joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140097a40
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x140097af1
mov rcx, rbx
call fcn.1400979e0
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140097af1
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x140097adf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov rbx, rax
call fcn.140053eb0
mov r8, rbx
lea rdx, str.UTF_16LE
lea rcx, [0x1402212c4]
lea r9, [rax*2 + 2]
call fcn.140085230
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
test rbx, rbx
je 0x140097af1
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Couldnt_get_clipboard_data
call fcn.1400978b0
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rcx, [0x140346534]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400533c0

Function at 0x1400985a0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rdi, rdx
lea r8, [rcx + 0x70]
mov rbp, rcx
mov edx, eax
mov rcx, rdi
mov r9d, 0x3e
call sub.IMM32.dll_ImmGetCompositionStringW
xor r14d, r14d
mov ebx, eax
test eax, eax
mov edx, 0x80
mov rcx, rdi
cmovs ebx, r14d
xor r9d, r9d
xor r8d, r8d
shr ebx, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx ecx, ax
mov dword [rbp + 0xd0], ecx
cmp ecx, 0x20
jae 0x14009863a
mov edx, 0x3000
cmp word [rbp + rcx*2 + 0x70], dx
jne 0x14009863a
lea eax, [rcx + 1]
mov ecx, ebx
mov edx, eax
cmp rdx, rcx
jae 0x140098638
mov qword [rsp + 0x30], rsi
lea rdi, [rbp + 0x6e]
lea rsi, [rbp + 0x70]
sub rcx, rdx
lea rsi, [rsi + rax*2]
lea rdi, [rdi + rax*2]
rep movsw word [rdi], word [rsi]
mov rsi, qword [rsp + 0x30]
dec ebx
mov rdi, qword [rsp + 0x48]
movsxd rax, ebx
mov rbx, qword [rsp + 0x38]
mov word [rbp + rax*2 + 0x70], r14w
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140099530
Capabilities:
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp qword [0x140377e60], rax
movzx r8d, ax
mov qword [rbx + 0x1520], rax
je 0x1400995bf
mov edx, r8d
mov qword [0x140377e60], rax
and edx, 0x3ff
sub edx, 4
je 0x140099592
sub edx, 0xd
je 0x140099582
cmp edx, 1
jne 0x1400995bf
xor ecx, ecx
mov dword [rbx + 0x14ec], ecx
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x14ec], 1
add rsp, 0x20
pop rbx
ret
mov eax, 0xfc00
mov dword [rbx + 0x14ec], 1
and r8w, ax
xor ecx, ecx
mov eax, dword [rbx + 0x14ec]
mov edx, 0x800
cmp r8w, dx
cmove eax, ecx
mov dword [rbx + 0x14ec], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140099bb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x590]
xor edi, edi
xor edx, edx
mov r8d, 0x1400
lea rcx, [rbx + 0xd8]
mov dword [rbx + 0x38], edi
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
mov dword [rbx + 0x50], edi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov word [rbx + 0x70], di
mov word [rbx + 0xb0], di
mov qword [rbx + 0xd0], rdi
call fcn.140053310
lea rcx, [rbx + 0x14f4]
mov qword [rbx + 0x14d8], rdi
xor edx, edx
mov qword [rbx + 0x14e0], rdi
lea r8d, [rdi + 0x10]
mov dword [rbx + 0x14e8], edi
mov qword [rbx + 0x14ec], 1
call fcn.140053310
lea rcx, [rbx + 0x1504]
xor edx, edx
lea r8d, [rdi + 0x10]
call fcn.140053310
mov qword [rbx + 0x1514], rdi
mov qword [rbx + 0x1520], rdi
mov qword [rbx + 0x1528], rdi
mov qword [rbx + 0x1530], rdi
mov qword [rbx + 0x1538], rdi
mov qword [rbx + 0x1540], rdi
mov qword [rbx + 0x1548], rdi
mov qword [rbx + 0x1550], rdi
mov qword [rbx + 0x1558], rdi
mov dword [rbx + 0x1560], edi
mov qword [rbx + 0x1568], rdi
mov qword [rbx + 0x1570], 0xffffffffffffffff
mov qword [rbx + 0x1578], 0xffffffffffffffff
mov qword [rbx + 0x1580], rdi
mov qword [rbx + 0x1588], rdi
call fcn.140099f70
lea rdx, str.Menu
lea ecx, [rdi + 0x65]
call fcn.1400713a0
lea rdx, str.Left_Windows
mov ecx, 0xe3
call fcn.1400713a0
lea rdx, str.Right_Windows
mov ecx, 0xe7
call fcn.1400713a0
lea ecx, [rdi + 0x14]
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edx, ax
mov ecx, 0x2000
and edx, 1
call fcn.1400713c0
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edx, ax
mov ecx, 0x1000
and edx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400713c0
Function at 0x140099d40
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
lea ecx, [rdx + 0x20]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
test eax, eax
je 0x140099dce
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
xor esi, esi
mov ebx, esi
nop dword [rax + rax]
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov edx, edi
mov ecx, 0x20
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jg 0x140099dbe
inc ebx
cmp ebx, 5
jl 0x140099d90
mov rbx, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x160
pop rdi
ret

Function at 0x140099f70
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x830
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x820], rax
lea rcx, [rsp + 0x20]
call fcn.1400708f0
xor ebx, ebx
mov qword [rsp + 0x840], rdi
lea rsi, [0x140240700]
nop word [rax + rax]
movsxd rcx, dword [rsi]
test ecx, ecx
je 0x14009a003
lea rdi, [rsp + 0x20]
test dword [rdi + rcx*4], 0x40000000
lea rdi, [rdi + rcx*4]
jne 0x14009a003
lea eax, [rcx - 0x1e]
cmp eax, 9
jbe 0x14009a003
mov edx, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x14009a003
mov edx, 2
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
and eax, 0x7fff
je 0x14009a003
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x14009a001
add eax, 0x20
mov dword [rdi], eax
inc ebx
add rsi, 4
cmp ebx, 0x80
jb 0x140099fb0
mov r8d, 0x200
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140071310
mov rdi, qword [rsp + 0x840]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140158fa0
mov rbx, qword [rsp + 0x848]
add rsp, 0x830
pop rsi
ret

Function at 0x1400a1ae0
Capabilities:
Capture microphone audio

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov ebp, edx
xor edx, edx
mov rbx, rcx
mov rcx, rsi
mov edi, r9d
lea r8d, [rdx + 0x12]
call fcn.140053310
movzx eax, word [rbx + 0xc]
mov ecx, 0x100
and ax, cx
mov dword [rsp + 0x28], 1
mov ecx, 0x80
xor r9d, r9d
or ax, cx
mov r8, rsi
shr ax, 7
mov ecx, 0xff
mov word [rsi], ax
and cx, word [rbx + 0xc]
mov word [rsi + 0xe], cx
movzx eax, byte [rbx + 0xe]
shr cx, 3
mov word [rsi + 2], ax
mov edx, dword [rbx + 8]
xor ebx, ebx
movzx ecx, cx
imul ecx, eax
mov dword [rsi + 4], edx
mov qword [rsp + 0x20], rbx
movzx eax, cx
xor ecx, ecx
mov word [rsi + 0xc], ax
imul eax, edx
mov edx, ebp
mov dword [rsi + 8], eax
test edi, edi
je 0x1400a1b7f
call qword [sym.imp.WINMM.dll_waveInOpen]
jmp 0x1400a1b85
call qword [sym.imp.WINMM.dll_waveOutOpen]
mov rbp, qword [rsp + 0x48]
test eax, eax
mov rsi, qword [rsp + 0x50]
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a71e0
Capabilities:
Register raw input devices

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
lea rax, [rsp + 0x22]
lea r9, reloc.WS2_32.dll_getpeername
mov ebx, 1
nop word [rax + rax]
movzx edx, word [r9]
inc r8d
mov word [rax], dx
lea r9, [r9 + 2]
mov word [rax - 2], bx
mov dword [rax + 2], 0x2100
mov qword [rax + 6], rcx
lea rax, [rax + 0x10]
cmp r8d, ebx
jb 0x1400a7200
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
mov edx, ebx
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400a7251
lea rcx, str.Couldnt_register_for_raw_input_events
call fcn.140052570
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400a72f0
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
xor r10d, r10d
lea rax, [rsp + 0x22]
mov r8d, r10d
lea r9, reloc.WS2_32.dll_getpeername
mov edx, 1
nop dword [rax + rax]
movzx ecx, word [r9]
inc r8d
mov word [rax], cx
lea r9, [r9 + 2]
mov word [rax - 2], dx
mov dword [rax + 2], edx
mov qword [rax + 6], r10
lea rax, [rax + 0x10]
cmp r8d, edx
jb 0x1400a7310
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400a7353
lea rcx, str.Couldnt_unregister_for_raw_input_events
call fcn.140052570
add rsp, 0x38
ret
Function at 0x1400dcec0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, [0x140249da0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1403786f8], rax
test rax, rax
je 0x1400dd084
lea rdx, str.HidD_GetAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140378698], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_GetSerialNumberString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786a0], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_GetManufacturerString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786a8], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_GetProductString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786b0], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_SetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786b8], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_GetFeature
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786c0], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_GetIndexedString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786c8], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_GetPreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786d0], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_FreePreparsedData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786d8], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidP_GetCaps
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786e0], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_SetNumInputBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786e8], rax
test rax, rax
je 0x1400dd084
mov rcx, qword [0x1403786f8]
lea rdx, str.HidD_SetOutputReport
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403786f0], rax
test rax, rax
je 0x1400dd084
xor eax, eax
add rsp, 0x28
ret
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x1400dd650
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x140378760], 0
je 0x1400dd66b
inc dword [0x14037875c]
xor eax, eax
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
lea rcx, str.XInput1_4.dll
mov ebx, 0x10004
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140378760], rax
test rax, rax
jne 0x1400dd6e2
lea rcx, str.XInput1_3.dll
mov ebx, 0x10003
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140378760], rax
test rax, rax
jne 0x1400dd6e2
lea rcx, str.binXInput1_3.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140378760], rax
test rax, rax
jne 0x1400dd6e2
lea rcx, str.XInput9_1_0.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140378760], rax
test rax, rax
je 0x1400dd7a7
mov edx, 0x64
mov dword [0x140378758], ebx
mov rcx, rax
mov dword [0x14037875c], 1
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140378738], rax
test rax, rax
jne 0x1400dd727
mov rcx, qword [0x140378760]
lea rdx, str.XInputGetState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140378738], rax
mov rcx, qword [0x140378760]
lea rdx, str.XInputSetState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378760]
lea rdx, str.XInputGetCapabilities
mov qword [0x140378740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378760]
lea rdx, str.XInputGetBatteryInformation
mov qword [0x140378748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140378738], 0
mov qword [0x140378750], rax
je 0x1400dd7a2
cmp qword [0x140378740], 0
je 0x1400dd7a2
cmp qword [0x140378748], 0
je 0x1400dd7a2
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
call fcn.1400dd7c0
mov rbx, qword [rsp + 0x20]
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x1400dd7f0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x140378768], 0
je 0x1400dd80b
inc dword [0x140378770]
xor eax, eax
add rsp, 0x28
ret
lea rcx, str.hid.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140378768], rax
test rax, rax
je 0x1400dd97f
lea rdx, str.HidD_GetManufacturerString
mov dword [0x140378770], 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidD_GetProductString
mov qword [0x14037af10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidD_GetPreparsedData
mov qword [0x14037af08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidD_FreePreparsedData
mov qword [0x14037af00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidP_GetCaps
mov qword [0x14037aef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidP_GetButtonCaps
mov qword [0x14037aef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidP_GetValueCaps
mov qword [0x14037aee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidP_MaxDataListLength
mov qword [0x14037aee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140378768]
lea rdx, str.HidP_GetData
mov qword [0x14037aed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14037af10], 0
mov qword [0x14037aed0], rax
je 0x1400dd97a
cmp qword [0x14037af08], 0
je 0x1400dd97a
cmp qword [0x14037af00], 0
je 0x1400dd97a
cmp qword [0x14037aef8], 0
je 0x1400dd97a
cmp qword [0x14037aef0], 0
je 0x1400dd97a
cmp qword [0x14037aee8], 0
je 0x1400dd97a
cmp qword [0x14037aee0], 0
je 0x1400dd97a
cmp qword [0x14037aed8], 0
je 0x1400dd97a
test rax, rax
jne 0x1400dd804
call fcn.1400dd990
mov eax, 0xffffffff
add rsp, 0x28
ret
Function at 0x14012c9b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x14012c54b
movzx ecx, byte [rbx]
call fcn.14013a680
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x14012c530
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14012c9e6
call fcn.14012cda0
test al, al
jne 0x14012c9e6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14012cd00
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14012c510
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1401362f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140136355
mov dl, 1
call fcn.1401288e0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov qword [rsp + 0x20], rax
mov r8, rbp
mov rax, qword [rdi + 0x718]
mov edx, ebx
mov rcx, rdi
call qword [case.0x1401289aa.0]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1401288e0
mov eax, ebx
jmp 0x140136397
cmp ebx, 2
ja 0x140136395
mov r9, qword [rdi + 0x668]
lea rdx, [0x1402550b8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.140165680
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.140165680
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140136660
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1401366a2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1401367c0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rsp + 0x180]
mov rsi, r9
movsxd rax, edx
mov rdi, r8
mov r15, rcx
mov rbx, qword [rcx + rax*8 + 0x4c0]
call fcn.140136cd0
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], 0
cmp rdi, 0xffffffffffffffff
jne 0x140136872
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14013683e
mov dword [r14], 0x51
xor eax, eax
jmp 0x140136875
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.1401238a0
mov rcx, qword [r15]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1401363b0
mov rcx, qword [r15]
mov dword [rcx + 0x11a0], ebx
mov dword [r14], 0x37
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140158fa0
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140136cd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movsxd rcx, edx
mov rax, qword [rsi + 0x688]
lea rbx, [rcx + 0x28]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x140136dcb
lea rax, [0x1401366e0]
cmp qword [rsi + rcx*8 + 0x4e0], rax
jne 0x140136dcb
cmp qword [rbx], 0
je 0x140136d2d
test rdi, rdi
je 0x140136dcb
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rbp
mov rbp, qword [rsi + rcx*8 + 0x4c0]
xor r9d, r9d
mov rcx, rbp
mov r8, rdx
call fcn.1401481e0
cmp eax, 0xffffffff
je 0x140136dc6
test al, 1
je 0x140136dc6
mov rax, qword [rbx]
test rax, rax
jne 0x140136d9b
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb70]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
mov rax, qword [fcn.14016d320]
call qword [case.0x1401289aa.0]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
test rax, rax
je 0x140136dbe
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140136dc6
add qword [rbx + 0x10], rcx
jmp 0x140136dc6
mov qword [rbx + 8], 0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140137a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x32c], 3
mov rdi, rdx
mov rbx, rcx
jne 0x140137c9f
cmp byte [rcx + 0x64d], 0
mov qword [rsp + 0x260], rsi
jne 0x140137c8f
cmp byte [rcx + 0x664], 0
jne 0x140137c8f
mov rsi, qword [rcx]
lea r8, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x140137b10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x130]
mov ecx, eax
mov ebx, eax
call fcn.1401238a0
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1401363b0
jmp 0x140137c97
xorps xmm0, xmm0
mov dword [rsp + 0x24], 0x80
lea r8, [rsp + 0x24]
mov rcx, rdi
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140137b9a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x130]
mov ecx, eax
mov ebx, eax
call fcn.1401238a0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1401363b0
jmp 0x140137c97
mov edx, dword [rsp + 0x20]
lea rdi, [rbx + 0x3fe]
mov r8, rdi
lea r9, [rbx + 0x42c]
lea rcx, [rsp + 0xb0]
call fcn.140136de0
test al, al
jne 0x140137bfe
call fcn.140164a54
mov ebx, dword [rax]
call fcn.140164a54
mov r8d, 0x100
lea rdx, [rsp + 0x130]
mov ecx, ebx
mov rdi, rax
call fcn.1401238a0
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1401363b0
jmp 0x140137c97
movups xmm0, xmmword [rdi]
mov eax, dword [rdi + 0x28]
lea r9, [rbx + 0x460]
movups xmm1, xmmword [rdi + 0x10]
mov edx, dword [rsp + 0x24]
lea r8, [rbx + 0x430]
movups xmmword [rbx + 0x2f8], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rdi + 0x20]
movups xmmword [rbx + 0x308], xmm1
movsd qword [rbx + 0x318], xmm0
mov dword [rbx + 0x320], eax
movzx eax, word [rdi + 0x2c]
mov word [rbx + 0x324], ax
call fcn.140136de0
test al, al
jne 0x140137c8f
call fcn.140164a54
mov ebx, dword [rax]
call fcn.140164a54
mov r8d, 0x100
lea rdx, [rsp + 0x130]
mov ecx, ebx
mov rdi, rax
call fcn.1401238a0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1401363b0
jmp 0x140137c97
mov rcx, rbx
call fcn.140137670
mov rsi, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140158fa0
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop rdi
ret
Function at 0x140138680
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1403749c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0xf1f], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1401386ef
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, rbx
call fcn.1401364c0
jmp 0x14013877e
mov ecx, dword [rbx + 0xe84]
mov dword [rsp + 0x58], 1
call fcn.1401389e0
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xe88]
call fcn.1401389e0
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, ntohs
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x14013877e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r9d, eax
mov rcx, rbx
call fcn.1401364c0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140158fa0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret