joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050d60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 0x48], 0
je 0x180050f2b
call fcn.18004cdf0
mov rcx, rax
call fcn.18004d5f0
test al, al
je 0x180050f2b
mov rbx, qword [0x1801d4b38]
mov rax, qword [0x1801d4b80]
mov rdx, qword [rax]
mov rax, qword [rbx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4cd0]
mov rcx, rbx
call r9
mov rdx, qword [rbx]
mov r9, qword [rdx + 0xc0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call r9
test al, al
je 0x180050f2b
mov rax, qword [0x1801d4b80]
mov rbx, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b48d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b4180
mov rdi, qword [0x1801d4b38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x180050e52
mov rax, qword [rdi]
mov r9, qword [rax + 0xc0]
xor r8d, r8d
mov rcx, rdi
call r9
test al, al
jne 0x180050e52
mov rax, qword [rdi]
mov r9, qword [rax + 0x330]
mov r8, qword [0x1801d4c48]
mov rdx, qword [rbx]
mov rcx, rdi
call r9
mov rcx, rbx
call fcn.1800b4860
call fcn.18004cdf0
lea rcx, [rax + 0xa0]
lea rdx, [rsp + 0x20]
call fcn.18004e2e0
nop
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
cmp rdi, rbp
je 0x180050f21
movss xmm6, dword [0x1800e7dec]
nop dword [rax]
mov rsi, qword [0x1801d4b38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x180050f14
mov rax, qword [rsi]
mov r9, qword [rax + 0xc0]
xor r8d, r8d
mov rcx, rsi
call r9
test al, al
jne 0x180050f14
mov eax, dword [0x1801cc364]
test eax, eax
je 0x180050ede
cmp eax, 6
je 0x180050ede
mov r8, qword [0x1801d4da0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1800ab5e0
test al, al
setne al
jmp 0x180050ef5
mov r8, qword [0x1801d4da0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.18009a580
test eax, eax
setg al
test al, al
je 0x180050f14
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180050f14
movaps xmm1, xmm6
mov rcx, rbx
call fcn.1800b3cc0
add rdi, 0x38
cmp rdi, rbp
jne 0x180050e90
lea rcx, [rsp + 0x20]
call fcn.18004dee0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800caa50
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rcx + 8]
jmp 0x180050d60
Function at 0x180051060
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 0x48], 0
je 0x180050f2b
call fcn.18004cdf0
mov rcx, rax
call fcn.18004d5f0
test al, al
je 0x180050f2b
mov rbx, qword [0x1801d4b38]
mov rax, qword [0x1801d4b80]
mov rdx, qword [rax]
mov rax, qword [rbx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4cd0]
mov rcx, rbx
call r9
mov rdx, qword [rbx]
mov r9, qword [rdx + 0xc0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call r9
test al, al
je 0x180050f2b
mov rax, qword [0x1801d4b80]
mov rbx, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b48d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b4180
mov rdi, qword [0x1801d4b38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x180050e52
mov rax, qword [rdi]
mov r9, qword [rax + 0xc0]
xor r8d, r8d
mov rcx, rdi
call r9
test al, al
jne 0x180050e52
mov rax, qword [rdi]
mov r9, qword [rax + 0x330]
mov r8, qword [0x1801d4c48]
mov rdx, qword [rbx]
mov rcx, rdi
call r9
mov rcx, rbx
call fcn.1800b4860
call fcn.18004cdf0
lea rcx, [rax + 0xa0]
lea rdx, [rsp + 0x20]
call fcn.18004e2e0
nop
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
cmp rdi, rbp
je 0x180050f21
movss xmm6, dword [0x1800e7dec]
nop dword [rax]
mov rsi, qword [0x1801d4b38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x180050f14
mov rax, qword [rsi]
mov r9, qword [rax + 0xc0]
xor r8d, r8d
mov rcx, rsi
call r9
test al, al
jne 0x180050f14
mov eax, dword [0x1801cc364]
test eax, eax
je 0x180050ede
cmp eax, 6
je 0x180050ede
mov r8, qword [0x1801d4da0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.1800ab5e0
test al, al
setne al
jmp 0x180050ef5
mov r8, qword [0x1801d4da0]
mov rdx, qword [rbx]
mov rcx, rsi
call fcn.18009a580
test eax, eax
setg al
test al, al
je 0x180050f14
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180050f14
movaps xmm1, xmm6
mov rcx, rbx
call fcn.1800b3cc0
add rdi, 0x38
cmp rdi, rbp
jne 0x180050e90
lea rcx, [rsp + 0x20]
call fcn.18004dee0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800caa50
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rcx + 8]
jmp 0x180050d60
Function at 0x180051320
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
cmp byte [rcx + 0x48], 0
je 0x1800514eb
call fcn.18004cdf0
mov rcx, rax
call fcn.18004d5f0
test al, al
je 0x1800514eb
mov rbx, qword [0x1801d4b38]
mov rax, qword [0x1801d4b80]
mov rdx, qword [rax]
mov rax, qword [rbx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4cd0]
mov rcx, rbx
call r9
mov rdx, qword [rbx]
mov r9, qword [rdx + 0xc0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call r9
test al, al
je 0x1800514eb
mov rax, qword [0x1801d4b80]
mov rbx, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b4180
mov rsi, qword [0x1801d4b38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x1800513fe
mov rax, qword [rsi]
mov r9, qword [rax + 0xc0]
xor r8d, r8d
mov rcx, rsi
call r9
test al, al
jne 0x1800513fe
mov rax, qword [rsi]
mov r9, qword [rax + 0x330]
mov r8, qword [0x1801d4c48]
mov rdx, qword [rbx]
mov rcx, rsi
call r9
mov rcx, rbx
call fcn.1800b4860
call fcn.18004cdf0
lea rcx, [rax + 0xa0]
lea rdx, [rsp + 0x20]
call fcn.18004e2e0
nop
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
cmp rbx, rsi
je 0x1800514e1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180051459
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180051482
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800514ab
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800514d4
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
add rbx, 0x38
cmp rbx, rsi
jne 0x180051430
lea rcx, [rsp + 0x20]
call fcn.18004dee0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800caa50
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rcx + 8]
jmp 0x180051320
Function at 0x180051660
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
cmp byte [rcx + 0x48], 0
je 0x1800514eb
call fcn.18004cdf0
mov rcx, rax
call fcn.18004d5f0
test al, al
je 0x1800514eb
mov rbx, qword [0x1801d4b38]
mov rax, qword [0x1801d4b80]
mov rdx, qword [rax]
mov rax, qword [rbx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4cd0]
mov rcx, rbx
call r9
mov rdx, qword [rbx]
mov r9, qword [rdx + 0xc0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call r9
test al, al
je 0x1800514eb
mov rax, qword [0x1801d4b80]
mov rbx, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b4180
mov rsi, qword [0x1801d4b38]
mov rdx, qword [rbx]
test rdx, rdx
je 0x1800513fe
mov rax, qword [rsi]
mov r9, qword [rax + 0xc0]
xor r8d, r8d
mov rcx, rsi
call r9
test al, al
jne 0x1800513fe
mov rax, qword [rsi]
mov r9, qword [rax + 0x330]
mov r8, qword [0x1801d4c48]
mov rdx, qword [rbx]
mov rcx, rsi
call r9
mov rcx, rbx
call fcn.1800b4860
call fcn.18004cdf0
lea rcx, [rax + 0xa0]
lea rdx, [rsp + 0x20]
call fcn.18004e2e0
nop
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
cmp rbx, rsi
je 0x1800514e1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180051459
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180051482
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800514ab
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800514d4
mov rax, qword [0x1801d4b80]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x70]
movss xmm1, dword [rax + 8]
call fcn.1800b3cc0
add rbx, 0x38
cmp rbx, rsi
jne 0x180051430
lea rcx, [rsp + 0x20]
call fcn.18004dee0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800caa50
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rcx + 8]
jmp 0x180051320
Function at 0x1800668c0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov rdi, rcx
mov qword [rcx], rsi
mov rbx, rdx
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov qword [rdi], 0xffffffffffffffff
mov qword [rdi + 0x10], rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
je 0x1800669d7
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rdi]
lea r8d, [rsi + 2]
mov eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rdi + 0x10], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 8], rax
test rax, rax
jne 0x180066989
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1800669aa
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rdi + 0x18], rsi
jmp 0x1800669aa
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x180066a1c
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800669bd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rsi
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x1800669d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0xffffffffffffffff
mov qword [rdi + 0x10], rsi
xorps xmm0, xmm0
mov byte [rsp + 0x60], 1
lea rax, [0x1800d800e]
lea rbx, vtable.std::exception.0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x58]
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.VCRUNTIME140.dll___std_exception_destroy]
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800caa50
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180066a40
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x180066a94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180066a70
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmova rsi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rdi
jae 0x18006b251
mov rcx, qword [rcx + 0x30]
sub rdi, rax
lea rdx, [rax + rcx]
mov rcx, r14
cmp rsi, rdi
ja 0x18006b238
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x18006b26c
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rsi, 0x1000
jae 0x18006b319
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jns 0x18006b2c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x18006b2a0
mov r15, qword [rsp + 0x20]
test rdi, rdi
jle 0x18006b2e5
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rdi, rsi
jg 0x18006b2f7
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
jmp 0x180066a40
Function at 0x180066ac0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x48], rcx
lea edi, [rcx + 1]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x34], r8d
nop dword [rax + rax]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x180066b2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180066b00
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800caa50
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x180066b90
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x468
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx eax, word [rcx]
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp ax, 2
je 0x180066bcc
cmp ax, 0x17
jne 0x180066c74
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsi], eax
mov r8d, 0x401
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
lea r8, [rsp + 0x40]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x180066c74
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180066c26
mov rax, qword [rdi + 0x18]
cmp rbx, rax
ja 0x180066c60
mov rsi, rdi
cmp rax, 0xf
jbe 0x180066c44
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov al, 1
mov byte [rsi + rbx], 0
jmp 0x180066c76
lea r9, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call fcn.180050260
mov al, 1
jmp 0x180066c76
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800caa50
add rsp, 0x468
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18006b090
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, qword [rcx + 8]
mov rdi, rcx
mov r8, qword [rcx + 0x28]
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x48], rax
lea esi, [rax + 1]
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
nop dword [rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, esi
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x18006b10d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x18006b0e0
test ebx, ebx
jle 0x18006b1af
mov rdi, qword [rdi + 8]
xor eax, eax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 1
nop dword [rax]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea ecx, [rdi + 1]
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
test eax, eax
jns 0x18006b15f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x18006b130
test ebx, ebx
je 0x18006b1ab
jns 0x18006b170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 9
je 0x18006b1af
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov r9d, 2
mov rdx, rsi
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jns 0x18006b1a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x18006b180
test ebx, ebx
jle 0x18006b1af
mov al, 1
jmp 0x18006b1b1
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800caa50
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18006b1e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x180066a94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x180066a70
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmova rsi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rdi
jae 0x18006b251
mov rcx, qword [rcx + 0x30]
sub rdi, rax
lea rdx, [rax + rcx]
mov rcx, r14
cmp rsi, rdi
ja 0x18006b238
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
jne 0x18006b26c
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rsi, 0x1000
jae 0x18006b319
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jns 0x18006b2c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x18006b2a0
mov r15, qword [rsp + 0x20]
test rdi, rdi
jle 0x18006b2e5
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rdi, rsi
jg 0x18006b2f7
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
jmp 0x180066a40
Function at 0x18006b340
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x18006b379
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x18006b3a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x18006b382
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18006b440
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x18006b499
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.180066b90
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800caa50
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret