi, edx
mov eax, dword [0x1400b4154]
mov rbp, r8
mov dword [r11 - 0x5c], eax
mov r14, rcx
mov eax, dword [0x1400b4158]
mov dword [r11 - 0x58], eax
mov eax, dword [0x1400b415c]
mov dword [r11 - 0x54], eax
mov eax, dword [0x1400b4160]
mov dword [r11 - 0x50], eax
mov eax, dword [0x1400b4164]
mov dword [r11 - 0x4c], eax
mov eax, dword [0x1400b4168]
mov dword [r11 - 0x48], eax
mov eax, dword [0x1400b416c]
mov dword [r11 - 0x44], eax
xor eax, eax
cmp edx, ebx
mov qword [rsp + 0x20], rax
cmovb ebx, edx
mov rdx, rcx
mov r8d, ebx
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x24]
add ecx, esi
cmp ecx, 0x40
jae 0x14000d26d
mov dword [rsp + 0x24], ecx
jmp 0x14000d2d8
sub esi, ebx
mov qword [rsp + 0x128], rdi
mov edi, esi
lea rdx, [rsp + 0x28]
mov r8d, 1
shr edi, 6
lea rcx, [rsp + 0x20]
add rbx, r14
call fcn.14000d550
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14000d550
mov edx, edi
lea rcx, [rsp + 0x28]
shl edx, 6
and esi, 0x3f
add rdx, rbx
mov r8d, esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x20]
shl edi, 6
add ecx, 0x40
add ecx, edi
mov dword [rsp + 0x24], esi
mov rdi, qword [rsp + 0x128]
mov dword [rsp + 0x20], ecx
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000d310
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14007a0e0
add rsp, 0xe0
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x140015b20
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1400b44c0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1400b88d8], eax
inc eax
cmp eax, 1
jne 0x140015b6f
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400b88dc], eax
test bl, bl
je 0x140015c13
xor ebx, ebx
lock xadd dword [0x1400b88dc], ebx
test ebx, ebx
je 0x140015c13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1400b4048]
lea rsi, [0x1400b4040]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x140015bc8
mov rax, qword [0x1400b4040]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140015bca
mov al, 1
lea rcx, str.C:_Boost_boost_1_85_0_include_boost_1_85_boost_asio_detail_impl_winsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x140015c37
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14007a0e0
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140021dd0
int3
Function at 0x14001b490
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14001b4f1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14001b4b0
mov ecx, dword [r9]
jmp 0x14001b5db
cmp ecx, 0x4e0
jb 0x14001b5db
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14001b510
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14001b560
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14001f130
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x14001f306
mov qword [rsp + 0x98], rbx
test r8b, r8b
je 0x14001f19c
movzx eax, byte [rdx]
test al, 8
je 0x14001f19c
or al, 8
mov dword [rbp + 0x30], r12d
mov byte [rdx], al
lea r9, [rbp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x18]
setne dl
call fcn.140022950
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140022950
test ebx, ebx
je 0x14001f302
mov qword [rsp + 0xa0], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0xa8], r14
lea r13, [0x1400b4040]
mov r14, qword [0x1400b4048]
add rcx, r14
mov dword [rbp - 0x2c], r12d
cmp rcx, 1
jbe 0x14001f20c
mov rax, qword [0x1400b4040]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov r14, qword [0x1400b4048]
jmp 0x14001f20e
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x2733
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14001b2e0
test al, al
jne 0x14001f2ab
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r12d
add rax, r14
cmp rax, 1
jbe 0x14001f271
mov rax, qword [0x1400b4040]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x14001f273
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x18]
add rax, 2
mov dword [rbp - 0x30], 0x4d5
mov qword [rbp - 0x20], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x20]
mov qword [rbp - 0x28], r13
movups xmm0, xmmword [rbp - 0x30]
movsd qword [rbp - 8], xmm1
movups xmmword [rbp - 0x18], xmm0
call fcn.14001b2e0
test al, al
je 0x14001f2dc
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.140022950
mov r13, qword [rsp + 0xa0]
mov eax, ebx
mov r14, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x14001f2ee
mov eax, r12d
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020170
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x1400201fb
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x1400b4048]
lea rbx, [0x1400b4040]
cmp rcx, 1
jbe 0x1400201bd
mov rax, qword [0x1400b4040]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x1400201bf
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], 0x2719
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.140022950
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140023bf0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1400b8a34], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x140023c51
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.140011b00]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x140029480
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbx, qword [rsp + 0xa0]
xor r14d, r14d
mov qword [rax - 0x48], r14
mov qword [rax - 0x50], r14
mov dword [rax - 0x58], r9d
lea r9, [rax + 0x20]
mov dword [rax + 0x20], r14d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1400b4048]
lea rbp, [0x1400b4040]
movabs r15, 0x4d54ee85da812030
mov dword [rsp + 0x44], r14d
add rdx, r15
mov edi, eax
cmp rdx, 1
jbe 0x140029502
mov rcx, qword [0x1400b4040]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, rbp
call r8
jmp 0x140029507
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x48], rbp
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x14002954a
mov eax, dword [rbx]
mov r8d, eax
jmp 0x14002957a
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x1400295bc
mov rcx, qword [0x1400b4048]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x1400295b0
mov rax, qword [0x1400b4040]
mov edx, 0x2746
mov rcx, rbp
call qword [rax + 0x30]
mov dword [rsp + 0x40], 0x2746
jmp 0x14002962b
mov al, 1
mov dword [rsp + 0x40], 0x2746
jmp 0x14002962b
cmp r9, 1
jne 0x1400295ef
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x14002964f
mov rcx, qword [0x1400b4048]
add rcx, r15
mov dword [rsp + 0x44], r14d
cmp rcx, 1
jbe 0x140029621
mov rax, qword [0x1400b4040]
mov edx, 0x274d
mov rcx, rbp
call qword [rax + 0x30]
jmp 0x140029623
mov al, 1
mov dword [rsp + 0x40], 0x274d
movzx eax, al
mov qword [rsp + 0x48], rbp
add rax, 2
movups xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x50], rax
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x14002965a
mov eax, 0xffffffff
jmp 0x140029677
mov eax, dword [rsp + 0x98]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rsp + 0x50], r14
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbx + 0x10], xmm0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140029df0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov esi, ecx
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rax
sete dl
call fcn.140022950
cmp rdi, 0xffffffffffffffff
jne 0x140029e48
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp esi, 0x17
jne 0x140029e76
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov edx, 0x29
mov dword [rsp + 0x20], 4
mov r8d, 0x1b
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14002b890
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400b44c0]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, r9
mov rsi, rcx
call fcn.140020170
mov rbx, qword [0x1400b4048]
lea r14, [0x1400b4040]
xor r15d, r15d
movabs r12, 0x4d54ee85da812030
mov dword [rsp + 0x34], r15d
lea rax, [rbx + r12]
cmp rax, 1
jbe 0x14002b90b
mov rax, qword [0x1400b4040]
mov edx, 0x2734
mov rcx, r14
call qword [rax + 0x30]
mov rbx, qword [0x1400b4048]
jmp 0x14002b90d
mov al, 1
movzx eax, al
lea rdx, [rsp + 0x50]
add rax, 2
mov dword [rsp + 0x30], 0x2734
mov qword [rsp + 0x40], rax
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movsd qword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x50], xmm0
call fcn.14001b2e0
test al, al
jne 0x14002b9bd
lea rax, [rbx + r12]
mov dword [rsp + 0x34], r15d
cmp rax, 1
jbe 0x14002b977
mov rax, qword [0x1400b4040]
mov edx, 0x2733
mov rcx, r14
call qword [rax + 0x30]
mov rbx, qword [0x1400b4048]
jmp 0x14002b979
mov al, 1
movzx eax, al
lea rdx, [rsp + 0x50]
add rax, 2
mov dword [rsp + 0x30], 0x2733
mov qword [rsp + 0x40], rax
mov rcx, rdi
movsd xmm1, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
movups xmm0, xmmword [rsp + 0x30]
movsd qword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x50], xmm0
call fcn.14001b2e0
test al, al
je 0x14002baec
cmp rsi, 0xffffffffffffffff
jne 0x14002ba00
lea rax, [rbx + r12]
mov dword [rsp + 0x34], r15d
cmp rax, 1
jbe 0x14002b9f1
mov rax, qword [0x1400b4040]
mov edx, 0x2719
mov rcx, r14
call qword [rax + 0x30]
mov dword [rsp + 0x30], 0x2719
jmp 0x14002bac8
mov al, 1
mov dword [rsp + 0x30], 0x2719
jmp 0x14002bac8
lea ecx, [rsi + 1]
mov qword [rbp + 0x188], rsi
lea r9, [rsp + 0x70]
mov dword [rbp + 0x180], 1
lea r8, [rbp + 0x180]
mov qword [rsp + 0x78], rsi
xor edx, edx
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.WS2_32.dll_select]
mov edx, eax
mov rcx, rdi
shr edx, 0x1f
mov ebx, eax
call fcn.140022950
test ebx, ebx
js 0x14002baec
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x48], r15d
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x4c], 4
mov r8d, 0x1007
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.140022950
cmp ebx, 0xffffffff
je 0x14002baec
mov rcx, qword [0x1400b4048]
mov ebx, dword [rsp + 0x48]
add rcx, r12
mov dword [rsp + 0x34], r15d
cmp rcx, 1
jbe 0x14002babf
mov rax, qword [0x1400b4040]
mov edx, ebx
mov rcx, r14
call qword [rax + 0x30]
jmp 0x14002bac4
test ebx, ebx
setne al
mov dword [rsp + 0x30], ebx
movzx eax, al
mov qword [rsp + 0x38], r14
add rax, 2
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14007a0e0
add rsp, 0x4a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret