joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e7f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x60
cmp byte [0x1403f0b10], 0
mov rsi, r8
mov rbp, rdx
mov r14, rcx
jne 0x14001e81b
xor ebx, ebx
jmp 0x14001e86c
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1405f78c0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14001e865
lea rbx, [rdi + 8]
test rbx, rbx
je 0x14001e865
cmp byte [rbx + 0x330], 0
je 0x14001e867
xor edx, edx
mov rcx, rbx
call fcn.140026d50
mov rbx, rax
jmp 0x14001e867
xor ebx, ebx
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x28], 0x10000
lea rdx, [rsp + 0x30]
mov r9, rbp
mov qword [rsp + 0x20], 0
mov r8, r14
mov rcx, rbx
call fcn.14005a370
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [0x14005a290]
call fcn.14004bd30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14005a550
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov r9, qword [0x1403f0d20]
mov r11, rdx
mov r10, qword [0x1403f0d18]
lea rcx, [r10 + r11]
mov r8, rcx
cmp rcx, r9
jb 0x14004bcf8
xor edx, edx
mov rax, rcx
div r9
mov r8, rdx
mov rax, r10
lock cmpxchg qword [0x1403f0d18], r8
mov r10, rax
jne 0x14004bce1
cmp rcx, r9
jb 0x14004bd1e
lea r8, [0x1403f0d08]
xor edx, edx
xor ecx, ecx
jmp 0x14001e7f0
ret
Function at 0x140022e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140022ef8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140022ef8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140022ee5
nop
cmp rbx, rcx
jae 0x140022ef8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140022ed0
cmp rbx, rcx
jae 0x140022ef8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x140022efa
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400231a0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400705f0
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400231b0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140070710
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140025240
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x1403efb58], rax
cmp rax, 0x1000
jbe 0x14002527f
lea rcx, str._jemalloc_:_Unsupported_system_page_size_n
call fcn.140024be0
cmp byte [0x1403e7a40], 0
jne 0x140025318
jmp 0x1400252cf
cmp dword [0x1403f0b98], 0
mov byte [0x1403efb54], 0
je 0x14002529c
cmp byte [0x1403e7a40], 0
jne 0x14002531e
xor ecx, ecx
mov dword [0x1405f78d0], 3
mov edx, 0x1000
mov dword [0x1403efb50], 3
mov r8d, 0x2000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400252d7
mov al, 1
add rsp, 0x50
pop rbx
ret
cmp byte [0x1403dd0d8], 0
je 0x1400252fc
mov edx, 0x1000
mov r9d, 4
mov r8d, 0x80000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x140025303
mov byte [0x1403dd0d8], 0
mov edx, 0x1000
mov rcx, rbx
call fcn.1400251d0
xor al, al
add rsp, 0x50
pop rbx
ret
call fcn.14025c5b0
int3
lea rcx, str._jemalloc_:_no_MADV_HUGEPAGE_support_n
call fcn.140024be0
call fcn.14025c5b0
int3
Function at 0x14002f090
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1403f0b10], 0
je 0x14002f105
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1405f78c0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rdi, rdi
je 0x14002f0e7
lea rax, [rdi + 8]
test rax, rax
je 0x14002f0e7
cmp byte [rax + 0x330], bl
je 0x14002f0ea
xor edx, edx
mov rcx, rax
call fcn.140026d50
jmp 0x14002f0ea
mov rax, rbx
mov rdi, qword [rsp + 0x30]
lea rcx, [rax + 0xd8]
test rax, rax
cmovne rbx, rcx
mov rax, rbx
test rbx, rbx
jne 0x14002f10c
lea rax, [0x1403ddb88]
add rsp, 0x20
pop rbx
ret
Function at 0x14004bcd0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x60
cmp byte [0x1403f0b10], 0
mov rsi, r8
mov rbp, rdx
mov r14, rcx
jne 0x14001e81b
xor ebx, ebx
jmp 0x14001e86c
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1405f78c0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x14001e865
lea rbx, [rdi + 8]
test rbx, rbx
je 0x14001e865
cmp byte [rbx + 0x330], 0
je 0x14001e867
xor edx, edx
mov rcx, rbx
call fcn.140026d50
mov rbx, rax
jmp 0x14001e867
xor ebx, ebx
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x28], 0x10000
lea rdx, [rsp + 0x30]
mov r9, rbp
mov qword [rsp + 0x20], 0
mov r8, r14
mov rcx, rbx
call fcn.14005a370
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [0x14005a290]
call fcn.14004bd30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14005a550
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov r9, qword [0x1403f0d20]
mov r11, rdx
mov r10, qword [0x1403f0d18]
lea rcx, [r10 + r11]
mov r8, rcx
cmp rcx, r9
jb 0x14004bcf8
xor edx, edx
mov rax, rcx
div r9
mov r8, rdx
mov rax, r10
lock cmpxchg qword [0x1403f0d18], r8
mov r10, rax
jne 0x14004bce1
cmp rcx, r9
jb 0x14004bd1e
lea r8, [0x1403f0d08]
xor edx, edx
xor ecx, ecx
jmp 0x14001e7f0
ret
Function at 0x14006f750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
test rcx, rcx
jne fcn.140018fc0
ret

Function at 0x14006fa40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
cmp rcx, rdx
jne fcn.140018fc0
ret

Function at 0x14006fbf0
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1403e4f00]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rsi, r8
movzx ebp, dx
mov rdi, rcx
call fcn.14006fa70
mov word [rsi], ax
test ax, ax
je 0x14006fc36
mov r8, rsi
movzx edx, bp
mov rcx, rdi
call fcn.14006fb60
jmp 0x14006fd0a
xor eax, eax
mov qword [rsp + 0x138], rbx
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0xc00
movups xmmword [rsi + 2], xmm0
mov qword [rsi + 0x12], rax
lea rcx, [rsp + 0x60]
mov word [rsi + 0x1a], ax
xor ebx, ebx
movzx eax, word [rsi]
xorps xmm1, xmm1
mov dword [rsp + 0x2c], eax
mov rdx, rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
lea r8d, [rbx + 3]
mov qword [rsp + 0x60], rax
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x50], rbx
movdqu xmmword [rsp + 0x40], xmm1
call fcn.14006ffe0
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x60]
mov edi, eax
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x14006fcc1
call fcn.140018fc0
test edi, edi
je 0x14006fcc9
mov ecx, edi
jmp 0x14006fcfa
mov rdi, qword [rsp + 0x20]
mov rdx, rdi
test rdi, rdi
je 0x14006fcec
mov eax, dword [rdx + 4]
cmp eax, 2
je 0x14006fd25
cmp eax, 0x17
je 0x14006fd25
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x14006fcd6
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140249860
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rdx + 0x10]
mov rcx, rsi
mov rdx, qword [rdx + 0x20]
call fcn.14027dfb0
mov rcx, rdi
mov ebx, 1
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsi + 2], ax
jmp 0x14006fd00
Function at 0x14006fd60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov dword [rax - 0x38], 0x1c
mov rdi, r8
mov rsi, rdx
lea r8, [rax - 0x38]
mov r14, r9
lea rdx, [rax - 0x30]
mov word [rax - 0x30], bx
cmp dword [rsp + 0x80], ebx
je 0x14006fda4
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x14006fdaa
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x14006fdb2
xor eax, eax
jmp 0x14006fe2c
movzx ecx, word [rsp + 0x2a]
mov qword [rsp + 0x60], rbp
movzx ebp, word [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [r14], ax
lea rcx, [rsp + 0x30]
movzx eax, word [rsp + 0x28]
mov r8, rsi
movsxd r9, dword [rdi]
lea rdx, [rsp + 0x2c]
cmp eax, 2
cmovne rdx, rcx
mov ecx, eax
call sub.WS2_32.dll_InetNtopW
test rax, rax
je 0x14006fe07
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov ebx, 1
mov dword [rdi], eax
jmp 0x14006fe25
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x57
jne 0x14006fe25
cmp bp, 2
mov ecx, reloc.WS2_32.dll_shutdown
mov eax, 0x41
cmovne ecx, eax
mov dword [rdi], ecx
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140070310
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov rbx, qword [rdx + 8]
xor r15d, r15d
test rbx, rbx
je 0x1400703bd
cmp qword [rbx], r15
je 0x1400703ae
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400703ea
lea rdx, str.CreateFileTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400703b4
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
mov rcx, rbp
call r10
jmp 0x1400703e4
cmp dword [rbx + 8], r15d
jne 0x1400703bd
mov rax, 0xffffffffffffffff
jmp 0x1400703e4
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400703f1
call fcn.140021b10
jmp 0x1400703f7
mov qword [rsi], rax
mov eax, r15d
test eax, eax
js 0x1400704e9
lea rdx, [rsp + 0x7c]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x78], eax
cmp eax, 0xffffffff
jne 0x140070423
call fcn.140021b10
test eax, eax
js 0x1400704e9
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400704d7
cmp rax, r14
ja 0x1400704d7
mov rbx, qword [rsi]
lea rdx, [rsp + 0x7c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x78], eax
mov r9, qword [rsp + 0x78]
shr r9, 0x20
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140070483
call fcn.140021b10
jmp 0x1400704e9
mov rax, qword [rsp + 0x78]
mov qword [rdi + 8], rax
mov dword [rdi + 0x20], 4
mov qword [rdi + 0x18], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov qword [rdi], rax
test rax, rax
jne 0x1400704d2
call fcn.140021b10
mov ebx, eax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], r15
mov eax, ebx
jmp 0x1400704e9
mov eax, r15d
jmp 0x1400704e9
mov ecx, 0x800700df
mov edx, 0x800703ee
test rax, rax
cmove ecx, edx
mov eax, ecx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400705a0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x1400705c0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x38
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1400705f0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1400705f0
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x140070620
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dword [rsp + 0x50], 1
mov rdi, rcx
mov dword [rsp + 0x48], 0
test edx, edx
jne 0x140070648
lea r9, [rsp + 0x50]
jmp 0x140070652
cmp edx, 1
jne 0x14007069b
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0xfffffffb
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
jne 0x1400706ee
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0xfffffffb
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret

Function at 0x140070710
Capabilities:
Set socket configuration

Disassembly:
jmp 0x140070710
mov dword [rsp + 0x10], edx
sub rsp, 0x38
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x1400707e0
Capabilities:
Get socket status

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x1403e4f00]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r8d, edx
mov qword [rsp + 0x258], rcx
mov eax, 0x10624dd3
mov qword [rsp + 0x48], rcx
mul edx
mov rbx, rcx
mov dword [rsp + 0x250], 1
shr edx, 6
lea r9, [rsp + 0x40]
imul eax, edx, 0x3e8
xor ecx, ecx
mov dword [rsp + 0x38], edx
xor edx, edx
mov dword [rsp + 0x40], 1
sub r8d, eax
imul eax, r8d, 0x3e8
lea r8, [rsp + 0x250]
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x140070886
jne 0x140070874
mov eax, 0x5b4
jmp 0x1400708f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x22a
cmove eax, ecx
jmp 0x1400708f7
lea rdx, [rsp + 0x40]
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
mov rcx, rbx
test eax, eax
je 0x1400708e8
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400708d2
mov ecx, dword [rsp + 0x34]
lea eax, [rcx + 1]
cmp eax, 1
ja 0x1400708e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x22a
test eax, eax
cmove eax, ecx
mov ecx, eax
mov eax, ecx
jmp 0x1400708f7
lea rdx, [rsp + 0x250]
call sub.WS2_32.dll___WSAFDIsSet
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140249860
add rsp, 0x470
pop rbx
ret

Function at 0x140071740
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x1f4]
mov rbx, rcx
test eax, eax
jne 0x140071831
nop dword [rax + rax]
mov r8d, dword [rbx + 0x48]
xor r9d, r9d
mov rdx, qword [rbx + 0x88]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jle 0x1400717da
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, qword [rbx + 0x88]
mov r9, qword [rcx + 0x1a0]
mov rcx, rbx
call r9
cmp eax, 2
jne 0x1400717e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x4c7
cmove eax, ecx
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 4
mov dword [rbx + 0x20], eax
xor eax, eax
mov dword [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edi, 0xffffffff
je 0x140071824
test edi, edi
je 0x140071801
mov eax, dword [rbx + 0x1f4]
test eax, eax
je 0x140071760
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 0x18], 1
xor eax, eax
mov qword [rbx + 0x1c], 5
mov dword [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400717b5
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400736e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x1ec]
mov rbx, rcx
test eax, eax
jne 0x1400737d6
xor esi, esi
mov r8d, dword [rbx + 0x44]
xor r9d, r9d
mov rdx, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jle 0x14007379c
mov rcx, qword [rbx + 0x80]
mov edx, eax
mov dword [rbx + 0x1f0], esi
call fcn.140070240
test eax, eax
jne 0x1400737eb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, qword [rbx + 0x80]
mov rax, qword [rcx + 0x128]
mov rcx, rbx
call rax
cmp eax, 2
jne 0x1400737c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x4c7
cmove eax, ecx
mov dword [rbx + 0x18], 1
mov dword [rbx + 0x1c], 4
mov dword [rbx + 0x20], eax
xor eax, eax
mov dword [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edi, 0xffffffff
jne 0x1400737be
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1400737d6
lea ecx, [rax - 0x2744]
test ecx, 0xfffffffd
jne 0x140073772
jmp 0x1400737c8
test edi, edi
jne 0x1400737c8
mov dword [rbx + 0x1f0], esi
mov eax, dword [rbx + 0x1ec]
test eax, eax
je 0x140073702
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 0x24], esi
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x18], 1
mov qword [rbx + 0x1c], 5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140076310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x70], 0
mov r9, rcx
mov dword [rcx + 0x4c], edx
jne 0x140076326
mov dword [rcx + 0x70], 1
mov dword [rcx + 0x54], edx
mov ecx, dword [rcx + 0x54]
mov eax, edx
sub eax, ecx
cmp eax, 0x2710
jge 0x140076341
cmp eax, 0xffffd8f0
jl 0x140076341
test eax, eax
js 0x140076366
jmp 0x140076347
mov dword [r9 + 0x54], edx
mov ecx, edx
mov r10d, dword [r9 + 0x50]
add ecx, r10d
cmp edx, ecx
mov dword [r9 + 0x54], ecx
js 0x14007635e
lea eax, [r10 + rdx]
mov dword [r9 + 0x54], eax
mov rcx, r9
jmp fcn.1400749b0
ret

Function at 0x140077540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140077591
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14007757e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400775b1
mov rcx, r8
call fcn.140248fa4
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov rdx, qword [rbx + 8]
lea rcx, [rbx + 8]
call fcn.1400773c0
mov rcx, qword [rbx + 8]
mov edx, 0x58
add rsp, 0x20
pop rbx
jmp fcn.140248fa4
call fcn.14025746c
int3

Function at 0x1400775c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140077611
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400775fe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007761f
mov rcx, r8
call fcn.140248fa4
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
pop rbx
jmp 0x1400776c0
call fcn.14025746c
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0
mov rbx, qword [rbx]
test rbx, rbx
je 0x140077716
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.140077730
mov edx, 0x48
mov rcx, rbx
call fcn.140248fa4
mov rbx, rdi
test rdi, rdi
jne 0x1400776f0
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x48
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.140248fa4