joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a040
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
test rax, rax
mov rdi, rcx
je 0x14008a068
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea rsi, [rsp + 0x2c]
mov ebx, 4
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14008a0b0
cdqe
add rsi, rax
sub rbx, rax
jne 0x14008a080
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14008a0bc
call rbp
cmp dword [rax], 4
je 0x14008a080
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400b0d30
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rcx, str.GLIBCXX_TUNABLES
pxor xmm0, xmm0
mov qword [0x1400b2780], 0
movups xmmword [0x1400b2788], xmm0
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
mov qword [0x1400b2798], 0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
mov dword [rsp + 0x58], 0x100
lea rax, str.obj_size
test rbx, rbx
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
jne 0x1400b0ddd
jmp 0x1400b0e87
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
test rax, rax
mov rbx, rax
je 0x1400b0e40
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400b0dc8
cmp qword [rbx + 7], r12
jne 0x1400b0dc8
cmp byte [rbx + 0xf], 0x2e
jne 0x1400b0dc8
lea rbp, [rsp + 0x30]
add rbx, 0x10
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400b0e23
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400b0e2d
cmp byte [rbx + rsi], 0x3d
je 0x1400b0ebd
add rbp, 0x18
cmp rbp, r13
jne 0x1400b0e07
jmp 0x1400b0dc8
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
test rbx, rbx
mov qword [0x1400b2798], rbx
jne 0x1400b0e97
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [0x1400b2798], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
test rax, rax
mov qword [0x1400b2790], rax
je 0x1400b0ef4
xor edx, edx
mov qword [0x1400b2788], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400b0e7a
lea rdx, [rsp + 0x28]
xor r8d, r8d
lea rcx, [rbx + rsi + 1]
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400b0ee4
test dl, dl
jne 0x1400b0dc8
test eax, eax
js 0x1400b0dc8
mov dword [rbp + 0x10], eax
jmp 0x1400b0dc8
xor ecx, ecx
mov qword [0x1400b2798], rcx
jmp 0x1400b0e7a
Function at 0x14003173c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1400317b4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1400317b4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1400317b4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1400317a8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1400317c6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140031796
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1400317b6

Function at 0x140033300
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003334a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003334a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003334a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003334a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003334a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003334c
xor al, al
add rsp, 0x28
ret

Function at 0x14003c094
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003bdf8

Function at 0x140045fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045fd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045fd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400018ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001936
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001936
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001936
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001936
cmp dword [rcx + 0x84], 0xe
jbe 0x140001936
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001938
xor al, al
add rsp, 0x28
ret

Function at 0x140001b28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b72
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b74
xor al, al
add rsp, 0x28
ret
Function at 0x1cd82d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1cd82dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1cd82ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1cd82d5
lea eax, [rcx + 1]
jmp 0x1cd82fb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1cd830e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1cd82f4
sub eax, 3
jb 0x1cd832e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1cd837d
sar eax, 1
movsxd rbp, eax
jb 0x1cd8364
jmp 0x1cd833c
add ebx, ebx
jne 0x1cd833a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1cd8364
inc ecx
add ebx, ebx
jne 0x1cd834a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1cd8364
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1cd835d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1cd834c
add ecx, 2
jmp 0x1cd8369
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01cd8292
jmp 0x1cd82dd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x18c2000]
mov eax, dword [rdi]
or eax, eax
je 0x1cd83d9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x18d8000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1cd8389
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1cd83d3
mov qword [rbx], rax
add rbx, 8
jmp 0x1cd83a9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1cd841d
cmp al, 0xef
ja 0x1cd8405
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1cd83e5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1cd83f4
mov eax, dword [rdi]
add rdi, 4
jmp 0x1cd83f4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1cd8471
sub rsp, 0xffffffffffffff80
jmp 0x471ca0
Function at 0x140004760
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x1400047de
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov edx, 0x4004667f
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1400047d6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp eax, 0x2714
jne 0x140004803
mov edx, ebx
inc ebx
cmp edx, dword [rdi + 0xc8]
jge 0x140004803
jmp 0x1400047a0
cmp dword [rsp + 0x20], 0
seta al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140006500
nop
mov r8, rax
lea rdx, str.TSocket::hasPendingDataToRead___THRIFT_IOCTL_SOCKET__
lea rcx, [rsp + 0x50]
call fcn.14000a760
nop
mov r8d, esi
mov rdx, rax
call fcn.140003d80
nop
lea rcx, [rsp + 0x50]
call fcn.140002b80
nop
lea rcx, [rsp + 0x28]
call fcn.140002b80
lea rdx, str.Unknown
lea rcx, [rsp + 0x28]
call fcn.140007bb0
nop
mov r9d, esi
lea r8, [rsp + 0x28]
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140003de0
lea rdx, [0x1401fbfa0]
lea rcx, [rsp + 0x50]
call fcn.14016c51c
int3
Function at 0x140004890
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140004999
cmp qword [rdi + 0xa0], 0
je 0x140004974
xor ebx, ebx
mov r14d, 0x300
lea r15d, [rbx - 1]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], r14w
mov rax, qword [rdi + 0xa0]
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
mov word [rsp + 0x40], r14w
mov r8d, dword [rdi + 0xb8]
test r8d, r8d
cmove r8d, r15d
mov edx, 2
lea rcx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_WSAPoll]
mov ebp, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test ebp, ebp
jns 0x14000496a
cmp eax, 0x2714
jne 0x140004a4c
mov ecx, ebx
inc ebx
cmp ecx, dword [rdi + 0xc8]
jge 0x140004a4c
jmp 0x1400048f0
jle 0x140004999
test word [rsp + 0x42], r14w
jne 0x140004999
mov r9d, 2
lea r8d, [r9 - 1]
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400049c8
test eax, eax
setg al
jmp 0x14000499b
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140006500
nop
mov r8, rax
lea rdx, str.TSocket::peek___recv__
lea rcx, [rsp + 0x48]
call fcn.14000a760
nop
mov r8d, ebx
mov rdx, rax
call fcn.140003d80
nop
lea rcx, [rsp + 0x48]
call fcn.140002b80
nop
lea rcx, [rsp + 0x28]
call fcn.140002b80
lea rdx, str.recv__
lea rcx, [rsp + 0x48]
call fcn.140007bb0
nop
mov r9d, ebx
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140003de0
lea rdx, [0x1401fbfa0]
lea rcx, [rsp + 0x70]
call fcn.14016c51c
nop
mov r8d, esi
lea rdx, str.TSocket::peek___THRIFT_POLL__
call fcn.14000c440
lea rdx, str.Unknown
lea rcx, [rsp + 0x48]
call fcn.140007bb0
nop
mov r9d, esi
lea r8, [rsp + 0x48]
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140003de0
lea rdx, [0x1401fbfa0]
lea rcx, [rsp + 0x70]
call fcn.14016c51c
int3
Function at 0x140005d10
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x140005f09
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140005e66
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140005e4d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140005e4d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.140006500
nop
mov r8, rax
lea rdx, str.TSocket::write_partial___send__
lea rcx, [rbp - 9]
call fcn.14000a760
nop
cmp qword [rax + 0x18], 0x10
jb 0x140005da5
mov rax, qword [rax]
mov r8d, ebx
mov rdx, rax
call fcn.14000c440
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140005dec
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005de7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005f3d
call fcn.140167ab8
mov qword [rbp + 7], 0
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140005e3b
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005f43
call fcn.140167ab8
cmp ebx, 0x2746
je 0x140005e6a
cmp ebx, 0x2749
jne 0x140005ea1
jmp 0x140005e6a
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0x90
pop rdi
pop rbx
pop rbp
ret
je 0x140005ed5
jmp 0x140005e4f
lea rdx, str.write___send__
lea rcx, [rbp - 0x29]
call fcn.140007bb0
nop
mov r9d, ebx
lea r8, [rbp - 0x29]
mov edx, 1
lea rcx, [rbp - 9]
call fcn.140003de0
lea rdx, [0x1401fbfa0]
lea rcx, [rbp - 9]
call fcn.14016c51c
nop
lea rdx, str.write___send__
lea rcx, [rbp - 0x29]
call fcn.140007bb0
nop
mov r9d, ebx
lea r8, [rbp - 0x29]
xor edx, edx
lea rcx, [rbp - 9]
call fcn.140003de0
lea rdx, [0x1401fbfa0]
lea rcx, [rbp - 9]
call fcn.14016c51c
nop
lea rdx, str.Socket_send_returned_0.
lea rcx, [rbp - 0x29]
call fcn.140007bb0
nop
lea r8, [rbp - 0x29]
mov edx, 1
lea rcx, [rbp - 9]
call fcn.140003d90
lea rdx, [0x1401fbfa0]
lea rcx, [rbp - 9]
call fcn.14016c51c
nop
lea rdx, str.Called_write_on_non_open_socket
lea rcx, [rbp - 0x29]
call fcn.140007bb0
nop
lea r8, [rbp - 0x29]
mov edx, 1
lea rcx, [rbp - 9]
call fcn.140003d90
lea rdx, [0x1401fbfa0]
lea rcx, [rbp - 9]
call fcn.14016c51c
nop
call fcn.14017d6e4
nop
call fcn.14017d6e4
int3
Function at 0x140005f50
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov byte [rcx + 0xbd], dl
mov dword [rcx + 0xc0], r8d
mov rcx, qword [rcx + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x140006160
movzx eax, dl
mov word [rsp + 0x30], ax
mov word [rsp + 0x32], r8w
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x140006160
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r15d, eax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140006500
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x22
jb 0x140006079
lea rax, [r8 + 0x22]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rdx, 0x10
jb 0x14000600e
mov rdi, qword [rbx]
lea rax, [0x1401d510a]
mov r14d, 0x22
lea rsi, str.TSocket::setLinger___setsockopt__
cmp rax, rdi
jbe 0x140006041
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x140006041
cmp rdi, rsi
ja 0x140006039
xor ebp, ebp
jmp 0x140006044
mov rbp, rdi
sub rbp, rsi
jmp 0x140006044
mov rbp, r14
lea rcx, [rdi + 0x22]
inc r8
mov rdx, rdi
call fcn.14016bcc0
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.14016bcc0
lea rcx, [rdi + rbp]
sub r14, rbp
lea rdx, [rsi + 0x22]
add rdx, rbp
mov r8, r14
call fcn.14016bcc0
jmp 0x1400060a4
mov r14d, 0x22
mov qword [rsp + 0x28], r14
lea rsi, str.TSocket::setLinger___setsockopt__
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbx
call fcn.14000bcc0
mov rbx, rax
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rdx, [rsp + 0x38]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rdx, rcx
mov r8d, r15d
call fcn.14000c440
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140006127
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006121
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006190
call fcn.140167ab8
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140006160
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000615b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000618a
call fcn.140167ab8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14017d6e4
nop
call fcn.14017d6e4
nop
int3
Function at 0x1400061b0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x240], rax
test edx, edx
jns 0x140006204
mov r8d, edx
lea rcx, [rsp + 0x40]
lea rdx, str.TSocket::setGenericTimeout_with_negative_input:__d_n
call fcn.1400031e0
lea rcx, [rsp + 0x40]
call qword [0x140205f60]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0x258
ret
cmp rcx, 0xffffffffffffffff
je 0x140006240
mov dword [rsp + 0x30], edx
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x140006240
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.TSocket::setGenericTimeout___setsockopt__
call fcn.14000c440
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401677c0
add rsp, 0x258
ret
Function at 0x1400062c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov byte [rcx + 0xbc], dl
mov rcx, qword [rcx + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x1400064c2
movzx eax, dl
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1400064c2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r15d, eax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140006500
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rcx, rdx
sub rcx, r8
cmp rcx, 0x25
jb 0x1400063db
lea rax, [r8 + 0x25]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rdx, 0x10
jb 0x140006370
mov rdi, qword [rbx]
lea rax, [0x1401d51c5]
mov r14d, 0x25
lea rsi, str.TSocket::setKeepAlive___setsockopt__
cmp rax, rdi
jbe 0x1400063a3
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x1400063a3
cmp rdi, rsi
ja 0x14000639b
xor ebp, ebp
jmp 0x1400063a6
mov rbp, rdi
sub rbp, rsi
jmp 0x1400063a6
mov rbp, r14
lea rcx, [rdi + 0x25]
inc r8
mov rdx, rdi
call fcn.14016bcc0
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.14016bcc0
lea rcx, [rdi + rbp]
sub r14, rbp
lea rdx, [rsi + 0x25]
add rdx, rbp
mov r8, r14
call fcn.14016bcc0
jmp 0x140006406
mov r14d, 0x25
mov qword [rsp + 0x28], r14
lea rsi, str.TSocket::setKeepAlive___setsockopt__
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rbx
call fcn.14000bcc0
mov rbx, rax
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rdx, [rsp + 0x38]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rdx, rcx
mov r8d, r15d
call fcn.14000c440
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140006489
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064f2
call fcn.140167ab8
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400064c2
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064ec
call fcn.140167ab8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14017d6e4
nop
call fcn.14017d6e4
nop
int3
Function at 0x1400067d0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x140205108]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x40], rdx
mov rsi, rdx
cmp qword [rcx + 0x88], 0
mov rbx, rcx
jne 0x14000696e
cmp qword [rcx + 0x40], 0
jne 0x14000696e
mov rcx, qword [rcx + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x14000696e
lea rdi, [rbx + 0xcc]
movzx eax, word [rdi]
cmp ax, 2
je 0x140006843
cmp ax, 0x17
jne 0x140006858
mov eax, 0x1c
jmp 0x140006848
mov eax, reloc.WS2_32.dll_recv
mov dword [rsp + 0x40], eax
mov r10, rdi
test rdi, rdi
jne 0x1400068f1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 0x80
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x14000696e
cmp qword [rbx + 0x40], 0
lea r10, [rsp + 0x50]
jne 0x1400068f1
movzx eax, word [rsp + 0x50]
cmp ax, 2
je 0x1400068b8
cmp ax, 0x17
jne 0x1400068c7
cmp dword [rsp + 0x40], 0x1c
jne 0x1400068c7
movaps xmm0, xmmword [rsp + 0x50]
movsd xmm1, qword [rsp + 0x60]
mov eax, dword [rsp + 0x68]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov dword [rdi + 0x18], eax
jmp 0x1400068c7
cmp dword [rsp + 0x40], 0x10
jne 0x1400068c7
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
lea rax, [rbx + 0x78]
xor ecx, ecx
mov qword [rax + 0x10], rcx
cmp qword [rax + 0x18], 0x10
jb 0x1400068db
mov rax, qword [rax]
mov byte [rax], cl
lea rax, [rbx + 0x58]
mov qword [rax + 0x10], rcx
cmp qword [rax + 0x18], 0x10
jb 0x1400068ef
mov rax, qword [rax]
mov byte [rax], cl
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0xd0]
mov dword [rsp + 0x30], 0xa
lea r8, [rsp + 0xf0]
mov dword [rsp + 0x28], 0x20
mov r9d, 0x401
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
lea rax, [rsp + 0xf0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140006940
lea rcx, [rbx + 0x78]
lea rdx, [rsp + 0xf0]
call fcn.1400090a0
lea rcx, [rsp + 0xd0]
call fcn.140174eb8
mov dword [rbx + 0x98], eax
lea rdx, [rbx + 0x78]
mov rcx, rsi
call fcn.140002be0
mov rax, rsi
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.1401677c0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400135d0
Capabilities:
Encode data using base64

Disassembly:
test r8d, r8d
jle 0x14001368f
lea r9, [rcx + 2]
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 - 2]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rdx], al
cmp r8d, 1
jbe 0x140013610
movzx eax, byte [r9 - 1]
shr eax, 4
jmp 0x140013612
xor eax, eax
movzx ecx, byte [r9 - 2]
and ecx, 3
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [rdx + 1], al
cmp r8d, 1
jbe 0x14001366f
cmp r8d, 2
jbe 0x14001363e
movzx eax, byte [r9]
shr eax, 6
jmp 0x140013640
xor eax, eax
movzx ecx, byte [r9 - 1]
and ecx, 0xf
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [rdx + 2], al
add rdx, 3
cmp r8d, 2
jbe 0x140013677
movzx eax, byte [r9]
and eax, 0x3f
movzx ecx, byte [rax + r10]
jmp 0x140013679
mov byte [rdx + 2], 0x3d
add rdx, 3
mov cl, 0x3d
mov byte [rdx], cl
sub r8d, 3
inc rdx
add r9, 3
test r8d, r8d
jg 0x1400135f0
mov rax, rdx
mov byte [rdx], 0
ret