joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003fce0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1003fd3d
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1003fd37
shr ax, 8
cmp al, 2
jne 0x1003fd37
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x1d8
ret

Function at 0x10048be0
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
lea rsi, [rcx + rdx]
cmp rcx, rsi
mov qword [rsp + 0x48], rdi
mov rbx, rcx
mov edi, 0x1505
jae 0x10048c20
movzx ecx, byte [rbx]
call fcn.1004a960
add rbx, 1
movsx rdx, al
imul rdi, rdi, 0x21
xor rdi, rdx
cmp rbx, rsi
jb 0x10048c04
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
movzx eax, dil
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
je 0x10048c76
call fcn.100489d0
test eax, eax
jne 0x10048c76
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.10048b20
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x10048be0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x10048c40
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
lea rsi, [rcx + rdx]
cmp rcx, rsi
mov qword [rsp + 0x48], rdi
mov rbx, rcx
mov edi, 0x1505
jae 0x10048c20
movzx ecx, byte [rbx]
call fcn.1004a960
add rbx, 1
movsx rdx, al
imul rdi, rdi, 0x21
xor rdi, rdx
cmp rbx, rsi
jb 0x10048c04
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
movzx eax, dil
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
je 0x10048c76
call fcn.100489d0
test eax, eax
jne 0x10048c76
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.10048b20
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x10048be0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1004b210
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9d, ecx
mov rcx, r8
call fcn.1004b1d0
mov ecx, r9d
mov r8d, eax
call fcn.10035c50
cdqe
add rsp, 0x28
ret

Function at 0x1004b500
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1004b53b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, reloc.WS2_32.dll_getservbyport
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1004b6c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp qword [rcx + 0x2c8], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rbp, r8
mov rdi, rcx
mov rsi, r9
movsxd rbx, edx
je 0x1004b725
mov edx, 1
call fcn.1004e960
mov r11, qword [rdi + 0x218]
mov r9, rsi
mov r8, rbp
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [rdi + 0x2c8]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1004e960
mov eax, ebx
jmp 0x1004b76b
test edx, edx
js 0x1004b769
cmp ebx, 2
jg 0x1004b769
mov r9, qword [rdi + 0x210]
lea rdx, [0x1008c7b8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.10081bc0
mov r9, qword [rdi + 0x210]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.10081bc0
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1004bd80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov rsi, rcx
movsxd rcx, edx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsi + 0x440]
mov rbp, qword [rsi + rcx*8 + 0x238]
lea rbx, [rcx + 0x14]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x1004be63
lea rax, [0x1004baa0]
cmp qword [rsi + rcx*8 + 0x260], rax
jne 0x1004be63
cmp qword [rbx], 0
je 0x1004bdea
test rdi, rdi
je 0x1004be63
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov rcx, rbp
mov r8, rdx
call fcn.1004c050
cmp eax, 0xffffffff
je 0x1004be63
test al, 1
je 0x1004be63
cmp qword [rbx], 0
jne 0x1004be42
mov rax, qword [rsi]
mov ecx, dword [rax + 0x740]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [fcn.10021ff0]
mov rdi, qword [rbx + 8]
xor ecx, ecx
test rax, rax
mov qword [rbx], rax
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
jne 0x1004be42
mov qword [rbx + 8], rcx
jmp 0x1004be63
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, edi
add rdx, qword [rbx + 0x10]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
movsxd rcx, eax
jle 0x1004be63
add qword [rbx + 0x10], rcx
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x1004be80
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
movsxd rax, edx
mov rbx, qword [rcx + rax*8 + 0x238]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov rdi, r9
mov rsi, r8
mov rbp, rcx
call fcn.1004bd80
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x70]
movsxd rdi, eax
mov dword [rsi], 0
cmp rdi, 0xffffffffffffffff
jne 0x1004bf1e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
mov ebx, eax
jne 0x1004bef0
mov dword [rsi], 0x51
xor eax, eax
jmp 0x1004bf21
mov edx, eax
mov rcx, rbp
call fcn.10076e10
mov rcx, qword [rbp]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1004b840
mov r11, qword [rbp]
mov dword [r11 + 0xd74], ebx
mov dword [rsi], reloc.WS2_32.dll_getservbyname
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x1004c880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x1004c88c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
mov r8, rax
add rdx, 4
mov ecx, 2
jmp fcn.10077030

Function at 0x100518e0
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
xor esi, esi
cmp dword [rcx + 0xa5c], esi
mov eax, esi
mov qword [r11 + 0x20], rdi
mov rdi, rdx
mov rbx, rcx
setne al
lea r9, [r11 - 0x28]
lea r8d, [rsi + 8]
mov edx, 0xffff
mov rcx, rdi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10051943
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov r8, rdi
mov rcx, rbx
call fcn.1004b790
jmp 0x100519d2
mov ecx, dword [rbx + 0xa60]
mov dword [rsp + 0x58], 1
call fcn.1004b1e0
mov ecx, dword [rbx + 0xa64]
imul eax, eax, 0x3e8
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x5c], eax
call fcn.1004b1e0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x58]
mov r9d, reloc.WS2_32.dll_inet_ntoa
mov edx, 0x98000004
imul eax, eax, 0x3e8
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x100519d2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r8d, edi
mov r9d, eax
mov rcx, rbx
call fcn.1004b790
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
add rsp, 0x78
ret
Function at 0x10052280
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
sub rsp, 0x158
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp dword [rcx + 0xbc], 2
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rbp, qword [rcx]
mov qword [r11 - 8], rsi
mov rbx, rdx
mov rsi, rcx
je 0x10052496
cmp dword [rcx + 0x398], 0
mov qword [r11 - 0x10], rdi
jne 0x10052486
cmp dword [rcx + 0x408], 0
jne 0x10052486
lea r8, [rsp + 0x20]
lea rdx, [r11 - 0xa8]
mov rcx, rbx
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x10052329
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rsi
mov edx, eax
mov ebx, eax
call fcn.10076e10
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rbp
call fcn.1004b840
jmp 0x1005248e
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x80
mov dword [rsp + 0x20], 0x80
call fcn.10025bb0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x10052386
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rsi
mov edx, eax
mov ebx, eax
call fcn.10076e10
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rbp
call fcn.1004b840
jmp 0x1005248e
lea r8, [rsi + 0x1b4]
lea rdx, [rsi + 0x186]
lea rcx, [rsp + 0xb0]
call fcn.100521e0
test eax, eax
jne 0x100523d9
call fcn.100240e0
mov rbx, rax
call fcn.100240e0
mov edx, dword [rbx]
mov rcx, rsi
mov rdi, rax
call fcn.10076e10
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.1004b840
jmp 0x1005248e
mov rax, qword [rsi + 0x186]
lea r8, [rsi + 0x1e8]
lea rdx, [rsi + 0x1b8]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0x18e]
lea rcx, [rsp + 0x30]
mov qword [rsi + 0x90], rax
mov rax, qword [rsi + 0x196]
mov qword [rsi + 0x98], rax
mov rax, qword [rsi + 0x19e]
mov qword [rsi + 0xa0], rax
mov rax, qword [rsi + 0x1a6]
mov qword [rsi + 0xa8], rax
mov eax, dword [rsi + 0x1ae]
mov dword [rsi + 0xb0], eax
movzx eax, word [rsi + 0x1b2]
mov word [rsi + 0xb4], ax
call fcn.100521e0
test eax, eax
jne 0x10052486
call fcn.100240e0
mov rbx, rax
call fcn.100240e0
mov edx, dword [rbx]
mov rcx, rsi
mov rdi, rax
call fcn.10076e10
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rbp
call fcn.1004b840
jmp 0x1005248e
mov rcx, rsi
call fcn.100520c0
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x158
ret
Function at 0x100524d0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov rax, rdx
mov edx, 6
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx]
mov qword [rsp + 0x58], rdi
mov rdi, rcx
lea r8d, [rdx - 5]
lea r9, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x10052543
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
call fcn.10076e10
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.1004b790
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.1004b790
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x38
ret

Function at 0x10052570
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x100b7818]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
test eax, eax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
jne 0x100525cd
lea r9d, [rax + 3]
lea r8d, [rax + 2]
lea ecx, [rax + 6]
xor edx, edx
call fcn.10078ca0
test eax, eax
je 0x100525c1
mov dword [0x100b7818], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x100b7818], 1
jmp 0x100525d2
cmp eax, 2
je 0x10052624
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10052603
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x10052624
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x10052720
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x2c0], 0
je 0x10052734
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x238]
cmp rcx, 0xffffffffffffffff
je 0x1005272d
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1005c320
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rsi, qword [rcx]
mov dword [rsp + 0x30], 0x80
mov qword [r11 - 8], rdi
mov rdi, qword [rcx + 0x6a0]
mov r8d, dword [rdi + 0x15c]
mov rdx, qword [rdi + 0x168]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [r11 - 0x18], r13
mov r13, rcx
mov rcx, qword [rdi + 0x18]
lea rax, [rsp + 0x40]
add r8d, 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rdi + 0x150], 0
mov dword [rdi + 0x154], eax
jne 0x1005c3c5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.10023d50
mov r11d, dword [rsp + 0x30]
mov dword [rdi + 0x150], r11d
mov r9d, dword [rdi + 0x154]
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0xd8], r12
cmp r9d, 4
jge 0x1005c442
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.1004b840
mov dword [rdi + 0xc], 7
xor eax, eax
mov r13, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0x108]
mov rbp, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0xe8
ret
lea rcx, [rdi + 0x168]
call fcn.1005ae40
movzx r8d, ax
mov dword [rdi + 0xc], r8d
sub r8d, 3
je 0x1005c503
sub r8d, 1
je 0x1005c57b
sub r8d, 1
je 0x1005c4b5
cmp r8d, 1
je 0x1005c491
lea r8, str.Internal_error:_Unexpected_packet
lea rdx, [0x1008d828]
mov rcx, rsi
call fcn.1004b840
jmp 0x1005c57b
mov rdx, qword [rdi + 0x168]
lea r8d, [r9 - 2]
mov rcx, rdi
add rdx, 2
call fcn.1005af60
test eax, eax
je 0x1005c57b
jmp 0x1005c3fa
mov r12, qword [rdi + 0x168]
lea eax, [r9 - 4]
lea rcx, [rdi + 0x168]
movsxd rbx, eax
call fcn.1005ae50
lea rcx, [r12 + 4]
movzx r9d, ax
mov rdx, rbx
mov dword [rdi + 8], r9d
call fcn.1005ae70
cmp rax, rbx
jae 0x1005c57b
lea r8, [r12 + 4]
lea rdx, str.TFTP_error:__s_n
mov rcx, rsi
call fcn.1004b790
jmp 0x1005c57b
cmp r9d, 4
jle 0x1005c57b
lea rcx, [rdi + 0x168]
call fcn.1005ae50
mov cx, word [rdi + 0x48]
add ecx, 1
cmp cx, ax
jne 0x1005c57b
mov r8, qword [rdi + 0x168]
lea eax, [r9 - 4]
mov edx, 1
add r8, 4
movsxd r9, eax
mov rcx, r13
call fcn.1004bd50
test eax, eax
mov ebx, eax
je 0x1005c55a
mov edx, 5
mov rcx, rdi
call fcn.1005c2a0
mov eax, ebx
jmp 0x1005c3fa
mov eax, dword [rdi + 0x154]
mov rcx, rsi
sub eax, 4
cdqe
add qword [rsi + 0xf8], rax
mov rdx, qword [rsi + 0xf8]
call fcn.1006ff90
mov rcx, r13
call fcn.10070120
test eax, eax
je 0x1005c3f8
mov edx, 5
mov rcx, rdi
call fcn.1005c2a0
mov eax, Ordinal_46
jmp 0x1005c3fa
Function at 0x1005e5d0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x100b4478]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1005e615
lea rdx, str.WSAStartup_failed___d_
mov r8d, eax
mov rcx, rbx
call fcn.1004b840
jmp 0x1005e641
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx r11d, word [rsp + 0x20]
cmp r11b, 2
jne 0x1005e632
shr r11w, 8
jne 0x1005e632
xor eax, eax
jmp 0x1005e646
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.1004b840
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.10021bf0
add rsp, 0x1d0
pop rbx
ret

Function at 0x1005e840
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
sub rsp, 0x38
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbp, qword [rcx]
mov qword [rax + 0x18], rsi
xor r9d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 0x238]
mov qword [rax + 0x20], rdi
mov byte [rax - 0x17], dl
mov edi, r8d
mov esi, edx
mov byte [rax - 0x16], r8b
lea r8d, [r9 + 3]
lea rdx, [rax - 0x18]
mov byte [rax - 0x18], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1005e8a1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1004b840
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.1005e700
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1005e8d0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
cmp r8d, 1
mov rax, qword [rcx]
movsxd r11, edx
mov r9, qword [rax + 0x208]
mov rbx, rcx
jne 0x1005e947
mov r10d, dword [r9 + r11*4 + 0xc08]
test r10d, r10d
je 0x1005e929
sub r10d, 2
je 0x1005e95e
cmp r10d, r8d
jne 0x1005e997
cmp dword [r9 + r11*4 + 0x1008], 0
jne 0x1005e997
mov dword [r9 + r11*4 + 0x1008], 1
add rsp, 0x20
pop rbx
ret
mov edx, 0xfd
mov r8d, r11d
mov dword [r9 + r11*4 + 0xc08], 2
add rsp, 0x20
pop rbx
jmp fcn.1005e840
mov ecx, dword [r9 + r11*4 + 0xc08]
sub ecx, 1
je 0x1005e97b
sub ecx, 1
je 0x1005e908
cmp ecx, 1
jne 0x1005e997
cmp dword [r9 + r11*4 + 0x1008], 1
jne 0x1005e997
mov dword [r9 + r11*4 + 0x1008], 0
add rsp, 0x20
pop rbx
ret
mov edx, 0xfe
mov rcx, rbx
mov r8d, r11d
mov dword [r9 + r11*4 + 0xc08], 3
call fcn.1005e840
add rsp, 0x20
pop rbx
ret
Function at 0x1005e9a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x208]
mov r10d, dword [r8 + r9*4 + 0xc08]
test r10d, r10d
je 0x1005ea5b
sub r10d, 2
je 0x1005ea0c
cmp r10d, 1
jne 0x1005ea45
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1005e9fb
cmp ecx, r10d
jne 0x1005ea45
mov dword [r8 + r9*4 + 0xc08], r10d
mov dword [r8 + r9*4 + 0x1008], 0
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1005ea4a
cmp ecx, 1
jne 0x1005ea45
mov dword [r8 + r9*4 + 0xc08], 3
mov dword [r8 + r9*4 + 0x1008], 0
mov rcx, r11
mov r8d, edx
mov edx, 0xfe
call fcn.1005e840
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x1408], 1
jne 0x1005ea38
mov dword [r8 + r9*4 + 0xc08], 1
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1005e840

Function at 0x1005ea90
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x208]
mov r10d, dword [r8 + r9*4 + 0xc08]
sub r10d, 1
je 0x1005eb38
sub r10d, 1
je 0x1005eb10
cmp r10d, 1
jne 0x1005eb4f
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1005eb01
cmp ecx, r10d
jne 0x1005eb4f
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x1008], eax
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1005e840
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1005eb01
cmp ecx, 1
jne 0x1005eb4f
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov dword [r8 + r9*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov r8d, edx
mov edx, 0xfe
call fcn.1005e840
add rsp, 0x28
ret

Function at 0x1005eb60
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
cmp r8d, 1
mov rax, qword [rcx]
movsxd r11, edx
mov r9, qword [rax + 0x208]
mov rbx, rcx
jne 0x1005ebcd
mov r10d, dword [r9 + r11*4 + 8]
test r10d, r10d
je 0x1005ebb2
sub r10d, 2
je 0x1005ebe1
cmp r10d, r8d
jne 0x1005ec17
cmp dword [r9 + r11*4 + 0x408], 0
jne 0x1005ec17
mov dword [r9 + r11*4 + 0x408], 1
add rsp, 0x20
pop rbx
ret
mov edx, 0xfb
mov r8d, r11d
mov dword [r9 + r11*4 + 8], 2
add rsp, 0x20
pop rbx
jmp fcn.1005e840
mov ecx, dword [r9 + r11*4 + 8]
sub ecx, 1
je 0x1005ebfe
sub ecx, 1
je 0x1005eb95
cmp ecx, 1
jne 0x1005ec17
cmp dword [r9 + r11*4 + 0x408], 1
jne 0x1005ec17
mov dword [r9 + r11*4 + 0x408], 0
add rsp, 0x20
pop rbx
ret
mov edx, 0xfc
mov rcx, rbx
mov r8d, r11d
mov dword [r9 + r11*4 + 8], 3
call fcn.1005e840
add rsp, 0x20
pop rbx
ret
Function at 0x1005ec20
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x208]
mov r10d, dword [r8 + r9*4 + 8]
sub r10d, 1
je 0x1005ecb4
sub r10d, 1
je 0x1005ec8f
cmp r10d, 1
jne 0x1005ecc8
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x1005ec83
cmp ecx, r10d
jne 0x1005ecc8
xor eax, eax
mov dword [r8 + r9*4 + 8], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x408], eax
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.1005e840
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x1005ec83
cmp ecx, 1
jne 0x1005ecc8
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov dword [r8 + r9*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov r8d, edx
mov edx, 0xfc
call fcn.1005e840
add rsp, 0x28
ret
Function at 0x1005f9b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x48
cmp edx, 0x1f
mov qword [rsp + 0x58], rbp
mov rbp, qword [rcx]
mov qword [rsp + 0x68], rdi
mov rdi, qword [rbp + 0x208]
mov qword [rsp + 0x38], r13
mov r13, rcx
jne 0x1005fb6a
mov qword [rsp + 0x50], rbx
lea rbx, [rdi + 0x1eb8]
mov qword [rsp + 0x60], rsi
lea rsi, [rdi + 0x1cb8]
cmp rsi, rbx
mov qword [rbx], rsi
jae 0x1005fa00
mov byte [rsi], 0xff
add qword [rbx], 1
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1005fa0f
mov byte [rax], 0xfa
add qword [rbx], 1
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1005fa1e
mov byte [rax], Ordinal_33
add qword [rbx], 1
movzx ecx, word [rdi + 0x1ca8]
mov qword [rsp + 0x40], r12
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r12d, ax
mov word [rsp + 0x20], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbx]
movzx r11d, ax
mov word [rsp + 0x24], ax
cmp rcx, rbx
jae 0x1005fa5e
mov byte [rcx], r12b
add qword [rbx], 1
mov rdx, qword [rbx]
mov r12, qword [rsp + 0x40]
cmp rdx, rbx
jae 0x1005fa76
movzx ecx, byte [rsp + 0x21]
mov byte [rdx], cl
add qword [rbx], 1
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1005fa85
mov byte [rax], r11b
add qword [rbx], 1
mov rcx, qword [rbx]
cmp rcx, rbx
jae 0x1005fa98
movzx eax, byte [rsp + 0x25]
mov byte [rcx], al
add qword [rbx], 1
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1005faa7
mov byte [rax], 0xff
add qword [rbx], 1
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1005fab6
mov byte [rax], 0xf0
add qword [rbx], 1
mov rax, qword [rbx]
lea r8, [rdi + 0x1cba]
mov edx, 0x3e
mov r9, rax
mov rcx, rbp
mov qword [rbx], rsi
sub r9, rsi
mov qword [rdi + 0x1ec0], rax
sub r9, 2
call fcn.1005ecd0
mov rcx, qword [r13 + 0x238]
xor r9d, r9d
lea r8d, [r9 + 3]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test eax, eax
jns 0x1005fb1e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1004b840
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r13
call fcn.1005f740
mov rcx, qword [r13 + 0x238]
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rdi + 0x1cbf]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1005fb6a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.1004b840
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret