joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800360c0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x18003626f
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.18002b9a0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x180036262
movabs rcx, 0x100000001b3
movabs rdx, 0xcbf29ce484222325
jmp 0x180036161
mov qword [r9 + r10*8], r8
mov qword [r9 + rbx*8], r8
cmp rax, rdi
je 0x180036262
mov r8, rax
mov rax, qword [rax]
movzx r9d, byte [r8 + 0x10]
xor r9, rdx
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x12]
xor r9, r10
imul r9, rcx
movzx r11d, byte [r8 + 0x13]
xor r11, r9
imul r11, rcx
and r11, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11*2 + 1]
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x180036150
mov r14, qword [r9 + rbx*8]
mov ebp, dword [r8 + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x180036200
mov r10, qword [r14]
cmp r10, r8
je 0x180036154
mov r11, qword [r8 + 8]
mov qword [r11], rax
mov r14, qword [rax + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], r8
mov qword [r10 + 8], r14
mov qword [rax + 8], r11
mov qword [r8 + 8], r15
jmp 0x180036154
cmp r11, r14
je 0x180036238
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x180036200
mov r9, qword [r14]
mov r10, qword [r8 + 8]
mov qword [r10], rax
mov r11, qword [rax + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r8
mov qword [r9 + 8], r11
mov qword [rax + 8], r10
mov qword [r8 + 8], rbx
jmp 0x180036158
mov rbx, qword [r8 + 8]
mov qword [rbx], rax
mov r14, qword [rax + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], r8
mov qword [r11 + 8], r14
mov qword [rax + 8], rbx
mov qword [r8 + 8], r15
mov qword [r9 + r10*8], r8
jmp 0x180036158
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800ab8c8
int3
Function at 0x1800383c0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1800384dc
mov rsi, rcx
mov r8, qword [rcx + 8]
mov rcx, qword [rcx + 0x38]
shr rcx, 3
cmp rcx, rax
jbe 0x180038409
mov rdx, qword [r8]
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.180038510
mov rax, qword [r8 + 8]
mov qword [rax], 0
mov rdi, qword [r8]
test rdi, rdi
jne 0x180038435
jmp 0x18003844d
mov edx, 0x28
mov rcx, rdi
call fcn.1800aa400
mov rdi, rbx
test rbx, rbx
je 0x180038449
mov rbx, qword [rdi]
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x180038420
mov rcx, qword [rdi + 0x18]
call rax
jmp 0x180038420
mov r8, qword [rsi + 8]
mov qword [r8], r8
mov qword [r8 + 8], r8
mov qword [rsi + 0x10], 0
mov rdx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x20]
cmp rdx, rax
je 0x1800384dc
mov rcx, qword [rsi + 8]
mov r9, rax
sub r9, rdx
add r9, 0xfffffffffffffff8
cmp r9, 0x18
jae 0x180038482
mov r8, rdx
jmp 0x1800384d0
shr r9, 3
inc r9
mov r10, r9
and r10, 0xfffffffffffffffc
lea r8, [rdx + r10*8]
movq xmm0, rcx
pshufd xmm0, xmm0, 0x44
xor r11d, r11d
nop word cs:[rax + rax]
movdqu xmmword [rdx + r11*8], xmm0
movdqu xmmword [rdx + r11*8 + 0x10], xmm0
add r11, 4
cmp r10, r11
jne 0x1800384b0
cmp r9, r10
je 0x1800384dc
nop dword [rax + rax]
mov qword [r8], rcx
add r8, 8
cmp r8, rax
jne 0x1800384d0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x180038510
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
cmp rdx, r8
je 0x18003861f
mov rsi, r8
mov rdi, rcx
mov rax, qword [rcx + 8]
mov qword [rbp - 0x10], rax
mov rdx, qword [rcx + 0x18]
movzx eax, byte [rbx + 0x10]
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r8, 0x100000001b3
imul rax, r8
movzx ecx, byte [rbx + 0x11]
xor rcx, rax
imul rcx, r8
movzx eax, byte [rbx + 0x12]
xor rax, rcx
imul rax, r8
movzx ecx, byte [rbx + 0x13]
xor rcx, rax
imul rcx, r8
and rcx, qword [rdi + 0x30]
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rax
lea rax, [rcx + rcx]
lea r8, [rcx*2 + 1]
mov qword [rbp - 0x28], r8
shl rcx, 4
lea r8, [rdx + rcx]
mov qword [rbp - 0x18], r8
mov r12, qword [rdx + rcx]
mov qword [rbp - 8], rdx
mov r15, qword [rdx + rax*8 + 8]
mov r14, rbx
jmp 0x1800385d8
mov r14, r13
cmp r13, rsi
je 0x180038612
mov r13, qword [r14]
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x1800385ea
mov rcx, qword [r14 + 0x18]
call rax
mov edx, 0x28
mov rcx, r14
call fcn.1800aa400
dec qword [rdi + 0x10]
cmp r14, r15
je 0x180038636
cmp r13, rsi
jne 0x1800385d0
cmp r12, rbx
jne 0x1800385d0
mov r12, qword [rbp - 0x18]
mov qword [r12], rsi
mov rax, qword [rbp - 0x20]
mov qword [rax], rsi
mov qword [rsi + 8], rax
jmp 0x180038622
mov rsi, rbx
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp - 0x20]
cmp r12, rbx
jne 0x18003864a
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov qword [rcx], rax
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + rdx*8], rax
cmp r13, rsi
je 0x180038612
movzx eax, byte [r13 + 0x10]
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rdx, 0x100000001b3
imul rax, rdx
movzx ecx, byte [r13 + 0x11]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r13 + 0x12]
xor rax, rcx
imul rax, rdx
movzx r12d, byte [r13 + 0x13]
xor r12, rax
imul r12, rdx
and r12, qword [rdi + 0x30]
lea rax, [r12 + r12]
lea r14, [r12*2 + 1]
shl r12, 4
mov rcx, qword [rbp - 8]
add r12, rcx
mov r15, qword [rcx + rax*8 + 8]
mov rbx, r13
nop word cs:[rax + rax]
mov r13, qword [rbx]
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x1800386e2
mov rcx, qword [rbx + 0x18]
call rax
mov edx, 0x28
mov rcx, rbx
call fcn.1800aa400
dec qword [rdi + 0x10]
cmp rbx, r15
je 0x180038705
mov rbx, r13
cmp r13, rsi
jne 0x1800386d0
jmp 0x18003860e
mov rax, qword [rbp - 0x10]
mov qword [r12], rax
mov rcx, qword [rbp - 8]
mov qword [rcx + r14*8], rax
cmp r13, rsi
jne 0x18003865b
jmp 0x180038612
Function at 0x180038e90
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x180038f88
cmp qword [rcx + 0x18], 0x10
jb 0x180038ea7
mov rcx, qword [rcx]
mov rax, r8
and rax, 3
je 0x180038ef7
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, byte [rcx + r9]
add r10d, edx
mov r11d, r10d
shl r11d, 0xa
add r11d, r10d
mov edx, r11d
shr edx, 6
xor edx, r11d
inc r9
cmp rax, r9
jne 0x180038ec0
add rcx, r9
mov rax, r8
sub rax, r9
cmp r8, 4
jae 0x180038f04
jmp 0x180038f88
mov rax, r8
cmp r8, 4
jb 0x180038f88
xor r8d, r8d
nop word [rax + rax]
movzx r9d, byte [rcx + r8]
add r9d, edx
mov edx, r9d
shl edx, 0xa
add edx, r9d
mov r9d, edx
shr r9d, 6
xor r9d, edx
movzx edx, byte [rcx + r8 + 1]
add edx, r9d
mov r9d, edx
shl r9d, 0xa
add r9d, edx
mov edx, r9d
shr edx, 6
xor edx, r9d
movzx r9d, byte [rcx + r8 + 2]
add r9d, edx
mov edx, r9d
shl edx, 0xa
add edx, r9d
mov r9d, edx
shr r9d, 6
xor r9d, edx
movzx edx, byte [rcx + r8 + 3]
add edx, r9d
mov r9d, edx
shl r9d, 0xa
add r9d, edx
mov edx, r9d
shr edx, 6
xor edx, r9d
add r8, 4
cmp rax, r8
jne 0x180038f10
lea eax, [rdx + rdx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
ret
Function at 0x18003d8b0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
cmp qword [rcx + 0x18], 8
jb 0x18003d8c6
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor ebx, ebx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x18003d98e
mov rsi, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18003d99b
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
test rax, rax
je 0x18003d97e
mov r9, rax
shr r9, 0x20
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
xor ebx, ebx
mov rcx, rsi
xor edx, edx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x18003d985
mov r14, rax
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003d985
lea rbx, [0x18014fc14]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
xor ebx, ebx
jmp 0x18003d985
Function at 0x180046940
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rax, [r8 + 2]
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
mov r15, rdx
add r15, rdx
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
and r15, 0xfffffffffffffffc
js 0x180046bab
mov ebx, r9d
mov r14, r8
cmp r15, 0xf
ja 0x180046ab5
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], recvfrom
mov rcx, rsi
xor edx, edx
mov r8, r15
call fcn.1800d85b0
add r15, rsi
mov r12, r15
mov byte [r12], 0
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x1800469cf
mov rax, qword [rsi]
mov rcx, qword [rbp + 0x70]
cmp r14, 3
jb 0x180046aee
lea r8, [r14 - 2]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, byte [rdi + rdx]
shr r9d, 2
movzx r9d, byte [rcx + r9]
mov byte [rax], r9b
movzx r9d, byte [rdi + rdx]
shl r9d, 4
and r9d, 0x30
movzx r10d, byte [rdi + rdx + 1]
shr r10d, 4
or r10d, r9d
movzx r9d, byte [rcx + r10]
mov byte [rax + 1], r9b
movzx r9d, byte [rdi + rdx + 1]
and r9d, 0xf
movzx r10d, byte [rdi + rdx + 2]
shr r10d, 6
lea r9d, [r10 + r9*4]
movzx r9d, byte [rcx + r9]
mov byte [rax + 2], r9b
movzx r9d, byte [rdi + rdx + 2]
and r9d, 0x3f
movzx r9d, byte [rcx + r9]
mov byte [rax + 3], r9b
add rax, 4
add rdx, 3
cmp rdx, r8
jb 0x1800469f0
cmp rdx, r14
jae 0x180046af9
movzx r8d, byte [rdi + rdx]
shr r8d, 2
movzx r8d, byte [rcx + r8]
mov byte [rax], r8b
dec r14
movzx r8d, byte [rdi + rdx]
shl r8d, 4
and r8d, 0x30
cmp rdx, r14
jne 0x180046b41
movzx ecx, byte [rcx + r8]
mov byte [rax + 1], cl
test bl, bl
je 0x180046b74
mov byte [rax + 2], 0x3d
mov byte [rax + 3], 0x3d
jmp 0x180046b97
mov rax, r15
or rax, 0xf
cmp rax, 0x17
mov r13d, socket
cmovae r13, rax
cmp r13, 0xfff
jb 0x180046b02
lea rcx, [r13 + 0x28]
call fcn.1800aa410
mov r12, rax
add r12, 0x27
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x180046b0e
xor edx, edx
cmp rdx, r14
jb 0x180046a6e
test bl, bl
je 0x180046b74
jmp 0x180046b97
lea rcx, [r13 + 1]
call fcn.1800aa410
mov r12, rax
mov qword [rsi], r12
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r13
mov rcx, r12
xor edx, edx
mov r8, r15
call fcn.1800d85b0
add r12, r15
mov byte [r12], 0
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jae 0x1800469cc
jmp 0x1800469cf
movzx r9d, byte [rdx + rdi + 1]
shr r9d, 4
movzx r8d, r8b
or r8, r9
movzx r8d, byte [rcx + r8]
mov byte [rax + 1], r8b
movzx edx, byte [rdx + rdi + 1]
and edx, 0xf
movzx ecx, byte [rcx + rdx*4]
mov byte [rax + 2], cl
test bl, bl
je 0x180046b74
mov byte [rax + 3], 0x3d
jmp 0x180046b97
cmp qword [rsi + 0x18], 0x10
mov rdi, rsi
jb 0x180046b81
mov rdi, qword [rsi]
mov rcx, rdi
call fcn.1800b4830
cmp qword [rsi + 0x10], rax
jb 0x180046bb0
mov qword [rsi + 0x10], rax
mov byte [rdi + rax], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.180008c70
call fcn.18000c8d0
int3
Function at 0x18004b2f0
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x150], xmm6
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov rsi, rcx
mov word [rcx + 8], 1
mov byte [rcx + 0xa], 0
xorps xmm6, xmm6
movups xmmword [rcx + 0x10], xmm6
mov qword [rcx + 0x20], 0
lea rax, [0x1800dbe78]
mov qword [rcx], rax
mov qword [rcx + 0x30], 0xffffffffffffffff
movups xmmword [rcx + 0x38], xmm6
mov word [rcx + 0x48], 0
add rcx, 0x50
mov dword [rbp - 0x58], 0
lea rdx, [rbp - 0x58]
lea r8, [rbp + 0x147]
call fcn.180037fb0
mov word [rsi + 0x90], 0
mov byte [rsi + 0x92], 0
movups xmmword [rsi + 0x98], xmm6
mov qword [rsi + 0xa8], 0
mov qword [rsi + 0xb0], recvfrom
movups xmmword [rsi + 0xb8], xmm6
movups xmmword [rsi + 0xc8], xmm6
movups xmmword [rsi + 0xd8], xmm6
mov qword [rsi + 0xe8], 0
mov qword [rsi + recvfrom0], 0xf
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
movups xmmword [rsi + 0x128], xmm6
movups xmmword [rsi + 0x138], xmm6
mov qword [rsi + 0x148], recvfrom
movups xmmword [rsi + 0x150], xmm6
mov qword [rsi + 0x160], 0
mov rax, qword [0x180150fb0]
lea rcx, [rax + 1]
mov qword [0x180150fb0], rcx
test rax, rax
jne 0x18004b423
lea rdx, [rbp - 0x58]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x150]
add rsp, 0x1e8
pop rsi
pop rbp
ret

Function at 0x18004b480
Capabilities:
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], 0xfffffffffffffffe
mov rax, qword [0x180150fb0]
lea rcx, [rax + 1]
mov qword [0x180150fb0], rcx
test rax, rax
jne 0x18004b4c0
lea rdx, [rbp - 0x60]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop
add rsp, 0x1c0
pop rbp
ret
Function at 0x18004bc60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x48], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx + 0x38], xmm0
cmp qword [rdx], 0
mov rcx, qword [rcx + 0x30]
jne 0x18004bd22
cmp word [rdi + 8], 0
jne 0x18004bd22
cmp word [rdi + 0xa], 0xffff
jne 0x18004bd22
cmp rcx, 0xffffffffffffffff
jne 0x18004bcd6
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004bd65
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x18004bd65
mov qword [rbp - 0x1c], 0
mov word [rbp - 0x24], 2
movzx eax, word [rdi + 0x10]
mov word [rbp - 0x22], ax
mov eax, dword [rdi + 0xc]
mov dword [rbp - 0x20], eax
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x24]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
jmp 0x18004bda1
cmp rcx, 0xffffffffffffffff
jne 0x18004bd4b
mov ecx, reloc.WS2_32.dll_socket
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004bd65
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x18004bd69
xor eax, eax
jmp 0x18004bda3
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov word [rbp - 0x24], reloc.WS2_32.dll_socket
movzx eax, word [rdi + 0x10]
mov word [rbp - 0x22], ax
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x1c], xmm0
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x24]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_connect]
mov al, 1
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004c000
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x18004c05c
cmp edi, 1
mov eax, 6
mov r8d, reloc.WS2_32.dll_recvfrom
cmove r8d, eax
mov ecx, reloc.WS2_32.dll_socket
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004c107
rol r14w, 8
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov word [rsi + 0x48], r14w
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov word [rbp - 0x2c], reloc.WS2_32.dll_socket
mov word [rbp - 0x2a], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x24], xmm0
mov dword [rbp - 0xc], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18004c107
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x2c]
mov r8d, 0x1c
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x18004c107
cmp edi, 1
jne 0x18004c0e6
mov rcx, qword [rsi + 0x30]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x18004c107
mov dword [rbp - 0x10], 1
mov rcx, qword [rsi + 0x30]
lea r8, [rbp - 0x10]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
jmp 0x18004c109
xor eax, eax
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x18004c1b0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, r9
mov r14d, r8d
mov edi, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x18004c20c
cmp edi, 1
mov eax, 6
mov r8d, reloc.WS2_32.dll_recvfrom
cmove r8d, eax
mov ecx, 2
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov qword [rsi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004c2b2
rol r14w, 8
xorps xmm0, xmm0
movups xmmword [rsi + 0x38], xmm0
mov word [rsi + 0x48], r14w
mov qword [rbp - 0x18], 0
mov word [rbp - 0x20], 2
mov word [rbp - 0x1e], r14w
mov eax, dword [rbx + 0xc]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0xc], 1
mov dword [rsp + 0x20], 4
lea r9, [rbp - 0xc]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18004c2b2
mov rcx, qword [rsi + 0x30]
lea rdx, [rbp - 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x18004c2b2
cmp edi, 1
jne 0x18004c291
mov rcx, qword [rsi + 0x30]
mov edx, 0x64
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x18004c2b2
mov dword [rbp - 0x10], 1
mov rcx, qword [rsi + 0x30]
lea r8, [rbp - 0x10]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
sete al
jmp 0x18004c2b4
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x18004c380
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
mov r9, rdx
cmp qword [rdx], 0
jne 0x18004c3a3
cmp word [r9 + 8], 0
jne 0x18004c3a3
cmp word [r9 + 0xa], 0xffff
jne 0x18004c3a3
mov edx, 2
jmp fcn.18004c1b0
mov edx, 2
jmp fcn.18004c000

Function at 0x18004f390
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx + 0xc0]
mov rdi, qword [r8 + 0x10]
cmp rax, qword [rcx + 0xc8]
je 0x18004f3d7
cmp qword [r8 + 0x18], 0x10
jb 0x18004f3c5
mov r8, qword [r8]
mov rcx, rsi
mov r9, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp fcn.18004f870
mov eax, edi
rol ax, 8
mov byte [rbp - 0x28], dl
mov word [rbp - 0x27], 0x303
mov word [rbp - 0x25], ax
mov qword [rbp - 0x23], 0
mov dword [rbp - 0x1c], 0
mov qword [rbp - 0x18], 5
mov qword [rbp - 0x10], recvfrom
cmp qword [r8 + 0x18], 0x10
jb 0x18004f413
mov r8, qword [r8]
cmp rdi, 0xa
jbe 0x18004f43d
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x28]
mov rdx, rdi
mov r9, r8
call fcn.18000a400
mov edi, dword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jb 0x18004f463
mov rdx, qword [rbp - 0x28]
jmp 0x18004f467
lea rcx, [rbp - 0x23]
lea rax, [rdi + 5]
mov qword [rbp - 0x18], rax
mov rdx, r8
mov r8, rdi
call fcn.1800d7e70
mov byte [rbp + rdi - 0x23], 0
mov edi, dword [rbp - 0x18]
cmp qword [rbp - 0x10], 0x10
jae 0x18004f437
lea rdx, [rbp - 0x28]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rax, qword [rbp - 0x10]
cmp rax, 0x10
jb 0x18004f4b4
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x18004f4af
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x18004f4c1
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1800aa400
cmp esi, edi
sete al
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.1800b3cac
int3

Function at 0x18004f7f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r8, rdx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x18004f829
mov dl, reloc.WS2_32.dll_socket
mov r9, rsi
add rsp, 0x28
pop rsi
pop rbp
jmp fcn.18004f870
mov rcx, qword [rcx + 0x30]
mov rdx, r8
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, esi
sete al
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x18004f870
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, r8
mov bl, dl
mov rsi, rcx
add rcx, 0xb8
mov qword [rsp + 0x20], r9
lea rdx, [rbp - 0x38]
mov r8d, ebx
mov r9, rax
call fcn.180084a50
mov word [rbp - 5], 0x303
mov byte [rbp - 6], bl
movzx eax, word [rbp - 0x30]
mov word [rbp - 2], ax
mov ecx, 5
call fcn.18008aec0
lea rdx, [rbp - 5]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 5
mov byte [rbp - 0x18], 0
lea rcx, method.std::codecvt_char__char__struct__Mbstatet_.virtual_0
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x10], rcx
mov byte [rax], bl
inc qword [rbp - 0x48]
mov rax, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
mov r8d, 1
call qword [rax + ioctlsocket]
test al, al
je 0x18004f965
lea rdx, [rbp - 4]
mov rax, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
mov r8d, 1
call qword [rax + ioctlsocket]
test al, al
je 0x18004f965
cmp byte [rbp - 0x18], 0
je 0x18004f944
lea rdx, [rbp - 2]
mov rax, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
jmp 0x18004f95c
movzx eax, word [rbp - 2]
rol ax, 8
mov word [rbp - 8], ax
mov rax, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 8]
mov r8d, 2
call qword [rax + ioctlsocket]
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x38]
mov r14, qword [rbp - 0x30]
lea rax, [r14 + rdi]
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x28], rax
jb 0x18004f9e8
lea rcx, [rdx + rdi]
mov r8, r14
call fcn.1800d7e70
mov rcx, qword [rbp - 0x38]
mov rdx, rbx
mov r8, rdi
call fcn.1800d7e70
mov edi, dword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18004f9c5
call fcn.1800b7060
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18004f9d3
call fcn.1800b7060
cmp esi, edi
sete al
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov r15, rax
shr r15, 1
add r15, rax
mov rcx, rdx
mov rdx, r15
call fcn.18008af10
mov rdx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], r15
jmp 0x18004f983

Function at 0x18004fbb0
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x48], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx + 0x38], xmm0
cmp qword [rcx + 0x30], 0xffffffffffffffff
jne 0x18004fc28
movzx eax, word [rdi]
or ax, word [rdi + 2]
movzx ecx, word [rdi + 0xa]
not ecx
or cx, word [rdi + 8]
or cx, word [rdi + 6]
or cx, word [rdi + 4]
or cx, ax
mov eax, 2
mov ecx, reloc.WS2_32.dll_socket
cmove ecx, eax
mov edx, 2
mov r8d, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18004fc3e
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.18004fc70
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret