joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ede0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov r11, rsp
sub rsp, 0x868
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x840], rax
test rcx, rcx
mov qword [r11 - 8], rbx
mov rbx, rcx
je 0x52eec1
cmp dword [rcx + 0x494], 0
je 0x52eec1
mov r8, rdx
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
mov edx, 0x801
mov qword [r11 - 0x10], rdi
call fcn.0052c880
mov r10, qword [rbx + 0x268]
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
test r10, r10
not rcx
lea rdi, [rcx - 1]
je 0x52ee81
mov rax, qword [rbx + 0x1b8]
lea r9, [rcx - 1]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
jmp 0x52eeb9
mov r9, qword [rbx + 0x1b0]
mov edx, 2
lea rcx, [0x006adfb8]
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x1b0]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
mov rdi, qword [rsp + 0x858]
mov rbx, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x840]
call fcn.00693b90
add rsp, 0x868
ret

Function at 0x52eee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x58
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rbx
mov r8, rdx
mov rbx, rcx
lea r9, [rsp + 0x70]
add rcx, 0x828
mov edx, 0x4000
mov qword [rsp + 0x48], rsi
call fcn.0052c880
mov rcx, qword [rbx + 0x1c0]
test rcx, rcx
je 0x52ef5c
cmp dword [rbx + 0x8878], 0
jne 0x52ef5c
lea r9, [rbx + 0x828]
lea r8, [0x006a0bd4]
mov edx, 0x100
call fcn.0052c8e0
mov dword [rbx + 0x8878], 1
cmp dword [rbx + 0x494], 0
je 0x52f00f
mov qword [rsp + 0x40], rdi
xor eax, eax
lea rdi, [rbx + 0x828]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x3fff
mov rdi, rcx
jae 0x52efa4
inc rdi
mov byte [rcx + rbx + 0x828], 0xa
mov byte [rdi + rbx + 0x828], al
mov r10, qword [rbx + 0x268]
test r10, r10
je 0x52efd0
mov rax, qword [rbx + 0x1b8]
lea r8, [rbx + 0x828]
mov r9, rdi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
jmp 0x52f00a
mov r9, qword [rbx + 0x1b0]
mov edx, 2
lea rcx, [0x006adfb8]
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x1b0]
lea rcx, [rbx + 0x828]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.00693b90
add rsp, 0x58
ret
Function at 0x52f030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov r11, rsp
sub rsp, 0x138
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xe0], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x18], rsi
mov rsi, qword [rdx]
mov qword [r11 - 0x38], r14
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rdx, [r11 + 0x20]
mov rcx, r8
mov qword [r11 - 0x40], r15
call fcn.0052d510
test rax, rax
mov r15, rax
jne 0x52f08e
lea eax, [r15 + 0x1b]
jmp 0x52f274
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x108], r13
mov rdi, r15
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov r13, r15
mov qword [rsp + 0x128], rbp
not rcx
lea rdi, [0x006a3b14]
lea r12, [rcx - 1]
nop
xor edx, edx
cmp rbx, qword [r14 + 0x1b0]
lea rcx, [rsp + 0x30]
sete dl
mov qword [rsp + 0x20], rcx
mov r9, r12
movsxd rax, edx
mov r8, r13
mov rcx, r14
mov dword [rsp + 0x30], 0
call qword [r14 + rax*8 + 0x1e0]
test rax, rax
mov rbp, rax
js 0x52f10e
xor ebx, ebx
jmp 0x52f127
mov ebx, dword [rsp + 0x30]
test ebx, ebx
je 0x52f244
cmp ebx, 0x51
jne 0x52f249
xor ebp, ebp
xor ebx, ebx
cmp dword [rsi + 0x494], 0
je 0x52f22f
cmp dword [rsi + 0x448], 0
je 0x52f1b4
mov rax, qword [r14 + 0xc0]
test rax, rax
je 0x52f1b4
mov qword [rsp + 0x28], rax
lea r9, str.Data
lea r8, str.__s__s__s_
lea rcx, [rsp + 0x40]
mov edx, 0xa0
mov qword [rsp + 0x20], rdi
call fcn.0052c8e0
mov r10, qword [rsi + 0x268]
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
test r10, r10
not rcx
lea rdi, [rcx - 1]
je 0x52f1e5
mov rax, qword [rsi + 0x1b8]
lea r9, [rcx - 1]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x52f21f
mov rdi, qword [rsi + 0x268]
test rdi, rdi
je 0x52f228
mov rax, qword [rsi + 0x1b8]
mov r9, rbp
mov r8, r13
mov edx, 4
mov rcx, rsi
mov qword [rsp + 0x20], rax
call rdi
lea rdi, [0x006a3b14]
jmp 0x52f22f
mov r9, qword [rsi + 0x1b0]
mov edx, 2
lea rcx, [0x006adfb8]
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rsi + 0x1b0]
lea rcx, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
jmp 0x52f1b4
lea rdi, [0x006a3b14]
jmp 0x52f22f
lea rdi, [0x006a3b14]
cmp rbp, r12
je 0x52f249
mov rbx, qword [rsp + 0x38]
sub r12, rbp
add r13, rbp
jmp 0x52f0d0
mov ebx, reloc.WS2_32.dll_getservbyname
mov rcx, r15
call qword [sub.msvcrt.dll_free]
mov r13, qword [rsp + 0x108]
mov r12, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
mov rbp, qword [rsp + 0x128]
mov eax, ebx
mov r15, qword [rsp + 0xf8]
mov r14, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0xe0]
call fcn.00693b90
add rsp, 0x138
ret
Function at 0x52f380
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
xor eax, eax
cmp rdx, qword [rcx + 0x1b0]
mov r10, r9
sete al
mov r11, r8
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rdi, rcx
mov rcx, qword [rcx + rax*8 + 0x1a8]
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
call qword [sym.imp.WS2_32.dll_send]
movsxd rsi, eax
cmp rsi, 0xffffffffffffffff
jne 0x52f441
mov qword [rsp + 0x30], rbx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebx, eax
jne 0x52f3fa
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x30]
lea eax, [rsi + 0x52]
mov qword [rcx], 0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
add rsp, 0x38
ret
mov edx, eax
mov rcx, rdi
call fcn.0052bc00
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.0052eee0
mov r11, qword [rdi]
mov rcx, qword [rsp + 0x60]
mov dword [r11 + 0x887c], ebx
mov rbx, qword [rsp + 0x30]
mov eax, reloc.WS2_32.dll_getservbyname
mov qword [rcx], rsi
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov qword [rcx], rsi
mov rsi, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x53e5c0
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
xor esi, esi
cmp dword [rcx + 0x68c], esi
mov eax, esi
mov qword [r11 + 0x20], rdi
mov rdi, rdx
mov rbx, rcx
setne al
lea r9, [r11 - 0x28]
lea r8d, [rsi + 8]
mov edx, 0xffff
mov rcx, rdi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x53e623
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov r8, rdi
mov rcx, rbx
call fcn.0052ede0
jmp 0x53e6b2
mov ecx, dword [rbx + 0x690]
mov dword [rsp + 0x58], 1
call fcn.00566be0
mov ecx, dword [rbx + 0x694]
imul eax, eax, 0x3e8
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x5c], eax
call fcn.00566be0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x58]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov edx, 0x98000004
imul eax, eax, 0x3e8
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x53e6b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r8d, edi
mov r9d, eax
mov rcx, rbx
call fcn.0052ede0
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
add rsp, 0x78
ret
Function at 0x53f170
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov r10, rdx
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx]
mov eax, dword [rbx + 0x4c4]
mov edx, 6
mov qword [rsp + 0x58], rdi
mov rdi, rcx
lea r9, [rsp + 0x40]
lea r8d, [rdx - 5]
mov rcx, r10
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x53f1e5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
call fcn.0052bc00
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.0052ede0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.0052ede0
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret

Function at 0x53f210
Capabilities:
Check os version
Set socket configuration

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0xe0], rax
mov eax, dword [0x007736c8]
mov rbx, rcx
mov dword [rsp + 0x30], 0x4020
test eax, eax
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
jne 0x53f2ad
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, __WSAFDIsSet
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], __WSAFDIsSet
mov dword [0x007736c8], 1
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x53f2a7
cmp dword [rsp + 0x44], 6
jb 0x53f2a7
mov dword [0x007736c8], 2
mov rcx, qword [rsp + 0xe0]
call fcn.00693b90
add rsp, 0xf0
pop rbx
ret
mov eax, dword [0x007736c8]
cmp eax, 2
je 0x53f304
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x53f2e3
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
jg 0x53f304
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0xe0]
call fcn.00693b90
add rsp, 0xf0
pop rbx
ret

Function at 0x53f340
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
mov rbx, qword [rcx + 0x810]
mov qword [rsp + 0x60], rsi
test rbx, rbx
mov qword [rsp + 0x68], rdi
mov rsi, rdx
mov rdi, rcx
je 0x53f3a5
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x53f3a5
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], 0
mov rcx, qword [rcx + 0x60]
lea r8, [0x0053f320]
lea rdx, [rsp + 0x28]
call fcn.00564710
cmp dword [rsp + 0x30], 0
jne 0x53f3c0
mov qword [rdi + 0x810], 0
mov rax, 0xffffffffffffffff
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
test rsi, rsi
je 0x53f3c8
mov qword [rsi], rbx
cmp dword [rbx + 0x1f0], 0
mov rdi, qword [rbx + 0x1a8]
je 0x53f3e6
mov rcx, rbx
call fcn.0052e360
test eax, eax
jne 0x53f402
jmp 0x53f3a5
mov r9d, 2
lea rdx, [rsp + 0x20]
mov rcx, rdi
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x53f3a5
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rdi, qword [rsp + 0x68]
add rsp, 0x48
ret
Function at 0x5400c0
Capabilities:
Parse pe header

Disassembly:
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x5400df
lea r8, [0x00400000]
cdqe
mov edx, dword [r8 + rax*4 + 0x140134]
add rdx, r8
jmp rdx
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, Ordinal_79
ret
mov al, reloc.WLDAP32.dll_Ordinal_79
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x5406a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
movzx r9d, byte [rcx]
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x54082d
lea rdx, [0x00400000]
movzx r10d, byte [rbx]
test r10b, r10b
je 0x54082d
test r8, r8
je 0x540832
movsx eax, r9b
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x5406f2
cdqe
mov ecx, dword [rdx + rax*4 + 0x140864]
add rcx, rdx
jmp rcx
mov r9b, 0x41
jmp case.default.0x5406f2
mov r9b, 0x42
jmp case.default.0x5406f2
mov r9b, 0x43
jmp case.default.0x5406f2
mov r9b, 0x44
jmp case.default.0x5406f2
mov r9b, 0x45
jmp case.default.0x5406f2
mov r9b, 0x46
jmp case.default.0x5406f2
mov r9b, 0x47
jmp case.default.0x5406f2
mov r9b, 0x48
jmp case.default.0x5406f2
mov r9b, 0x49
jmp case.default.0x5406f2
mov r9b, 0x4a
jmp case.default.0x5406f2
mov r9b, 0x4b
jmp case.default.0x5406f2
mov r9b, 0x4c
jmp case.default.0x5406f2
mov r9b, Ordinal_79
jmp case.default.0x5406f2
mov r9b, Ordinal_79
jmp case.default.0x5406f2
mov r9b, reloc.WLDAP32.dll_Ordinal_79
jmp case.default.0x5406f2
mov r9b, 0x50
jmp case.default.0x5406f2
mov r9b, 0x51
jmp case.default.0x5406f2
mov r9b, 0x52
jmp case.default.0x5406f2
mov r9b, 0x53
jmp case.default.0x5406f2
mov r9b, 0x54
jmp case.default.0x5406f2
mov r9b, 0x55
jmp case.default.0x5406f2
mov r9b, 0x56
jmp case.default.0x5406f2
mov r9b, 0x57
jmp case.default.0x5406f2
mov r9b, 0x58
jmp case.default.0x5406f2
mov r9b, 0x59
jmp case.default.0x5406f2
mov r9b, 0x5a
movsx eax, r10b
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x540790
cdqe
mov ecx, dword [rdx + rax*4 + 0x1408cc]
add rcx, rdx
jmp rcx
mov r10b, 0x41
jmp case.default.0x540790
mov r10b, 0x42
jmp case.default.0x540790
mov r10b, 0x43
jmp case.default.0x540790
mov r10b, 0x44
jmp case.default.0x540790
mov r10b, 0x45
jmp case.default.0x540790
mov r10b, 0x46
jmp case.default.0x540790
mov r10b, 0x47
jmp case.default.0x540790
mov r10b, 0x48
jmp case.default.0x540790
mov r10b, 0x49
jmp case.default.0x540790
mov r10b, 0x4a
jmp case.default.0x540790
mov r10b, 0x4b
jmp case.default.0x540790
mov r10b, 0x4c
jmp case.default.0x540790
mov r10b, Ordinal_79
jmp case.default.0x540790
mov r10b, Ordinal_79
jmp case.default.0x540790
mov r10b, reloc.WLDAP32.dll_Ordinal_79
jmp case.default.0x540790
mov r10b, 0x50
jmp case.default.0x540790
mov r10b, 0x51
jmp case.default.0x540790
mov r10b, 0x52
jmp case.default.0x540790
mov r10b, 0x53
jmp case.default.0x540790
mov r10b, 0x54
jmp case.default.0x540790
mov r10b, 0x55
jmp case.default.0x540790
mov r10b, 0x56
jmp case.default.0x540790
mov r10b, 0x57
jmp case.default.0x540790
mov r10b, 0x58
jmp case.default.0x540790
mov r10b, 0x59
jmp case.default.0x540790
mov r10b, 0x5a
cmp r9b, r10b
jne 0x54082d
mov r9b, byte [r11 + 1]
inc r11
dec r8
inc rbx
test r9b, r9b
jne 0x5406c0
test r8, r8
jne 0x54083d
mov eax, 1
add rsp, 0x20
pop rbx
ret
movzx ecx, byte [r11]
call fcn.005400c0
movzx ecx, byte [rbx]
movzx r9d, al
call fcn.005400c0
xor ecx, ecx
cmp r9b, al
sete cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x540940
Capabilities:
Parse pe header

Disassembly:
cmp r8, 1
mov r10, rcx
jb 0x540a13
lea r11, [0x00400000]
movsx r9d, byte [rdx]
lea eax, [r9 - 0x61]
cmp eax, 0x19
ja case.default.0x540972
cdqe
mov ecx, dword [r11 + rax*4 + 0x140a18]
add rcx, r11
jmp rcx
mov r9b, 0x41
jmp case.default.0x540972
mov r9b, 0x42
jmp case.default.0x540972
mov r9b, 0x43
jmp case.default.0x540972
mov r9b, 0x44
jmp case.default.0x540972
mov r9b, 0x45
jmp case.default.0x540972
mov r9b, 0x46
jmp case.default.0x540972
mov r9b, 0x47
jmp case.default.0x540972
mov r9b, 0x48
jmp case.default.0x540972
mov r9b, 0x49
jmp case.default.0x540972
mov r9b, 0x4a
jmp case.default.0x540972
mov r9b, 0x4b
jmp case.default.0x540972
mov r9b, 0x4c
jmp case.default.0x540972
mov r9b, Ordinal_79
jmp case.default.0x540972
mov r9b, Ordinal_79
jmp case.default.0x540972
mov r9b, reloc.WLDAP32.dll_Ordinal_79
jmp case.default.0x540972
mov r9b, 0x50
jmp case.default.0x540972
mov r9b, 0x51
jmp case.default.0x540972
mov r9b, 0x52
jmp case.default.0x540972
mov r9b, 0x53
jmp case.default.0x540972
mov r9b, 0x54
jmp case.default.0x540972
mov r9b, 0x55
jmp case.default.0x540972
mov r9b, 0x56
jmp case.default.0x540972
mov r9b, 0x57
jmp case.default.0x540972
mov r9b, 0x58
jmp case.default.0x540972
mov r9b, 0x59
jmp case.default.0x540972
mov r9b, 0x5a
mov byte [r10], r9b
movzx eax, byte [rdx]
inc r10
inc rdx
test al, al
je 0x540a13
dec r8
jne 0x540954
ret 0
Function at 0x545e00
Capabilities:
Resolve dns

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x68
mov qword [rsp + 0x58], rbp
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov r13, qword [rsp + 0x90]
mov qword [rsp + 0x30], r14
mov qword [rbp], 0
mov qword [rsp + 0x28], r15
movzx r14d, r9w
mov byte [r13], 0
mov r15d, r8d
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
mov r12, rax
je 0x545f5e
cmp word [rax + 0x10], 2
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
jne 0x545f0d
cmp word [rax + 0x12], 4
jne 0x545f0d
mov rdi, qword [rax + 0x18]
mov rcx, qword [rdi]
test rcx, rcx
je 0x545f0d
nop
mov esi, dword [rcx]
mov edx, gethostbyaddr
lea ecx, [rdx - 0x2f]
call qword [sym.imp.msvcrt.dll_calloc]
test rax, rax
mov rbx, rax
je 0x545ef3
mov edx, reloc.WS2_32.dll_recv
lea ecx, [rdx - 0xf]
call qword [sym.imp.msvcrt.dll_calloc]
test rax, rax
jne 0x545ec8
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
xor ebx, ebx
jmp 0x545ef3
mov ecx, dword [rsp + 0x78]
mov word [rax], 2
mov word [rax + 2], r14w
mov dword [rax + 4], esi
mov dword [rbx + 8], ecx
mov dword [rbx + 4], 2
mov dword [rbx + 0xc], r15d
mov qword [rbx + reloc.WS2_32.dll_recv], 0x10
mov qword [rbx + 0x20], rax
test rbx, rbx
mov qword [rbp], rbx
je 0x545f57
mov rcx, qword [rdi + 8]
add rdi, 8
lea rbp, [rbx + 0x28]
test rcx, rcx
jne 0x545e90
mov rdx, qword [r12]
mov r8d, 0x400
mov rcx, r13
call qword [sym.imp.msvcrt.dll_strncpy]
mov byte [r13 + 0x400], 0
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x68
ret
mov eax, 8
jmp 0x545f2a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x545f75
dec eax
je 0x545f83
dec eax
je 0x545f7c
dec eax
mov eax, 0x2af9
jmp 0x545f39
mov eax, 0x2afb
jmp 0x545f39
mov eax, 0x2afa
jmp 0x545f39
Function at 0x5469c0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
sub rsp, 0x288
mov rax, qword [0x0072f1d0]
mov qword [rsp + reloc.MFC42u.dll_CDaoException::CDaoException], rax
cmp dword [0x007736d0], 0
lea rax, [0x00546320]
mov qword [r11 + 0x10], rbp
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
mov qword [r11 - 8], r12
mov qword [rsp + 0x30], rax
lea rax, [0x005466f0]
lea r12, str.getaddrinfo
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
movzx ebp, cx
mov qword [rsp + 0x40], rax
lea rax, [0x005462b0]
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x48], rax
jne 0x546b9a
lea rcx, [r11 - 0x128]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x546b90
mov qword [rsp + 0x290], rbx
xor ebx, ebx
mov rcx, rbx
movzx eax, byte [rsp + rcx + 0x160]
inc rcx
test al, al
mov byte [rsp + rcx + 0x4f], al
jne 0x546a60
xor eax, eax
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rdi
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.ws2_32]
lea rcx, [rsp + 0x50]
mov qword [rdi - 1], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x546acb
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x546b2d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, rbx
nop
movzx eax, byte [rsp + rdx + 0x160]
inc rdx
test al, al
mov byte [rsp + rdx + 0x4f], al
jne 0x546ad0
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.wship6]
lea rcx, [rsp + 0x50]
mov qword [rdi - 1], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x546b78
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x546b2d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x546b78
lea rdi, [rsp + 0x28]
mov rdx, qword [rdi - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [rdi], rax
je 0x546b22
inc rbx
add rdi, 0x10
cmp rbx, 3
jl 0x546b32
mov rax, qword [rsp + 0x28]
mov qword [0x0072f220], rax
mov rax, qword [rsp + 0x38]
mov qword [0x0072f230], rax
mov rax, qword [rsp + 0x48]
mov qword [0x0072f240], rax
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x290]
mov dword [0x007736d0], 1
mov r12, qword [rsp + 0x280]
movzx eax, bp
mov rbp, qword [rsp + 0x298]
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + reloc.MFC42u.dll_CDaoException::CDaoException]
call fcn.00693b90
add rsp, 0x288
ret

Function at 0x5473e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
je 0x54740a
cmp rax, 0xffffffffffffffff
jne 0x54740c
xor eax, eax
add rsp, 0x38
ret
Function at 0x5541a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov r8d, dword [rcx]
test r8d, r8d
mov r9, qword [rax]
je 0x55420e
dec r8d
je 0x554205
dec r8d
je 0x5541fc
dec r8d
mov rcx, r9
je 0x5541e2
lea r8, str.Internal_state_machine_error
lea rdx, [0x006a0bd4]
call fcn.0052eee0
mov eax, 0x47
add rsp, 0x28
ret
lea r8, str.TFTP_finished
lea rdx, [0x006aecd4]
call fcn.0052ede0
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.00553320
add rsp, 0x28
jmp fcn.00552ff0
add rsp, 0x28
jmp fcn.00553c10
Function at 0x5566f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0x494], 0
movsxd r10, r9d
mov r11, rcx
je 0x55681f
cmp r8d, 0xff
jne 0x556754
lea eax, [r10 - 0xec]
mov r8, rdx
cmp eax, 0x13
ja 0x556741
lea rcx, [0x00400000]
lea rdx, str._s_IAC__s_n
mov r9, qword [rcx + r10*8 + 0x2b19f0]
mov rcx, r11
add rsp, 0x38
jmp fcn.0052ede0
lea rdx, str._s_IAC__d_n
mov r9d, r10d
add rsp, 0x38
jmp fcn.0052ede0
cmp r8d, 0xfb
jne 0x556766
lea r9, str.WILL
jmp 0x5567a4
cmp r8d, 0xfc
jne 0x556778
lea r9, str.WONT
jmp 0x5567a4
cmp r8d, 0xfd
jne 0x55678a
lea r9, [0x006b2284]
jmp 0x5567a4
xor r9d, r9d
cmp r8d, 0xfe
lea rax, str.DONT
cmove r9, rax
test r9, r9
je 0x556808
cmp r10d, 0x27
jg 0x5567da
lea rcx, [0x00400000]
mov rcx, qword [rcx + r10*8 + 0x2b2010]
test rcx, rcx
je 0x5567ec
mov r8, rdx
mov qword [rsp + 0x20], rcx
lea rdx, str._s__s__s_n
mov rcx, r11
call fcn.0052ede0
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x5567ec
lea rcx, str.EXOPL
jmp 0x5567be
mov r8, rdx
lea rdx, str._s__s__d_n
mov rcx, r11
mov dword [rsp + 0x20], r10d
call fcn.0052ede0
add rsp, 0x38
ret
mov r9d, r8d
mov r8, rdx
lea rdx, str._s__d__d_n
mov dword [rsp + 0x20], r10d
call fcn.0052ede0
add rsp, 0x38
ret

Function at 0x556830
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
sub rsp, 0x38
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbp, qword [rcx]
mov qword [rax + 0x18], rsi
xor r9d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 0x1a8]
mov qword [rax + 0x20], rdi
mov byte [rax - 0x17], dl
mov edi, r8d
mov esi, edx
mov byte [rax - 0x16], r8b
lea r8d, [r9 + 3]
lea rdx, [rax - 0x18]
mov byte [rax - 0x18], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x556891
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.0052eee0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.005566f0
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret