joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800382a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801878e0]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0xa4], 2
mov rbx, rdx
mov rsi, qword [rcx]
mov rdi, rcx
je 0x18003846d
cmp byte [rcx + 0x34a], 0
jne 0x180038465
cmp byte [rcx + 0x366], 0
jne 0x180038465
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_133
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x180038342
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180043a90
mov r9, rax
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.180036d50
jmp 0x18003846d
xor edx, edx
mov dword [rsp + 0x20], Ordinal_133
mov r8d, Ordinal_133
lea rcx, [rsp + 0x30]
call fcn.18007f510
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x18003839f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180043a90
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.180036d50
jmp 0x18003846d
lea rbx, [rdi + 0x16e]
mov rdx, rbx
lea r8, [rdi + 0x19c]
lea rcx, [rsp + 0xb0]
call fcn.180038900
test al, al
jne 0x1800383ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180043a90
mov r9, rax
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.180036d50
jmp 0x18003846d
movups xmm0, xmmword [rbx]
mov eax, dword [rbx + 0x28]
lea r8, [rdi + 0x1d0]
movups xmm1, xmmword [rbx + 0x10]
lea rdx, [rdi + 0x1a0]
movups xmmword [rdi + 0x70], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rbx + 0x20]
movups xmmword [rdi + 0x80], xmm1
movsd qword [rdi + 0x90], xmm0
mov dword [rdi + 0x98], eax
movzx eax, word [rbx + 0x2c]
mov word [rdi + 0x9c], ax
call fcn.180038900
test al, al
jne 0x180038465
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call fcn.180043a90
mov r9, rax
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.180036d50
jmp 0x18003846d
mov rcx, rdi
call fcn.180037ea0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18005ef00
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180038c30
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1801878e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0x764], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x180038c9f
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, rbx
call fcn.180036e20
jmp 0x180038d2e
mov ecx, dword [rbx + 0x768]
mov dword [rsp + 0x58], 1
call fcn.180042460
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0x76c]
call fcn.180042460
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, Ordinal_14
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x180038d2e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r9d, eax
mov rcx, rbx
call fcn.180036e20
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18005ef00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180042400
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
mov rcx, r8
call fcn.180042480
mov r8d, eax
mov rdx, rbx
mov ecx, edi
call fcn.180091ac0
mov rbx, qword [rsp + 0x30]
cdqe
add rsp, 0x20
pop rdi
ret

Function at 0x180043690
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15, r9
mov qword [r9], r12
mov esi, r12d
lea r9, [rsp + 0x68]
mov r14d, r12d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebp, eax
test eax, eax
jne 0x180043808
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1800437f1
mov qword [rsp + 0x58], rdi
nop dword [rax]
cmp dword [rbx + 4], 2
jne 0x180043788
cmp qword [rbx + 0x20], r12
je 0x180043788
cmp qword [rbx + 0x10], 0x10
jb 0x180043788
mov ecx, 0x30
call qword [fcn.1800819ac]
mov rdi, rax
test rax, rax
je 0x1800437c1
mov ecx, dword [rbx]
mov dword [rax], ecx
mov ecx, dword [rbx + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 0xc]
mov dword [rax + 0xc], ecx
mov ecx, reloc.WS2_32.dll_recv
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
mov qword [rax + 0x20], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x28], r12
call qword [fcn.1800819ac]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1800437b1
mov rcx, qword [rbx + 0x20]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180043775
call qword [case.0x18002d7a6.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x180043797
test rsi, rsi
cmove rsi, rdi
test r14, r14
je 0x180043785
mov qword [r14 + 0x28], rdi
mov r14, rdi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800436e0
jmp 0x1800437c6
mov rcx, qword [rdi + 0x20]
mov ebp, 8
call qword [fcn.180081628]
mov rcx, rdi
call qword [fcn.180081628]
jmp 0x1800437c6
mov rcx, rdi
mov ebp, 8
call qword [fcn.180081628]
jmp 0x1800437c6
mov ebp, 8
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
test rcx, rcx
je 0x1800437db
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x1800437ec
mov rcx, rsi
call fcn.180043640
mov rsi, r12
jmp 0x1800437fe
test rsi, rsi
jne 0x1800437fe
mov ebp, 0x2af9
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov qword [r15], rsi
add rsp, 0x20
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x180044460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov rax, r8
mov r10, rdx
cmp ecx, 2
je 0x180044481
mov ecx, 0x273f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
ret
mov r8, r9
mov rdx, rax
mov rcx, r10
add rsp, 0x28
jmp 0x1800444a0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1801878e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx + 3]
mov rbx, rdx
movzx edx, byte [rcx + 2]
mov rdi, r8
movzx r10d, byte [rcx + 1]
lea r8, str._d._d._d._d
movzx r9d, byte [rcx]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
mov edx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r10d
call fcn.180039460
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180044501
test rax, rax
je 0x180044544
cmp rax, rdi
jae 0x180044544
lea rax, [rsp + 0x40]
mov r8, rbx
sub r8, rax
lea rcx, [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rcx]
mov byte [r8 + rcx], dl
lea rcx, [rcx + 1]
test dl, dl
jne 0x180044530
mov rax, rbx
jmp 0x180044551
mov ecx, 0x1c
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18005ef00
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x180045220
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1801878e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180045266
mov r8d, eax
lea rdx, str.WSAStartup_failed___d_
mov rcx, rbx
call fcn.180036d50
jmp 0x180045290
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x180045281
shr ax, 8
test al, al
jne 0x180045281
xor eax, eax
jmp 0x180045295
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.180036d50
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18005ef00
add rsp, 0x1d0
pop rbx
ret

Function at 0x1800459a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x198]
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x180045a24
sub r8d, 1
je 0x1800459fb
cmp r8d, 1
jne 0x180045a38
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x180045a1c
cmp ecx, r8d
jne 0x180045a38
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
jmp fcn.180045bc0
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x180045a1c
cmp ecx, 1
jne 0x180045a38
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
jmp fcn.180045bc0
ret
Function at 0x180045a40
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x198]
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x180045ae7
sub r8d, 2
je 0x180045aa0
cmp r8d, 1
jne 0x180045ad9
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180045a93
cmp ecx, r8d
jne 0x180045ad9
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
ret
mov dword [r9 + r10*4 + 0xc08], 0
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180045ada
cmp ecx, 1
jne 0x180045ad9
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
jmp fcn.180045bc0
ret
mov dword [r9 + r10*4 + 0xc08], 1
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x180045acc
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
jmp fcn.180045bc0

Function at 0x180045b10
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x198]
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x180045ba0
sub r8d, 1
je 0x180045b71
cmp r8d, 1
jne 0x180045bb7
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180045b95
cmp ecx, r8d
jne 0x180045bb7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.180045bc0
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180045b95
cmp ecx, 1
jne 0x180045bb7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.180045bc0
ret

Function at 0x180045bc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x210]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x180045c1f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180036d50
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1800453c0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180045d70
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x180045f1e
push rbp
push rdi
push r14
sub rsp, 0x30
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdi, qword [rbp + 0x198]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x180045db9
mov byte [rsi], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180045dc7
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180045dd5
mov byte [rax], 0x1f
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x58], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r8d, ax
mov word [rsp + 0x50], ax
cmp rcx, rbx
jae 0x180045e0f
mov byte [rcx], r15b
inc qword [rbx]
mov rdx, qword [rbx]
mov r15, qword [rsp + 0x20]
cmp rdx, rbx
jae 0x180045e26
movzx ecx, byte [rsp + 0x59]
mov byte [rdx], cl
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180045e34
mov byte [rax], r8b
inc qword [rbx]
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x180045e46
movzx eax, byte [rsp + 0x51]
mov byte [rcx], al
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180045e54
mov byte [rax], 0xff
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x180045e62
mov byte [rax], 0xf0
inc qword [rbx]
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov r9, rax
mov qword [rdi + 0x1ec0], rax
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.180045500
mov rcx, qword [r14 + 0x210]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
test eax, eax
jns 0x180045eca
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180036d50
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.180045c50
mov rcx, qword [r14 + 0x210]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x180045f16
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180036d50
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret

Function at 0x180045f20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
movsxd r11, edx
mov r9, qword [rax + 0x198]
cmp r8d, 1
jne 0x180045f7e
mov r8d, dword [r9 + r11*4 + 8]
test r8d, r8d
je 0x180045f67
sub r8d, 2
je 0x180045f92
cmp r8d, 1
jne 0x180045fc5
cmp dword [r9 + r11*4 + 0x408], 0
jne 0x180045fc5
mov dword [r9 + r11*4 + 0x408], 1
pop rbx
ret
mov edx, 0xfb
mov dword [r9 + r11*4 + 8], 2
mov r8d, r11d
pop rbx
jmp fcn.180045bc0
mov ecx, dword [r9 + r11*4 + 8]
sub ecx, 1
je 0x180045fab
sub ecx, 1
je 0x180045f4e
cmp ecx, 1
jne 0x180045fc5
cmp dword [r9 + r11*4 + 0x408], 1
jne 0x180045fc5
mov dword [r9 + r11*4 + 0x408], 0
pop rbx
ret
mov edx, 0xfc
mov dword [r9 + r11*4 + 8], 3
mov rcx, rbx
mov r8d, r11d
pop rbx
jmp fcn.180045bc0
pop rbx
ret
Function at 0x180045fd0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
movsxd r11, edx
mov r9, qword [rax + 0x198]
cmp r8d, 1
jne 0x180046038
mov r8d, dword [r9 + r11*4 + 0xc08]
test r8d, r8d
je 0x18004601e
sub r8d, 2
je 0x18004604f
cmp r8d, 1
jne 0x180046085
cmp dword [r9 + r11*4 + 0x1008], 0
jne 0x180046085
mov dword [r9 + r11*4 + 0x1008], 1
pop rbx
ret
mov edx, 0xfd
mov dword [r9 + r11*4 + 0xc08], 2
mov r8d, r11d
pop rbx
jmp fcn.180045bc0
mov ecx, dword [r9 + r11*4 + 0xc08]
sub ecx, 1
je 0x180046068
sub ecx, 1
je 0x180046005
cmp ecx, 1
jne 0x180046085
cmp dword [r9 + r11*4 + 0x1008], 1
jne 0x180046085
mov dword [r9 + r11*4 + 0x1008], 0
pop rbx
ret
mov edx, 0xfe
mov dword [r9 + r11*4 + 0xc08], 3
mov rcx, rbx
mov r8d, r11d
pop rbx
jmp fcn.180045bc0
pop rbx
ret
Function at 0x180047210
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1801878e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0x5e0]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], Ordinal_133
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
lea rsi, [rbx + 0x168]
mov rdx, qword [rsi]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1800472b4
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.18007f700
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r9d, dword [rbx + 0x154]
cmp r9d, 4
jge 0x180047303
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.180036d50
mov dword [rbx + 0xc], 7
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18005ef00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, rsi
call fcn.180046d50
movzx r8d, ax
mov dword [rbx + 0xc], r8d
sub r8d, 3
je 0x180047392
sub r8d, 1
je 0x180047401
sub r8d, 1
je 0x18004736a
cmp r8d, 1
je 0x18004734a
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1800ca738]
call fcn.180036d50
jmp 0x180047401
mov rdx, qword [rsi]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rbx
call fcn.180046f60
test eax, eax
je 0x180047401
jmp 0x1800472d9
mov rcx, rsi
call fcn.180046d30
movzx r8d, ax
lea rdx, [0x1800af57c]
mov dword [rbx + 8], r8d
mov rcx, rdi
mov r8, qword [rsi]
add r8, 4
call fcn.180036e20
jmp 0x180047401
cmp r9d, 4
jle 0x180047401
mov rcx, rsi
call fcn.180046d30
movzx ecx, word [rbx + 0x48]
inc ecx
cmp cx, ax
jne 0x180047401
mov r8, qword [rsi]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, r14
call fcn.180036c20
mov esi, eax
test eax, eax
je 0x1800473e0
mov edx, 5
mov rcx, rbx
call fcn.180047c60
mov eax, esi
jmp 0x1800472d9
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xb0], rax
mov rdx, qword [rdi + 0xb0]
call fcn.180041810
mov rcx, r14
call fcn.180041b10
test eax, eax
je 0x1800472d7
mov edx, 5
mov rcx, rbx
call fcn.180047c60
mov eax, Ordinal_46
jmp 0x1800472d9
Function at 0x18004e620
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1801878e0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x218]
lea r8, [rsp + 0x20]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rcx, rbp
or rdi, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x18004e691
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.180037750
mov rcx, rsi
cmp rdi, 0xffffffffffffffff
jne 0x18004e6b6
lea rdx, str.Error_accept__ing_server_connect
call fcn.180036d50
lea eax, [rdi + 0x1f]
jmp 0x18004e717
lea rdx, str.Connection_accepted_from_server_n
call fcn.180036e20
mov byte [rbx + 0x354], 0
mov edx, 1
mov rcx, rdi
mov qword [rbx + 0x218], rdi
call fcn.180057f20
mov byte [rbx + 0x231], 1
mov rax, qword [rsi + 0x268]
test rax, rax
je 0x18004e715
mov rcx, qword [rsi + 0x270]
mov r8d, 1
mov rdx, rdi
call rax
test eax, eax
je 0x18004e715
mov rcx, rbx
call fcn.18004ebe0
mov eax, Ordinal_46
jmp 0x18004e717
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18005ef00
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x18004f880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x5e0
cmp byte [rcx + 0x8a], 0
jne 0x18004f92d
xor r9d, r9d
mov dword [rcx + 0xa0], r9d
mov edx, r9d
mov rax, qword [rbx]
cmp dword [rax + 0x4fc], 2
sete dl
mov dword [rcx + 0xa4], edx
cmp byte [rbx + 0x34a], r9b
je 0x18004f8f6
mov r8, qword [rcx + 0x68]
test r8, r8
je 0x18004f8f6
lea rdx, str.CWD__s
mov dword [rcx + 0x9c], r9d
call fcn.18005ad80
test eax, eax
jne 0x18004f93a
lea edx, [rax + 0x10]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18004ebd0
cmp dword [rcx + 0x78], r9d
je 0x18004f92d
mov r8, qword [rcx + 0x70]
lea rdx, str.CWD__s
mov dword [rcx + 0x9c], 1
mov r8, qword [r8]
call fcn.18005ad80
test eax, eax
jne 0x18004f93a
lea edx, [rax + 0x10]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18004ebd0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18004fcf0
add rsp, 0x20
pop rbx
ret

Function at 0x18004fcf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
add rcx, 0x5e0
cmp byte [rax + 0x511], 0
jne 0x18004fd15
cmp dword [rax + 0x370], 0
je 0x18004fd41
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x18004fd41
lea rdx, str.MDTM__s
call fcn.18005ad80
test eax, eax
jne 0x18004fd4e
lea edx, [rax + 0x12]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18004ebd0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180050d70
add rsp, 0x20
pop rbx
ret
Function at 0x1800504a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx]
lea eax, [rdx - 0xc8]
mov ebx, dword [rcx + 0x67c]
mov rdi, rcx
cmp eax, 0x64
jb 0x180050521
test ebx, ebx
jne 0x1800504df
lea rdx, str.disabling_EPRT_usage_n
mov rcx, rsi
call fcn.180036e20
mov byte [rdi + 0x35d], bl
inc ebx
cmp ebx, 2
jne 0x180050508
lea rdx, str.Failed_to_do_PORT
mov rcx, rsi
call fcn.180036d50
lea eax, [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180051110
lea rdx, str.Connect_data_stream_actively_n
mov rcx, rsi
call fcn.180036e20
xor edx, edx
mov rcx, rdi
call fcn.18004ebd0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18004ed40
Function at 0x180050860
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x198]
cmp dword [rdx + 0x18], 0
je 0x1800508ad
cmp qword [rcx + 0x660], 0
je 0x1800508ad
add rcx, 0x5e0
lea rdx, str.REST__d
xor r8d, r8d
call fcn.18005ad80
test eax, eax
jne 0x1800508b7
lea edx, [rax + 0x1a]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18004ebd0
add rsp, 0x20
pop rbx
jmp fcn.180050550
add rsp, 0x20
pop rbx
ret

Function at 0x180050b60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x5e0
mov rax, qword [rbx]
mov rdx, qword [rax + 0x198]
cmp dword [rdx + 0x18], 1
jne 0x180050bac
mov r8, qword [rcx + 0x80]
test r8, r8
je 0x180050bac
lea rdx, str.SIZE__s
call fcn.18005ad80
test eax, eax
jne 0x180050bb9
lea edx, [rax + 0x17]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18004ebd0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180050860
add rsp, 0x20
pop rbx
ret

Function at 0x180050d70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov r10, qword [rcx]
mov r9, rcx
cmp byte [r10 + 0x520], 0
je 0x180050dc7
cmp qword [rcx + 0x660], 0
je 0x180050dc7
movzx edx, byte [r10 + 0x513]
call fcn.18004ef80
test eax, eax
je 0x180050dc7
mov rax, qword [r10 + 0x198]
mov r8d, reloc.WS2_32.dll_send
mov rcx, r9
mov dword [rax + 0x18], 1
movzx edx, byte [r10 + 0x513]
add rsp, 0x28
jmp fcn.18004eef0
mov rcx, r9
add rsp, 0x28
jmp fcn.180050b60