joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036f00
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
sub rsp, 0xa8
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx ebp, dx
mov r15, rcx
cmp dx, 0x50
jb 0x140036f3f
movzx edx, dx
lea rcx, str.Bad_WebSocket_header___d__n
call fcn.140040c90
xor eax, eax
jmp 0x140037170
mov qword [rsp + 0xc0], rbx
lea rdx, [0x140968630]
movzx ebx, word [0x14096864c]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xd0], rsi
mov r8d, ebx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r14
call fcn.140050fe0
mov eax, dword [0x14010ba58]
xor r14d, r14d
movups xmm0, xmmword [str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11]
mov edi, r14d
movups xmm1, xmmword [0x14010ba48]
movups xmmword [rsp + rbx + 0x30], xmm0
movups xmmword [rsp + rbx + 0x40], xmm1
mov dword [rsp + rbx + 0x50], eax
movzx eax, byte [0x14010ba5c]
mov byte [rsp + rbx + 0x54], al
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x140036fc1
movups xmm0, xmmword [0x14007a0c8]
mov eax, dword [0x14007a0d8]
lea rsi, [0x140116fb0]
mov dword [0x140116fc0], eax
movaps xmmword [0x140116fb0], xmm0
nop dword [rax + rax]
movzx edx, di
lea rcx, [rsp + 0x30]
call fcn.140015ef0
mov rcx, rsi
call fcn.1400161a0
mov eax, dword [0x140116fd4]
add edi, 0x40
movups xmm0, xmmword [0x140116fc4]
mov dword [0x140116fc0], eax
lea eax, [rdi - 9]
movaps xmmword [0x140116fb0], xmm0
cmp eax, ebx
jl 0x140036ff0
mov rbx, rsi
mov edi, 5
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub rdi, 1
jne 0x140037031
lea r11d, [rdi + 0x50]
mov r10d, reloc.WS2_32.dll_sendto
mov edi, 0xffff
lea r8, [rsp + 0x30]
lea ebx, [r11 - 0x21]
lea r12d, [rdi - 3]
mov word [rsp + 0x22], di
test r10w, r10w
je 0x14003712e
movzx ecx, byte [rsi]
inc rsi
movzx eax, cl
and cl, 3
shl cl, 4
shr al, 2
mov byte [rsp + 0x20], al
mov byte [rsp + 0x21], cl
add r10w, di
je 0x1400370cf
movzx edx, byte [rsi]
inc rsi
movzx eax, dl
and dl, 0xf
shr al, 4
or al, cl
shl dl, 2
mov byte [rsp + 0x21], al
mov byte [rsp + 0x22], dl
add r10w, di
je 0x1400370cf
movzx ecx, byte [rsi]
add r10w, di
movzx eax, cl
inc rsi
shr al, 6
or al, dl
and cl, 0x3f
mov byte [rsp + 0x22], al
mov byte [rsp + 0x23], cl
lea rdx, [rsp + 0x20]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [rdx]
cmp al, 0x19
ja 0x1400370eb
add al, 0x41
jmp 0x140037110
cmp al, 0x33
ja 0x1400370f3
add al, 0x47
jmp 0x140037110
cmp al, 0x3d
ja 0x1400370fb
add al, 0xfc
jmp 0x140037110
cmp al, 0x3e
jne 0x140037103
mov al, 0x2b
jmp 0x140037110
cmp al, 0x3f
mov ecx, 0x3d
cmove ecx, ebx
movzx eax, cl
mov byte [r8], al
inc rdx
inc r8
sub r9, 1
jne 0x1400370e0
add r11w, r12w
cmp r11w, 4
jae 0x140037061
movzx r8d, bp
lea rcx, [rsp + 0x30]
mov rdx, r15
call fcn.14006eed0
mov r12, qword [rsp + 0x98]
test eax, eax
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xd0]
sete r14b
mov rbx, qword [rsp + 0xc0]
mov eax, r14d
mov r14, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0xa8
pop r15
pop rbp
ret
Function at 0x1400410c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
movsx edx, cl
lea rcx, [0x14010d710]
jmp fcn.140040c90

Function at 0x140041140
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edx, cl
movzx edi, cl
shr dl, 4
lea rcx, [0x14010d710]
cmp dl, 9
mov ebx, gethostname
mov eax, ebx
mov esi, 0x30
cmovbe eax, esi
add al, dl
movzx edx, al
call fcn.140040c90
and dil, 0xf
lea rcx, [0x14010d710]
cmp dil, 9
cmovbe ebx, esi
add bl, dil
movzx edx, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140040c90

Function at 0x1400411b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov edi, ecx
shr ebx, 0x10
movzx ecx, bx
shr cx, 8
call fcn.140041140
movzx ecx, bl
call fcn.140041140
movzx ecx, di
shr cx, 8
call fcn.140041140
movzx ecx, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140041140
Function at 0x140044240
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rdi
xor ebx, ebx
movzx edi, r9w
movzx r10d, dx
mov r11, rcx
cmp r9w, 4
jb 0x140044366
mov qword [rsp + 0x18], rbp
mov ebp, 0xffff
mov qword [rsp + 0x20], rsi
lea esi, [rbx + 0x2f]
mov qword [rsp + 0x28], r14
lea r14d, [rbp - 3]
nop word [rax + rax]
mov word [rsp + 0x32], bp
test r10w, r10w
je 0x140044351
movzx ecx, byte [r11]
inc r11
movzx eax, cl
and cl, 3
shl cl, 4
shr al, 2
mov byte [rsp + 0x30], al
mov byte [rsp + 0x31], cl
add r10w, bp
je 0x1400442f1
movzx edx, byte [r11]
inc r11
movzx eax, dl
and dl, 0xf
shr al, 4
or al, cl
shl dl, 2
mov byte [rsp + 0x31], al
mov byte [rsp + 0x32], dl
add r10w, bp
je 0x1400442f1
movzx ecx, byte [r11]
add r10w, bp
movzx eax, cl
inc r11
shr al, 6
or al, dl
and cl, 0x3f
mov byte [rsp + 0x32], al
mov byte [rsp + 0x33], cl
lea rdx, [rsp + 0x30]
mov r9d, 4
nop dword [rax]
movzx eax, byte [rdx]
cmp al, 0x19
ja 0x14004430b
add al, 0x41
jmp 0x140044330
cmp al, 0x33
ja 0x140044313
add al, 0x47
jmp 0x140044330
cmp al, 0x3d
ja 0x14004431b
add al, 0xfc
jmp 0x140044330
cmp al, 0x3e
jne 0x140044323
mov al, 0x2b
jmp 0x140044330
cmp al, 0x3f
mov ecx, 0x3d
cmove ecx, esi
movzx eax, cl
mov byte [r8], al
inc rdx
inc r8
sub r9, 1
jne 0x140044300
add di, r14w
add bx, 4
cmp di, 4
jae 0x140044280
mov rsi, qword [rsp + 0x20]
movzx eax, bx
mov rbp, qword [rsp + 0x18]
mov r14, qword [rsp + 0x28]
pop rdi
pop rbx
ret
movzx eax, bx
pop rdi
pop rbx
ret

Function at 0x140044a60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x440
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rbx, rcx
lea r8, [0x14010db1c]
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140059800
test eax, eax
je 0x140044aa7
mov rdx, rbx
lea rcx, str.Fail_to_format_User_container_file___s__n
call fcn.140040c90
jmp 0x140044add
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.1400500b0
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov r8d, 2
call fcn.1400596c0
mov rcx, qword [rsp + 0x20]
call fcn.140056f18
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x440
pop rbx
ret
Function at 0x140045cd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx edi, r8w
mov rsi, rdx
cmp cl, 0x14
jae 0x140045d61
movzx eax, cl
lea rbp, [0x1409632c0]
imul rbx, rax, 0x58
mov eax, dword [rbx + rbp]
test eax, eax
je 0x140045d61
cmp eax, 3
je 0x140045d61
mov rcx, qword [0x1401591c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx + rbp], 2
jne 0x140045d33
movzx ecx, byte [rbx + rbp + 4]
movzx r8d, di
mov rdx, rsi
call fcn.140031060
movzx ebx, ax
jmp 0x140045d4f
mov r9, qword [rbx + rbp + 8]
mov edx, 1
movzx eax, di
mov rcx, rsi
lea r8d, [rax + rax]
call fcn.14005b6c4
mov rbx, rax
mov rcx, qword [0x1401591c8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bx
jmp 0x140045d63
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140045ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movzx eax, cl
lea r14, [0x140000000]
imul rdi, rax, 0x58
movzx ebx, r8w
mov rsi, rdx
cmp dword [rdi + r14 + 0x9632c0], 3
je 0x14004602c
xor eax, eax
jmp 0x1400460a9
mov rcx, qword [0x1401591c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, dword [rdi + r14 + 0x9632d4]
xor eax, eax
cmp ax, bx
jae 0x140046079
mov r9, rsi
movzx r10d, bx
nop
movzx ecx, byte [r9]
lea r9, [r9 + 1]
movzx eax, r8w
xor rcx, rax
mov eax, r8d
shr eax, 8
movzx edx, cl
mov r8d, dword [r14 + rdx*4 + 0x158c40]
xor r8d, eax
sub r10, 1
jne 0x140046050
movzx ecx, byte [rdi + r14 + 0x9632c4]
mov rdx, rsi
mov dword [rdi + r14 + 0x9632d4], r8d
movzx r8d, bx
call fcn.140031fb0
mov rcx, qword [0x1401591c8]
movzx ebx, ax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140046640
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rdx, rcx
lea r8, [0x14010e05c]
xor esi, esi
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rsi
call fcn.140059800
test eax, eax
je 0x14004666d
xor eax, eax
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x30], rbx
lea r8d, [rdx + 2]
call fcn.14005b3e4
mov rcx, qword [rsp + 0x38]
call fcn.14005b1cc
movsxd rbx, eax
cmp ebx, 0x100000
jle 0x1400466ae
mov rcx, qword [rsp + 0x38]
call fcn.140056f18
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rsi
ret
lea eax, [rbx + 1]
mov qword [rsp + 0x40], rdi
movsxd rcx, eax
call fcn.140056e8c
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
xor edx, edx
mov rdi, rax
call fcn.14005b3e4
mov r9, qword [rsp + 0x38]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.14005b6c4
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call fcn.140056f18
test ebx, ebx
cmovns esi, ebx
mov rbx, qword [rsp + 0x30]
movsxd rax, esi
mov byte [rax + rdi], 0
mov rax, rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140047b20
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x170
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x150], rax
movzx ebp, cx
mov ecx, 0xf0
movzx eax, bp
sub ax, cx
cmp ax, 1
jbe 0x140047d2d
movzx ecx, bp
mov qword [rsp + 0x168], r14
call fcn.1400475c0
mov r14, rax
cmp qword [rax], 0xffffffffffffffff
je 0x140047d25
mov ecx, dword [rax + 0x68]
sub ecx, 4
test ecx, 0xfffffffd
je 0x140047d25
mov rcx, qword [rax + 0x60]
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx edx, word [r14 + 0x40]
xor r15d, r15d
mov rcx, qword [r14 + 0x48]
movzx esi, word [r14 + 0x42]
add rcx, rdx
cmp r15w, si
jb 0x140047bd1
mov rdi, qword [rsp + 0x40]
movzx esi, r15w
jmp 0x140047be9
mov rdi, qword [r14 + 0x50]
cmp rdi, rcx
jb 0x140047bdf
sub rdi, rdx
jmp 0x140047be9
sub cx, di
cmp cx, si
cmovb si, cx
mov rcx, qword [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test si, si
je 0x140047d05
nop dword [rax]
mov dword [0x14095e3dc], r15d
xor r9d, r9d
mov rcx, qword [r14]
mov rdx, rdi
movzx r8d, si
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140047c88
test eax, eax
jle 0x140047c32
movzx r8d, ax
lea rcx, [r14 + 0x40]
xor edx, edx
call fcn.140014400
mov rcx, qword [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx ecx, word [r14 + 0x42]
movzx r8d, word [r14 + 0x40]
cmp r15w, cx
jb 0x140047c51
mov esi, r15d
jmp 0x140047c73
mov rdx, qword [r14 + 0x48]
mov rdi, qword [r14 + 0x50]
add rdx, r8
cmp rdi, rdx
jb 0x140047c66
sub rdi, r8
jmp 0x140047c70
sub dx, di
cmp dx, cx
cmovb cx, dx
movzx esi, cx
mov rcx, qword [r14 + 0x60]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test si, si
jne 0x140047c00
jmp 0x140047d05
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
lea ecx, [rax - 0x2745]
cmp ecx, 1
jbe 0x140047cdd
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x100
mov r9d, 0x400
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea r8, [rsp + 0x50]
mov edx, ebx
lea rcx, str.Send_failed_with_error__d:__s_n
call fcn.140040c90
jmp 0x140047d05
mov eax, dword [r14 + 0x68]
cmp eax, 2
jne 0x140047cf0
mov dword [r14 + 0x68], 6
jmp 0x140047cfd
cmp eax, 3
jne 0x140047cfd
mov dword [r14 + 0x68], 4
movzx ecx, bp
call fcn.140047830
mov rbx, qword [rsp + 0x188]
mov rdi, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x170
pop rbp
ret
Function at 0x1400481c0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
test rcx, rcx
jne 0x1400481ff
lea rcx, str.Invalid_parameter__no_host_
call fcn.140040c90
lea eax, [rbx - 1]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x60
pop rbx
ret
cmp dword [0x1401186d4], 0xf0
jb 0x14004822f
lea rcx, str.cannot_allocate_socket_n
call fcn.140040c90
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x60
pop rbx
ret
movzx r9d, dx
lea r8, [0x14010b4b8]
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.1400217a0
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400482bd
mov qword [rsp + 0x30], 0
lea rbx, [0x140991560]
mov dword [rsp + 0x28], 0x400
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x20], rbx
xor edx, edx
mov ecx, 0x12ff
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdx, rbx
lea rcx, str.getaddrinfo_failed:__s_n
call fcn.140040c90
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x48]
mov rbx, rcx
test rcx, rcx
je 0x1400482df
nop word [rax + rax]
cmp dword [rbx + 4], 2
je 0x1400482fd
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400482d0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x60
pop rbx
ret
mov edx, 1
mov qword [rsp + 0x80], rdi
lea ecx, [rdx + 1]
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov r8d, dword [rbx + 0x10]
mov rcx, rax
mov rdx, qword [rbx + 0x20]
mov rdi, rax
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, qword [rsp + 0x48]
test eax, eax
jns 0x140048363
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x60
pop rbx
ret
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea r8, [rsp + 0x44]
mov dword [rsp + 0x44], 1
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, 6
mov byte [rsp + 0x40], 1
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 1
mov rcx, rdi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rdi
call fcn.1400473e0
movzx eax, ax
jmp 0x140048348
Function at 0x140048470
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x850
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x840], rax
xor ebx, ebx
lea rdi, [0x1401596c0]
nop dword [rax + rax]
movsxd rax, ebx
imul rcx, rax, 0xc70
cmp dword [rcx + rdi], 0
je 0x1400484b7
inc ebx
cmp ebx, 6
jl 0x1400484a0
cmp ebx, 6
jne 0x140048508
mov eax, dword [0x14010e2e8]
lea rdx, [rsp + 0x40]
movups xmm0, xmmword [str.No_more_UDP_socket_available_n]
lea rcx, [0x14010b5f0]
mov dword [rsp + 0x58], eax
movsd xmm1, qword [0x14010e2e0]
movzx eax, byte [reloc.WS2_32.dll_ioctlsocket]
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x5c], al
movsd qword [rsp + 0x50], xmm1
mov byte [rsp + 0x5d], 0
call fcn.140040c90
mov al, 0xff
jmp 0x140048691
mov edx, 2
mov qword [rsp + 0x860], rbp
mov ecx, edx
lea r8d, [rdx + 0xf]
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140048543
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 0x53f
call fcn.140047310
mov al, 0xff
jmp 0x140048689
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 4
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140048592
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 0x544
call fcn.140047310
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov al, 0xff
jmp 0x140048689
mov qword [rsp + 0x868], rsi
xor edx, edx
movsxd rax, ebx
mov r8d, 0xc38
imul rsi, rax, 0xc70
xor eax, eax
mov qword [rsp + 0x870], r14
add rsi, rdi
mov qword [rsi], rax
lea rcx, [rsi + 0x38]
mov qword [rsi + 8], rax
call fcn.1400500b0
xor ecx, ecx
lea rax, [rsi + 0x6e]
mov qword [rsi + 0x10], rcx
mov r14d, 0x600
mov qword [rsi + 0x30], rcx
mov ecx, 0x28
mov qword [rsi + 0x18], rax
mov word [rsi + 0x10], r14w
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], rax
call fcn.140056e8c
mov rdi, rax
xor eax, eax
mov rcx, rdi
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsi + 0x30], rdi
lea rax, [rsi + 0x66e]
xor edx, edx
mov qword [rsi + 0x40], rdx
mov qword [rsi + 0x60], rdx
mov qword [rsi + 0x48], rax
lea ecx, [rdx + 0x28]
mov word [rsi + 0x40], r14w
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x50], rax
call fcn.140056e8c
mov rdi, rax
xor eax, eax
mov rcx, rdi
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r14, qword [rsp + 0x870]
movzx eax, bl
mov qword [rsi + 0x60], rdi
mov dword [rsi], 1
mov qword [rsi + 8], rbp
mov rsi, qword [rsp + 0x868]
mov rbp, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14004ee60
mov rbx, qword [rsp + 0x878]
add rsp, 0x850
pop rdi
ret
Function at 0x1400488d0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x668
mov rax, qword [0x140116008]
xor rax, rsp
mov qword [rsp + 0x640], rax
movzx ebx, cl
mov rcx, qword [0x14015e168]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
imul rdi, rbx, 0xc70
lea rax, [0x1401596c0]
add rdi, rax
cmp dword [rdi], 1
jne 0x140048ab9
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x60]
movzx ebx, word [rdi + 0x42]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bx, bx
je 0x140048ab9
mov rcx, qword [rdi + 0x60]
mov qword [rsp + 0x688], rbp
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x698], r12
mov qword [rsp + 0x660], r13
mov qword [rsp + 0x658], r14
mov qword [rsp + 0x650], r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx r13d, word [rdi + 0x42]
lea rcx, [rsp + 0x40]
movzx r14d, word [rdi + 0x40]
mov r12d, 0x600
mov r15, qword [rdi + 0x48]
cmp r12w, r13w
mov rdx, qword [rdi + 0x50]
cmova r12w, r13w
movzx esi, r12w
lea rbp, [r15 + r14]
lea rbx, [rsi + rdx]
cmp rbx, rbp
jbe 0x1400489d2
sub rbp, rdx
movzx ebx, bp
mov r8d, ebx
call fcn.140050fe0
sub rsi, rbx
lea rcx, [rsp + 0x40]
add rcx, rbx
mov r8, rsi
mov rdx, r15
call fcn.140050fe0
lea rbx, [rsi + r15]
jmp 0x1400489e2
mov r8, rsi
call fcn.140050fe0
cmp rbx, rbp
jne 0x1400489e2
sub rbx, r14
mov rcx, qword [rdi + 0x60]
sub r13w, r12w
mov word [rdi + 0x42], r13w
mov qword [rdi + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x60]
xor eax, eax
mov word [rdi + 0x42], ax
mov rax, qword [rdi + 0x48]
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx ecx, word [rdi + 0x6c]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov eax, 2
mov word [rsp + 0x30], ax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x32], ax
xor r9d, r9d
mov eax, dword [rdi + 0x68]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x30]
movzx r8d, r12w
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov r15, qword [rsp + 0x650]
mov r14, qword [rsp + 0x658]
mov r13, qword [rsp + 0x660]
mov r12, qword [rsp + 0x698]
mov rsi, qword [rsp + 0x690]
mov rbp, qword [rsp + 0x688]
test eax, eax
jns 0x140048ab9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 0x5ec
call fcn.140047310
mov rcx, qword [0x14015e168]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.14004ee60
add rsp, 0x668
pop rdi
pop rbx
ret
Function at 0x14004d6d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x14010accc]
mov ecx, 0x28
movups xmm0, xmmword [0x14010acbc]
mov dword [0x140116f60], eax
movzx eax, word [str.This_firmware_is_too_recent__please_upgrade_your_VirtualHub_or_Yoctopuce_library]
mov word [0x140116f64], ax
mov byte [0x140116f65], 0
movups xmmword [str.Mar_25_2024_11:45:46], xmm0
call fcn.140056e8c
mov rbx, rax
xor eax, eax
mov rcx, rbx
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
mov qword [0x140159658], rbx
mov r8d, 0x170
lea rcx, [0x14095e5e0]
call fcn.1400500b0
mov edx, 0xff
lea rcx, [0x1409612c0]
mov r8d, 0x2000
call fcn.1400500b0
movzx edx, word [0x140116ce8]
xor edi, edi
mov rcx, qword [0x140116c40]
shr dx, 7
mov word [0x14095e5a2], di
test rcx, rcx
je 0x14004d7ac
nop dword [rax + rax]
mov rax, qword [rcx + 0x28]
mov word [rax + 2], dx
movzx eax, word [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
shr ax, 7
add dx, ax
test rcx, rcx
jne 0x14004d790
lea rsi, [0x140158c40]
movzx r9d, di
mov r10, rsi
mov ebx, 8
mov r11d, 0x100
nop word [rax + rax]
movzx eax, r9w
mov r8, rbx
nop word [rax + rax]
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
sub r8, 1
jne 0x14004d7e0
mov dword [r10], eax
inc r9w
add r10, 4
cmp r9w, r11w
jb 0x14004d7d0
call fcn.140009a00
mov r8d, dword [0x140117130]
lea r9, [rsp + 0x30]
mov ecx, eax
mov qword [rsp + 0x30], rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
movzx eax, r8w
xor rcx, rax
mov eax, r8d
shr eax, 8
movzx edx, cl
mov r8d, dword [rsi + rdx*4]
xor r8d, eax
sub rbx, 1
jne 0x14004d830
test r8d, r8d
lea rcx, [0x14015e170]
mov eax, 0x12d35cc
mov edx, 0xff
cmove r8d, eax
mov dword [0x140117130], r8d
mov r8d, 0x800000
call fcn.1400500b0
mov r8d, 0x8f9fc
lea rdx, str.YFS3
lea rcx, [0x14035e170]
call fcn.140050fe0
lea ecx, [rbx + 0x28]
mov dword [0x1409632c0], edi
mov dword [0x140963318], edi
mov dword [0x140963370], edi
mov dword [0x1409633c8], edi
mov dword [0x140963420], edi
mov dword [0x140963478], edi
mov dword [0x1409634d0], edi
mov dword [0x140963528], edi
mov dword [0x140963580], edi
mov dword [0x1409635d8], edi
mov dword [0x140963630], edi
mov dword [0x140963688], edi
mov dword [0x1409636e0], edi
mov dword [0x140963738], edi
mov dword [0x140963790], edi
mov dword [0x1409637e8], edi
mov dword [0x140963840], edi
mov dword [0x140963898], edi
mov dword [0x1409638f0], edi
mov dword [0x140963948], edi
call fcn.140056e8c
mov rbx, rax
xor eax, eax
mov rcx, rbx
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0xef8e
mov qword [0x1401591c8], rbx
call fcn.140030730
mov rcx, qword [0x14095e440]
test rcx, rcx
je 0x14004d95b
call fcn.140044b00
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400270c0
Function at 0x14004d980
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov eax, dword [reloc.WS2_32.dll_accept]
mov ecx, eax
dec eax
mov dword [reloc.WS2_32.dll_accept], eax
test ecx, ecx
je 0x14004d9d4
xor eax, eax
mov dword [0x14015e164], 1
mov qword [rsp + 0x28], rax
lea r8, [0x14004a710]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14004d9df
mov rcx, rax
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 1
call fcn.14005accc
int3
lea rcx, str.thread_creation_failed
call fcn.140041200
mov ecx, 1
call fcn.14005accc
int3