joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400109f8
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, edx
mov rdi, rcx
shl rdi, 5
mov rax, qword [rbx + 0x3e8]
mov rsi, qword [rdi + rbx + 0x290]
sub rsi, qword [rdi + rbx + 0x298]
test byte [rax + 0x7c], 3
je 0x140010b12
lea rax, [0x140010ff8]
cmp qword [rbx + rcx*8 + 0x268], rax
jne 0x140010b12
cmp qword [rdi + rbx + 0x288], 0
je 0x140010a63
test rsi, rsi
je 0x140010b12
mov rbp, qword [rbx + rcx*8 + 0x240]
or r8, 0xffffffffffffffff
or rdx, r8
mov rcx, rbp
xor r9d, r9d
call fcn.140012e64
cmp eax, 0xffffffff
je 0x140010b12
test al, 1
je 0x140010b12
mov rax, qword [rdi + rbx + 0x288]
test rax, rax
jne 0x140010ade
mov rax, qword [rbx]
mov ecx, dword [rax + 0xb60]
add ecx, ecx
movsxd rcx, ecx
mov qword [rdi + rbx + 0x290], rcx
call qword [fcn.1400bac0c]
and qword [rdi + rbx + 0x298], 0
and qword [rdi + rbx + 0x2a0], 0
mov rsi, qword [rdi + rbx + 0x290]
mov qword [rdi + rbx + 0x288], rax
test rax, rax
je 0x140010b09
mov rdx, qword [rdi + rbx + 0x298]
xor r9d, r9d
add rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140010b12
add qword [rdi + rbx + 0x298], rcx
jmp 0x140010b12
and qword [rdi + rbx + 0x290], 0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140010ef8
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x100]
mov rsi, r9
movsxd rax, edx
mov rdi, r8
mov r15, rcx
mov rbx, qword [rcx + rax*8 + 0x240]
call fcn.1400109f8
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
and dword [r14], 0
movsxd rdi, eax
cmp rdi, 0xffffffffffffffff
jne 0x140010fa1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140010f73
xor edi, edi
mov dword [r14], VarR8FromBool
jmp 0x140010fa1
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140029a88
mov rcx, qword [r15]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140010ce0
mov rcx, qword [r15]
mov dword [rcx + 0x10e8], ebx
mov dword [r14], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14008f320
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140011364
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x140011399
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
cmp eax, 0x2733
lea edx, [rcx + 0x19]
cmove ecx, edx
mov eax, ecx
jmp 0x14001139e
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400114d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
movsxd r10, edx
mov rsi, r9
mov rbp, r8
mov rbx, rcx
cmp qword [rcx + 0x728], rdi
je 0x140011528
mov dl, 1
call fcn.140010970
mov r9, qword [rcx + 0x680]
mov edx, r10d
mov qword [rsp + 0x20], r9
mov r9, rsi
call qword [rcx + 0x728]
xor edx, edx
mov rcx, rbx
mov edi, eax
call fcn.140010970
jmp 0x140011568
mov edx, 2
cmp r10d, edx
ja 0x140011568
mov r9, qword [rbx + 0x678]
lea rcx, [r10 + r10*2]
lea rax, [0x14016c6c8]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.1400a02f8
mov r9, qword [rbx + 0x678]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1400a02f8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400115f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9d, ecx
mov rcx, r8
call fcn.1400115ac
mov r8d, eax
mov ecx, r9d
call fcn.1400e4314
cdqe
add rsp, 0x28
ret

Function at 0x140011778
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [rcx + 0xe74]
lea r9, [rsp + 0x50]
mov rdi, rdx
shr eax, 0xd
and eax, 1
mov dword [rsp + 0x20], 4
mov rbx, rcx
mov dword [rsp + 0x50], eax
mov edx, 0xffff
mov r8d, 8
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1400117e3
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov rcx, rbx
call fcn.140010bf0
jmp 0x140011872
mov ecx, dword [rbx + 0xdfc]
mov dword [rsp + 0x58], 1
call fcn.1400115b0
imul ecx, eax, 0x3e8
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xe00]
call fcn.1400115b0
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9d, listen
imul ecx, eax, 0x3e8
mov edx, 0x98000004
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x140011872
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r9d, eax
mov rcx, rbx
call fcn.140010bf0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008f320
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14001200c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
cmp dword [rcx + 0xbc], 2
mov rdi, rdx
mov rsi, qword [rcx]
mov rbx, rcx
je 0x1400121bc
test dword [rcx + 0x3c4], 0x8000002
jne 0x1400121b4
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1400120a5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, [rbp + 0x30]
mov ebx, eax
call fcn.140029a88
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140010ce0
jmp 0x1400121bc
xor edx, edx
mov dword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rcx, [rsp + 0x30]
call fcn.1400921f0
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1400120f2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, [rbp + 0x30]
mov ebx, eax
call fcn.140029a88
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x140012092
lea rdi, [rbx + 0x18e]
mov rdx, rdi
lea r8, [rbx + 0x1bc]
lea rcx, [rbp - 0x50]
call fcn.140011f9c
test al, al
jne 0x140012139
call fcn.1400b9518
mov ebx, dword [rax]
call fcn.1400b9518
lea rdx, [rbp + 0x30]
mov ecx, ebx
mov rdi, rax
call fcn.140029a88
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
jmp 0x140012095
movups xmm0, xmmword [rdi]
mov eax, dword [rdi + 0x28]
lea r8, [rbx + 0x1f0]
movups xmm1, xmmword [rdi + 0x10]
lea rdx, [rbx + 0x1c0]
movups xmmword [rbx + 0x88], xmm0
lea rcx, [rsp + 0x30]
movsd xmm0, qword [rdi + 0x20]
movups xmmword [rbx + 0x98], xmm1
movsd qword [rbx + 0xa8], xmm0
mov dword [rbx + 0xb0], eax
movzx eax, word [rdi + 0x2c]
mov word [rbx + 0xb4], ax
call fcn.140011f9c
test al, al
jne 0x1400121b4
call fcn.1400b9518
mov ebx, dword [rax]
call fcn.1400b9518
lea rdx, [rbp + 0x30]
mov ecx, ebx
mov rdi, rax
call fcn.140029a88
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
jmp 0x140012095
mov rcx, rbx
call fcn.140011eb8
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14008f320
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400125c8
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx]
lea r9, [rsp + 0x30]
mov r8d, 1
mov dword [rsp + 0x20], 4
mov rax, rdx
mov dword [rsp + 0x30], r8d
mov rcx, rax
lea edx, [r8 + 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140012638
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.140029a88
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
call fcn.140010bf0
jmp 0x140012647
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.140010bf0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008f320
add rsp, 0xd0
pop rbx
ret
Function at 0x140012660
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov rbx, rcx
mov eax, dword [0x14019c540]
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x1400126b1
xor edx, edx
lea ecx, [rax + 6]
lea r9d, [rax + 3]
call fcn.14000d7b0
test al, al
je 0x1400126a6
mov dword [0x14019c540], 2
jmp 0x140012708
mov eax, 1
mov dword [0x14019c540], eax
cmp eax, 2
je 0x140012708
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1400126e7
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140012708
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x140012bc8
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
test byte [rcx + 0x2d8], 1
je 0x140012be5
call fcn.14001bbd4
test eax, eax
jne 0x140012c09
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x240]
cmp rcx, 0xffffffffffffffff
je 0x140012bde
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
jmp 0x140012bda
mov al, 1
jmp 0x140012be0
Function at 0x140013778
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x140013784
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
add rdx, 4
mov r8, rax
mov ecx, 2
jmp fcn.14002a4b8

Function at 0x1400146c8
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
lea r10, [rcx + rdx]
mov r8, rcx
mov r9d, 0x1505
cmp rcx, r10
jae 0x1400146f9
mov cl, byte [r8]
call fcn.14001df14
imul r9, r9, 0x21
movsx rdx, al
inc r8
xor r9, rdx
cmp r8, r10
jb 0x1400146de
movzx eax, r9b
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001473a
call fcn.140014550
test al, al
jne 0x14001473a
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14001465c
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400146c8
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140014704
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub rsp, 0x28
lea r10, [rcx + rdx]
mov r8, rcx
mov r9d, 0x1505
cmp rcx, r10
jae 0x1400146f9
mov cl, byte [r8]
call fcn.14001df14
imul r9, r9, 0x21
movsx rdx, al
inc r8
xor r9, rdx
cmp r8, r10
jb 0x1400146de
movzx eax, r9b
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001473a
call fcn.140014550
test al, al
jne 0x14001473a
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14001465c
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400146c8
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140020718
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
and qword [r11 - 0x18], 0
lea rax, [r11 + 0x18]
and qword [r11 - 0x20], 0
xor r9d, r9d
mov qword [r11 - 0x28], rax
xor r8d, r8d
lea rax, [r11 + 0x10]
mov dword [rsp + 0x28], 4
mov edx, 0x4004747b
mov qword [r11 - 0x38], rax
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x14002077b
lea r9, [rsp + 0x68]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x50
pop rbx
ret
Function at 0x14002bc2c
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, r9
xor ebp, ebp
and qword [r9], rbp
xor r14d, r14d
lea r9, [rax + 0x20]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x14002bd89
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x14002bd77
cmp dword [rsi + 4], 2
jne 0x14002bd1e
cmp qword [rsi + 0x20], 0
je 0x14002bd1e
cmp qword [rsi + 0x10], 0x10
jb 0x14002bd1e
mov ecx, Ordinal_50
call qword [fcn.1400bac0c]
mov rdi, rax
test rax, rax
je 0x14002bd4d
mov ecx, dword [rsi]
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
and qword [rax + 0x20], 0
and qword [rax + 0x18], 0
and qword [rax + 0x28], 0
mov dword [rax + 0xc], ecx
mov ecx, reloc.WS2_32.dll_recv
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
call qword [fcn.1400bac0c]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14002bd46
mov rcx, qword [rsi + 0x20]
movups xmm0, xmmword [rcx]
movdqu xmmword [rax], xmm0
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14002bd0b
call qword [case.0x1400493c8.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x14002bd2c
test rbp, rbp
cmove rbp, rdi
test r14, r14
je 0x14002bd1b
mov qword [r14 + 0x28], rdi
mov r14, rdi
mov rsi, qword [rsi + 0x28]
test rsi, rsi
je 0x14002bd52
jmp 0x14002bc71
mov rcx, qword [rdi + 0x20]
mov ebx, 8
call qword [fcn.1400b8804]
mov rcx, rdi
call qword [fcn.1400b8804]
jmp 0x14002bd52
mov ebx, 8
jmp 0x14002bd3b
mov ebx, 8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002bd62
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebx, ebx
je 0x14002bd72
mov rcx, rbp
call fcn.14002bbe4
xor ebp, ebp
jmp 0x14002bd84
test rbp, rbp
jne 0x14002bd84
mov ebx, 0x2af9
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov qword [r15], rbp
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14002c880
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1400d6cd4
xor ebx, ebx
mov byte [rsp + 0x20], bl
test rax, rax
je 0x14002c8d3
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], bl
je 0x14002c8d3
lea rcx, [rsp + 0x20]
call qword [case.0x1400493c8.0]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14008f320
add rsp, 0x140
pop rbx
ret
jmp 0x14002c880
Function at 0x14002c8f0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1400d6cd4
xor ebx, ebx
mov byte [rsp + 0x20], bl
test rax, rax
je 0x14002c8d3
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], bl
je 0x14002c8d3
lea rcx, [rsp + 0x20]
call qword [case.0x1400493c8.0]
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14008f320
add rsp, 0x140
pop rbx
ret
jmp 0x14002c880
Function at 0x140034a80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, qword [rcx + 0x798]
lea rax, [rsp + 0x30]
mov rsi, qword [rcx]
mov r15, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rdi + 0x15c]
lea r14, [rdi + 0x168]
mov rdx, qword [r14]
add r8d, 4
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rdi + 0x150], 0
mov dword [rdi + 0x154], eax
jne 0x140034b27
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.1400919b0
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x150], eax
mov r9d, dword [rdi + 0x154]
cmp r9d, 4
jge 0x140034b79
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.140010ce0
mov dword [rdi + 0xc], 7
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14008f320
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, r14
call fcn.140033944
movzx r8d, ax
mov dword [rdi + 0xc], r8d
sub r8d, 3
je 0x140034c28
sub r8d, 1
je 0x140034c97
sub r8d, 1
je 0x140034be4
cmp r8d, 1
je 0x140034bc4
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x1401733b4]
call fcn.140010ce0
jmp 0x140034c97
mov rdx, qword [r14]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rdi
call fcn.140033a30
test eax, eax
je 0x140034c97
jmp 0x140034b4c
mov rbp, qword [r14]
lea eax, [r9 - 4]
mov rcx, r14
movsxd rbx, eax
call fcn.140033958
movzx r9d, ax
lea rcx, [rbp + 4]
mov rdx, rbx
mov dword [rdi + 8], r9d
call fcn.14003396c
cmp rax, rbx
jae 0x140034c97
lea r8, [rbp + 4]
mov rcx, rsi
lea rdx, str.TFTP_error:__s_n
call fcn.140010bf0
jmp 0x140034c97
cmp r9d, 4
jle 0x140034c97
mov rcx, r14
call fcn.140033958
movzx ecx, word [rdi + 0x48]
mov edx, 1
add ecx, edx
cmp cx, ax
jne 0x140034c97
mov r8, qword [r14]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov rcx, r15
call fcn.14001134c
mov ebx, eax
test eax, eax
je 0x140034c76
mov edx, 5
mov rcx, rdi
call fcn.1400347b8
mov eax, ebx
jmp 0x140034b4c
mov eax, dword [rdi + 0x154]
mov rcx, rsi
sub eax, 4
cdqe
add qword [rsi + 0x110], rax
mov rdx, qword [rsi + 0x110]
call fcn.140023bb8
mov rcx, r15
call fcn.140023cd4
test eax, eax
je 0x140034b4a
mov edx, 5
mov rcx, rdi
call fcn.1400347b8
mov eax, Ordinal_45
jmp 0x140034b4c
Function at 0x140036758
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rcx + 0x248]
lea r8, [r11 - 0x28]
mov rdi, qword [rcx]
lea rdx, [r11 - 0x20]
mov rbx, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rcx, rbp
or rsi, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1400367c7
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
mov rdx, rbp
mov rcx, rbx
call fcn.140012c10
mov rcx, rdi
cmp rsi, 0xffffffffffffffff
jne 0x1400367ec
lea rdx, str.Error_accept__ing_server_connect
call fcn.140010ce0
lea eax, [rsi + 0x1f]
jmp 0x140036866
lea rdx, str.Connection_accepted_from_server_n
call fcn.140010bf0
btr dword [rbx + 0x3c4], 0xb
mov ebp, 1
mov edx, ebp
mov qword [rbx + 0x248], rsi
mov rcx, rsi
call fcn.14002a4ec
mov byte [rbx + 0x261], bpl
cmp qword [rdi + 0x738], 0
je 0x140036864
mov dl, bpl
mov rcx, rdi
call fcn.140010970
mov rcx, qword [rdi + 0x740]
mov r8d, ebp
mov rdx, rsi
call qword [rdi + 0x738]
xor edx, edx
mov rcx, rdi
mov r8d, eax
call fcn.140010970
test r8d, r8d
je 0x140036864
mov rcx, rbx
call fcn.14003664c
lea eax, [rbp + 0x29]
jmp 0x140036866
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008f320
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400376fc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
mov rax, qword [r8 + 0x1f8]
cmp dword [rax + 0x20], 0
je 0x14003772e
mov edx, reloc.WS2_32.dll_listen
call fcn.140036df8
mov r8d, edx
mov dl, 1
add rsp, 0x20
pop rbx
jmp fcn.140037cc4
mov eax, dword [r8 + 0xe70]
bt eax, 0xe
jae 0x140037747
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.140036fdc
test byte [r8 + 0xe74], 1
je 0x1400377cb
mov rcx, qword [rcx + 0x820]
test rcx, rcx
jne 0x1400377a6
mov r8, qword [r8 + 0xbf8]
test r8, r8
jne 0x14003777f
bt eax, 0xd
lea r8, str.LIST
lea rax, str.NLST
cmovb r8, rax
lea rcx, [rbx + 0x798]
lea rdx, str.PRET__s
call fcn.140046bd4
test eax, eax
jne 0x1400377d0
lea edx, [rax + 0x1d]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140036df8
lea r9, [rbx + 0x798]
mov r8, rcx
mov rcx, r9
bt eax, 0x19
jae 0x1400377c2
lea rdx, str.PRET_STOR__s
jmp 0x14003778d
lea rdx, str.PRET_RETR__s
jmp 0x14003778d
call fcn.140037668
add rsp, 0x20
pop rbx
ret

Function at 0x140038694
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rsi, rcx
mov rcx, qword [rcx]
mov edi, r8d
cmp eax, 0x64
jb 0x1400386ca
lea rdx, str.Couldnt_set_desired_mode
call fcn.140010ce0
lea eax, [rbx + 0x11]
jmp 0x14003871f
cmp edx, 0xc8
je 0x1400386e1
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.140010bf0
cmp edi, 0x13
jne 0x1400386f0
mov rcx, rsi
call fcn.140037830
jmp 0x14003871b
cmp edi, 0x14
jne 0x1400386ff
mov rcx, rsi
call fcn.14003788c
jmp 0x14003871b
cmp edi, 0x15
jne 0x14003870e
mov rcx, rsi
call fcn.1400379e4
jmp 0x14003871b
cmp edi, 0x16
jne 0x14003871d
mov rcx, rsi
call fcn.1400379f4
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003b010
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1401980c8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14003b056
mov r8d, eax
lea rdx, str.WSAStartup_failed___d_
mov rcx, rbx
call fcn.140010ce0
jmp 0x14003b080
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14003b071
shr ax, 8
test al, al
jne 0x14003b071
xor eax, eax
jmp 0x14003b085
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.140010ce0
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14008f320
add rsp, 0x1d0
pop rbx
ret
Function at 0x14003b29c
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x240]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14003b2fb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140010ce0
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.14003b184
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret