joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010dad0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.140110550
jmp fcn.1401126a0

Function at 0x14010daf0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
xor r8d, r8d
sub edx, 0xa0
je 0x14010dc80
sub edx, 0x40
je 0x14010db92
sub edx, 0x20
je 0x14010dc40
sub edx, 0x80
je 0x14010dbd0
cmp edx, 0x80
jne 0x14010dca7
mov rax, qword [0x1402c4af0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1402c4af8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1402c4b00]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1402c4b08]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402c4b10]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1402c4b18]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1402c4b20]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1402c4b28]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], r8
ret
mov rax, qword [0x1402c4830]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1402c4838]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1402c4840]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1402c4848]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1402c4850]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1402c4858]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1402c4860]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1402c4868]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], r8
mov qword [rcx + 0x88], r8
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov dword [rcx + 0x30], 0x5be0cd19
mov qword [rcx + 0x34], r8
ret
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], r8
ret
Function at 0x14010fab0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x38], rsi
mov ecx, 0x110
call fcn.1401dab7c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14010fcbc
mov rcx, rax
call fcn.140031be0
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.140014080
mov byte [0x1402bcfd0], al
call fcn.14010f5c0
test edi, edi
jle 0x14010fcb7
mov ecx, edi
sub ecx, 0xa0
je 0x14010fc90
sub ecx, 0x40
je 0x14010fc50
sub ecx, 0x20
je 0x14010fc10
sub ecx, 0x80
je 0x14010fba0
cmp ecx, 0x80
jne 0x14010fcb7
mov rax, qword [0x1402c4af0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1402c4af8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1402c4b00]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1402c4b08]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1402c4b10]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1402c4b18]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1402c4b20]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1402c4b28]
jmp 0x14010fbf4
mov rax, qword [0x1402c4830]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1402c4838]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1402c4840]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1402c4848]
mov qword [rbx + 0x58], rax
mov rax, qword [0x1402c4850]
mov qword [rbx + 0x60], rax
mov rax, qword [0x1402c4858]
mov qword [rbx + 0x68], rax
mov rax, qword [0x1402c4860]
mov qword [rbx + 0x70], rax
mov rax, qword [0x1402c4868]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x14010fcb7
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov dword [rbx + 0x30], 0x5be0cd19
jmp 0x14010fcb3
mov dword [rbx + 0x14], 0xc1059ed8
mov dword [rbx + 0x18], 0x367cd507
mov dword [rbx + 0x1c], 0x3070dd17
mov dword [rbx + 0x20], 0xf70e5939
mov dword [rbx + 0x24], 0xffc00b31
mov dword [rbx + 0x28], 0x68581511
mov dword [rbx + 0x2c], 0x64f98fa7
mov dword [rbx + 0x30], 0xbefa4fa4
jmp 0x14010fcb3
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x14010fcbf
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14010fcf0
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.14010fab0
Function at 0x140115f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140115fc8
xor al, al
jmp 0x1401160a0
lea rcx, [rsp + 0x20]
call fcn.1401154d0
test edi, edi
je 0x140115fee
test rbx, rbx
je 0x140115fee
mov r9b, reloc.WS2_32.dll_select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140116880
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x187], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x187], 0x80
inc dl
cmp dl, 0x8f
jae 0x14011603d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x8f
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, reloc.WS2_32.dll_select
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140116050
lea rcx, [rsp + 0x30]
call fcn.1401155d0
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
movups xmmword [rsi], xmm0
movsd qword [rsi + 0x10], xmm1
mov dword [rsi + 0x18], eax
lea rax, vtable._ckSha3.0
mov qword [rsp + 0x20], rax
call fcn.140031cf0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401da8c0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140116110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140116148
xor al, al
jmp 0x140116217
lea rcx, [rsp + 0x20]
call fcn.1401154d0
test edi, edi
je 0x14011616e
test rbx, rbx
je 0x14011616e
mov r9b, select
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140116880
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x17f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x17f], 0x80
inc dl
cmp dl, 0x87
jae 0x1401161bd
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x87
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, setsockopt
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401161d0
lea rcx, [rsp + 0x30]
call fcn.1401155d0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsi + 0x10], xmm1
call fcn.140031cf0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401da8c0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140116280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x1401162b8
xor al, al
jmp 0x140116390
lea rcx, [rsp + 0x20]
call fcn.1401154d0
test edi, edi
je 0x1401162de
test rbx, rbx
je 0x1401162de
mov r9b, ntohs
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140116880
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x15f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x15f], 0x80
inc dl
cmp dl, 0x67
jae 0x14011632d
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x67
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, ntohs
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140116340
lea rcx, [rsp + 0x30]
call fcn.1401155d0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm0
call fcn.140031cf0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401da8c0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140116400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test r8, r8
jne 0x140116438
xor al, al
jmp 0x140116519
lea rcx, [rsp + 0x20]
call fcn.1401154d0
test edi, edi
je 0x14011645e
test rbx, rbx
je 0x14011645e
mov r9b, 9
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, rbx
call fcn.140116880
movzx eax, byte [rsp + 0x1c0]
mov byte [rsp + 0x13f], 0
mov byte [rsp + rax + 0xf8], 6
movzx edx, byte [rsp + 0x1c0]
or byte [rsp + 0x13f], 0x80
inc dl
cmp dl, 0x47
jae 0x1401164ad
movzx eax, dl
lea rcx, [rsp + 0xf8]
add rcx, rax
mov eax, 0x47
sub al, dl
xor edx, edx
movzx r8d, al
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov edx, 9
nop word [rax + rax]
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401164c0
lea rcx, [rsp + 0x30]
call fcn.1401155d0
movaps xmm0, xmmword [rsp + 0x30]
lea rax, vtable._ckSha3.0
movaps xmm1, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
call fcn.140031cf0
mov al, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401da8c0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401167b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
lea rdi, [rcx + 0x10]
mov rbx, rdx
movzx esi, r9b
mov rdx, rcx
lea eax, [rax*8]
mov byte [rax + rcx + 0xd7], 0
lea r11d, [rax - 1]
mov r10d, eax
movzx eax, byte [rcx + 0x1a0]
mov byte [rax + rcx + 0xd8], 6
or byte [r10 + rcx + 0xd7], 0x80
movzx ecx, byte [rcx + 0x1a0]
inc cl
movzx eax, cl
cmp eax, r11d
jge 0x140116825
movzx eax, cl
inc cl
mov byte [rax + rdx + 0xd8], 0
movzx eax, cl
cmp eax, r11d
jl 0x140116810
test r8b, r8b
je 0x140116845
mov rax, rdi
movzx edx, r8b
mov rcx, qword [rax + 0xc8]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140116831
mov rcx, rdi
call fcn.1401155d0
test sil, sil
je 0x140116870
sub rdi, rbx
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x140116860
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140116880
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x40], rbp
movzx ecx, byte [rcx + 0x1a0]
mov esi, r8d
mov qword [rsp + 0x50], r14
mov rdi, rdx
movzx r14d, r9b
test cl, cl
je 0x140116947
movzx eax, r14b
movzx r9d, sil
shl al, 3
sub al, cl
movzx r8d, al
cmp r8d, esi
cmovbe r9d, r8d
xor dl, dl
lea r8, [rbx + rcx]
test r9b, r9b
je 0x1401168e7
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + r8 + 0xd8], al
cmp dl, r9b
jb 0x1401168d1
add byte [rbx + 0x1a0], dl
movzx ecx, byte [rbx + 0x1a0]
movzx eax, dl
add rdi, rax
movzx eax, dl
sub esi, eax
mov eax, r14d
shl eax, 3
cmp ecx, eax
jne 0x140116947
test r14b, r14b
je 0x140116934
lea rcx, [rbx + 0x10]
mov rdx, r14
nop word [rax + rax]
mov rax, qword [rcx + 0xc8]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140116920
mov rcx, rbx
add rcx, 0x10
call fcn.1401155d0
mov byte [rbx + 0x1a0], 0
mov ebp, r14d
shl ebp, 3
cmp esi, ebp
jb 0x1401169ae
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov r12d, ebp
nop
test r14b, r14b
je 0x140116992
mov r8, rdi
lea rax, [rbx + 0x10]
sub r8, rbx
mov rdx, r14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r8 + rax - 0x10]
xor qword [rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x140116980
lea rcx, [rbx + 0x10]
call fcn.1401155d0
sub esi, ebp
add rdi, r12
cmp esi, ebp
jae 0x140116960
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
xor dl, dl
mov rbp, qword [rsp + 0x40]
test esi, esi
je 0x1401169d7
nop
movzx ecx, dl
inc dl
movzx eax, byte [rcx + rdi]
mov byte [rcx + rbx + 0xd8], al
movzx eax, dl
cmp eax, esi
jb 0x1401169c0
add byte [rbx + 0x1a0], dl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401194f0
Capabilities:
Set socket configuration

Disassembly:
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x1401194fc
mov al, 1
ret
jmp fcn.1400d08f0

Function at 0x14011ab30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
cmp dword [rcx + 0x2a0], 2
je fcn.14011ba90
jmp fcn.14011bba0
Function at 0x14011b350
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x14011b37f
xor al, al
jmp 0x14011b410
xor r8d, r8d
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], r8d
test dl, dl
je 0x14011b3f0
mov qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r8
lea r9d, [r8 + 0xc]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x50], r8d
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x68], 0x7148
mov dword [rsp + 0x64], 0x1d0d8
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rbx + 0x298]
lea r9, [rsp + 0x54]
jmp 0x14011b3f5
lea r9, [rsp + 0x58]
mov r8d, 8
mov dword [rsp + 0x20], 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401da8c0
add rsp, 0x80
pop rbx
ret

Function at 0x14011b890
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x14011b931
mov r8d, dword [rcx + 0xdc]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14011b92c
and r8d, 0xfffff000
mov dword [rcx + 0xdc], r8d
cmp byte [rdx + 0x169], 0
je 0x14011b905
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_RCVBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xdc]
lea rdx, str.recvBufSize
mov rcx, rsi
call fcn.1400552e0
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xdc]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14011b940
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x298], 0xffffffffffffffff
mov rsi, rdx
mov rdi, rcx
je 0x14011b9e1
mov r8d, dword [rcx + 0xd8]
mov qword [rsp + 0x40], rbx
lea eax, [r8 - 0x1000]
cmp eax, 0x7ff000
ja 0x14011b9dc
and r8d, 0xfffff000
mov dword [rcx + 0xd8], r8d
cmp byte [rdx + 0x169], 0
je 0x14011b9b5
mov rax, qword [rdx]
mov rcx, rsi
lea rdx, str.Setting_SO_SNDBUF_size
call qword [rax + 0x30]
mov r8d, dword [rdi + 0xd8]
lea rdx, str.sendBufSize
mov rcx, rsi
call fcn.1400552e0
mov rcx, qword [rdi + 0x298]
lea r9, [rdi + 0xd8]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14011ba90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea r8, str.ck_getsockname_ipv4
mov rdx, r9
lea rcx, [rsp + 0x38]
call fcn.140054ae0
nop
mov rcx, rsi
call fcn.140040210
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x14011bb5f
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x14011bb3b
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
mov rcx, rsi
call fcn.14003beb0
movzx ecx, word [rsp + 0x2a]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x14011bb71
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.14011e3f0
jmp 0x14011bb6f
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.140054c00
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401da8c0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x14011bba0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea r8, str.ck_getsockname_ipv6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140054ae0
nop
mov rcx, rsi
call fcn.140040210
mov dword [r14], 0
mov rcx, qword [rbx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x14011bc6f
mov dword [rsp + 0x20], 0x1c
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
js 0x14011bc4b
mov rcx, rsi
call fcn.140040210
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14011d360
movzx ecx, word [rsp + 0x42]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [r14], eax
mov bl, 1
jmp 0x14011bc81
mov rax, qword [rdi]
lea rdx, str.Failed_to_getsockname_ipv6
mov rcx, rdi
call qword [rax + 0x28]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, rdi
xor edx, edx
mov ecx, eax
call fcn.14011e3f0
jmp 0x14011bc7f
mov rax, qword [rdi]
lea rdx, str.Cannot_get_socket_name:_INVALID_SOCKET.
mov rcx, rdi
call qword [rax + 0x28]
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.140054c00
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401da8c0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14011e220
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1000]
mov eax, 0x1100
call fcn.1401db1b0
sub rsp, rax
mov rax, qword [0x1402bf7c0]
xor rax, rsp
mov qword [rbp + 0xff0], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.14007d140
mov rdx, rbx
mov rcx, rdi
call fcn.14007d2c0
test al, al
je 0x14011e28d
mov byte [rdi + 0x29], 1
mov rax, qword [rbx]
lea rdx, str.Wait_for_data_on_socket_aborted_by_app
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x14011e34f
cmp qword [rsi + 0x298], 0xffffffffffffffff
jne 0x14011e2b2
mov rax, qword [rbx]
lea rdx, str.Cannot_wait_for_socket_data:_not_connected__invalid_socket_
mov rcx, rbx
call qword [rax + 0x28]
mov byte [rdi + 0x2a], 1
xor al, al
jmp 0x14011e34f
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
call fcn.140031c10
lea r15, vtable.ckFdSet.0
mov qword [rsp + 0x40], r15
mov ebx, 0x3004bc8d
mov dword [rsp + 0x50], ebx
mov dword [rbp + 0xfe0], ebx
mov dword [rsp + 0x58], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf60], xmm0
movups xmmword [rbp + 0xf70], xmm0
movups xmmword [rbp + 0xf80], xmm0
movups xmmword [rbp + 0xf90], xmm0
movups xmmword [rbp + 0xfa0], xmm0
movups xmmword [rbp + 0xfb0], xmm0
movups xmmword [rbp + 0xfc0], xmm0
movups xmmword [rbp + 0xfd0], xmm0
movsxd r9, dword [rsi + 0x298]
test r9d, r9d
jns 0x14011e375
mov byte [rdi + 0x2a], 1
xor bl, bl
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x50], r14d
mov dword [rbp + 0xfe0], r14d
lea rcx, [rsp + 0x40]
call fcn.140031cf0
movzx eax, bl
mov rcx, qword [rbp + 0xff0]
xor rcx, rsp
call fcn.1401da8c0
mov rbx, qword [rsp + 0x1148]
add rsp, 0x1100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + r14*8 + 0x60], r9
inc dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14011e32f
jne 0x14011e3a7
mov byte [rdi + 0x28], 1
jmp 0x14011e32f
mov bl, 1
jmp 0x14011e331

Function at 0x14011e3b0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xdc]
je 0x14011e3ca
mov dword [rcx + 0xdc], edx
test edx, edx
je 0x14011e3ca
mov rdx, r8
jmp fcn.14011b890
ret

Function at 0x14011e3d0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd8]
je 0x14011e3ea
mov dword [rcx + 0xd8], edx
test edx, edx
je 0x14011e3ea
mov rdx, r8
jmp fcn.14011b940
ret