joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov eax, 0xb8
call fcn.0055e9c0
sub rsp, rax
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x90], r12
mov r12, rcx
xor ebx, ebx
mov rcx, r9
mov qword [rsp + 0x78], r15
mov rbp, rdx
mov rsi, rbx
call fcn.00481aa0
test eax, eax
movsxd r15, eax
js 0x516156
mov qword [rsp + 0x98], rdi
mov edi, dword [rsp + 0xe0]
cmp edi, 0xffffffff
jne 0x515f62
mov edi, r15d
mov rcx, qword [r12 + 0x18]
mov qword [rsp + 0x80], r14
call fcn.004882a0
mov rcx, r12
lea r14d, [rax - 1]
call fcn.00479ee0
and r14d, 7
mov r12d, eax
jne 0x515f05
mov byte [rbp], bl
inc rbp
dec r12d
cmp edi, 0xfffffffe
jne 0x515f99
mov edi, r12d
sub edi, r15d
sub edi, 2
test edi, edi
jle 0x516018
lea rdx, [0x005e6668]
mov r8d, 0xda
mov ecx, edi
call fcn.004844e0
test rax, rax
mov rsi, rax
jne 0x516006
lea r9, str..crypto_rsa_rsa_pss.c
lea edx, [rax + 0x7d]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0xde
call fcn.0047c130
jmp 0x51613e
cmp edi, 0xfffffffe
jne 0x515f6c
jmp 0x515ed5
cmp edi, 0xfffffffe
jge 0x515ed5
mov edx, 0x7d
lea r9, [0x005e6638]
mov dword [rsp + 0x20], CreateErrorInfo
lea ecx, [rdx - 0x79]
lea r8d, [rdx + 0xb]
call fcn.0047c130
mov eax, ebx
jmp 0x515fd1
lea eax, [r15 + rdi + 2]
cmp r12d, eax
jge 0x515f17
mov edx, 0x7d
lea r9, [0x005e6650]
mov dword [rsp + 0x20], 0xd5
lea ecx, [rdx - 0x79]
lea r8d, [rdx - 0xf]
call fcn.0047c130
mov eax, ebx
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0x78]
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov edx, edi
mov rcx, rax
call fcn.00481740
test eax, eax
jle 0x51613e
mov qword [rsp + 0x88], r13
mov r13d, r12d
lea rcx, [rsp + 0x38]
sub r13d, r15d
lea eax, [r13 - 1]
cdqe
add rax, rbp
mov qword [rsp + 0x30], rax
call fcn.0049d430
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.0049d4a0
lea rdx, [0x005886a8]
lea rcx, [rsp + 0x38]
mov r8d, 8
call fcn.0049d710
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x38]
mov r8, r15
call fcn.0049d710
test edi, edi
je 0x516093
lea rcx, [rsp + 0x38]
movsxd r8, edi
mov rdx, rsi
call fcn.0049d710
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
xor r8d, r8d
call fcn.0049d8e0
lea rcx, [rsp + 0x38]
call fcn.0049d7e0
mov rax, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x30]
lea edx, [r13 - 1]
mov r9d, r15d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.004ac9d0
test eax, eax
jne 0x516136
sub r13d, edi
sub r13d, 2
movsxd rdx, r13d
add rdx, rbp
inc rdx
xor byte [rdx - 1], 1
test edi, edi
jle 0x516112
test edi, edi
movsxd r8, edi
jle 0x516112
nop
nop
nop
nop
movzx eax, byte [rbx + rsi]
inc rbx
inc rdx
xor byte [rdx - 1], al
cmp rbx, r8
jl 0x516100
test r14d, r14d
je 0x516129
mov ecx, 8
mov eax, 0xff
sub ecx, r14d
sar eax, cl
and byte [rbp], al
movsxd rax, r12d
mov ebx, 1
mov byte [rax + rbp - 1], 0xbc
mov r13, qword [rsp + 0x88]
test rsi, rsi
je 0x515fc7
mov rcx, rsi
call fcn.004849b0
mov eax, ebx
jmp 0x515fc9
mov eax, ebx
jmp 0x515fd9
Function at 0x519980
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.0055e9c0
sub rsp, rax
mov rax, qword [0x005ca070]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov ebp, dword [rsp + 0xb0]
test bpl, 7
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r15
mov r15, r8
mov rbx, rdx
mov r13, rcx
jne 0x519a88
cmp ebp, 8
jb 0x519a88
mov qword [rsp + 0x68], rdi
lea rcx, [r15 + 8]
mov r8, rbp
mov rdx, r9
mov qword [rsp + 0x60], r12
mov edi, 1
mov qword [rsp + 0x50], r14
call fcn.004435a0
lea rax, [0x00589d60]
test rbx, rbx
lea r12d, [rdi + 5]
mov qword [rsp + 0x70], rsi
cmovne rax, rbx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
test ebp, ebp
lea rbx, [r15 + 8]
je 0x519a62
lea esi, [rbp - 1]
shr esi, 3
inc esi
nop
nop
nop
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r8, r13
mov qword [rsp + 0x28], rax
call fcn.0049e8d0
xor byte [rsp + 0x27], dil
mov rax, qword [rsp + 0x28]
mov qword [rbx], rax
add rbx, 8
inc edi
dec rsi
jne 0x519a30
dec r12
jne 0x519a15
mov rax, qword [rsp + 0x20]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov qword [r15], rax
lea eax, [rbp + 8]
jmp 0x519a8d
mov eax, 0xffffffff
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
call fcn.0055e990
add rsp, 0x88
ret

Function at 0x51d400
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x48
call fcn.0055e9c0
sub rsp, rax
test r8, r8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rbx, rdx
mov rsi, rcx
mov rdi, r8
jne 0x51d440
xor eax, eax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
test rcx, rcx
je 0x51d4d8
test rdx, rdx
je 0x51d498
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], r8
call fcn.0048f300
test rax, rax
jne 0x51d4c0
lea rdx, [0x005e8b98]
sub rdx, rbx
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x51d487
inc rbx
test eax, eax
jne 0x51d475
test ecx, ecx
jne 0x51d498
mov rcx, rdi
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x51d4e0
mov rcx, qword [rsi + 0x10]
lea rax, str.default
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdi
call fcn.0048f300
test rax, rax
je 0x51d42a
mov rax, qword [rax + 0x10]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov rcx, r8
call sub.msvcrt.dll_getenv
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x5283d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov rbx, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rdi
cmp dword [rcx + 8], 2
mov rbp, r8
mov rdi, rdx
sete sil
test sil, sil
je 0x528415
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rdi
call qword [rbx + 0x18]
mov rdi, rax
jmp 0x528457
cmp qword [rbx + 0x10], 0
jne 0x52843f
mov rcx, qword [rcx + 0x10]
lea rdx, [0x00563164]
call qword [sym.imp.msvcrt.dll_fopen]
test rax, rax
mov qword [rbx + 0x10], rax
jne 0x52843f
mov rax, 0xffffffffffffffff
jmp 0x528484
mov r9, qword [rbx + 0x10]
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_fread]
mov rdi, rax
test rdi, rdi
je 0x528461
cmp rdi, rbp
jbe 0x528481
test sil, sil
jne 0x528478
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.msvcrt.dll_fclose]
mov qword [rbx + 0x10], 0
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x529600
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x005ca070]
mov qword [rsp + 0x1c0], rax
mov eax, dword [0x005ed260]
mov ebx, ecx
mov edx, eax
inc eax
test edx, edx
mov dword [0x005ed260], eax
jne 0x5296cd
test cl, 2
mov rax, qword [sym.imp.msvcrt.dll_malloc]
mov qword [sub.msvcrt.dll_malloc], rax
mov rax, qword [sym.imp.msvcrt.dll_free]
mov qword [fcn.00443590], rax
mov rax, qword [sym.imp.msvcrt.dll_realloc]
mov qword [case.0x534e6c.0], rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
mov qword [case.0x534e6c.1], rax
mov rax, qword [sym.imp.msvcrt.dll_calloc]
mov qword [case.0x534e6c.2], rax
je 0x5296c2
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x5296a7
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x5296a1
shr ax, 8
cmp al, 2
je 0x5296c2
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
call fcn.0055e990
add rsp, 0x1d0
pop rbx
ret
mov dword [0x005ed264], ebx
call fcn.0052c400
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
call fcn.0055e990
add rsp, 0x1d0
pop rbx
ret

Function at 0x5297e0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x005ca070]
mov qword [rsp + 0x1d0], rax
cmp dword [0x005ed260], 0
jne 0x5298a3
mov rax, qword [sym.imp.msvcrt.dll_malloc]
lea rdx, [rsp + 0x30]
mov cx, 0x202
mov qword [sub.msvcrt.dll_malloc], rax
mov rax, qword [sym.imp.msvcrt.dll_free]
mov dword [0x005ed260], 1
mov qword [fcn.00443590], rax
mov rax, qword [sym.imp.msvcrt.dll_realloc]
mov qword [case.0x534e6c.0], rax
mov rax, qword [sym.imp.msvcrt.dll__strdup]
mov qword [case.0x534e6c.1], rax
mov rax, qword [sym.imp.msvcrt.dll_calloc]
mov qword [case.0x534e6c.2], rax
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x52987d
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x529877
shr ax, 8
cmp al, 2
je 0x529894
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
call fcn.0055e990
add rsp, 0x1e8
ret
mov dword [0x005ed264], 3
call fcn.0052c400
lea rcx, [rsp + 0x20]
call fcn.0052d050
mov rcx, qword [rsp + 0x20]
xor edx, edx
test eax, eax
cmovne rcx, rdx
mov rax, rcx
mov rcx, qword [rsp + 0x1d0]
call fcn.0055e990
add rsp, 0x1e8
ret

Function at 0x536f30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x536f6b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, reloc.WS2_32.dll_getservbyport
mov edx, 0xffffffff
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x536f80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x58
mov rax, qword [rcx]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x28], r13
mov rbx, rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x20], r14
mov rdi, r9
test rcx, rcx
mov r13, r8
mov r14, rdx
je 0x536fc3
call fcn.0054f400
test al, al
je 0x536fc3
mov bpl, 1
jmp 0x536fc6
xor bpl, bpl
xor r8d, r8d
cmp r14, qword [rbx + 0x120]
mov qword [rsp + 0x40], rsi
mov rsi, qword [rsp + 0x80]
sete r8b
test bpl, bpl
mov qword [rsp + 0x30], r12
mov qword [rsi], 0
je 0x537053
mov rcx, qword [rbx + 0x248]
mov rax, qword [rbx + 0x250]
mov r12, rdi
sub rax, rcx
cmp rax, rdi
cmovb r12, rax
test r12, r12
je 0x53703e
mov rax, qword [rbx + 0x240]
mov r8, r12
lea rdx, [rcx + rax]
mov rcx, r13
call fcn.004435a0
add qword [rbx + 0x248], r12
mov byte [rbx + 0x1b5], 0
mov qword [rsi], r12
jmp 0x5370f3
mov rdx, qword [rbx + 0x240]
mov ecx, 0x4000
cmp rdi, rcx
cmovb rcx, rdi
jmp 0x537079
mov rax, qword [rbx]
mov ecx, 0x4000
mov edx, dword [rax + 0x340]
mov eax, ecx
test edx, edx
cmovne eax, edx
cmp edi, eax
jl 0x537073
test edx, edx
cmovne ecx, edx
mov edi, ecx
movsxd rcx, edi
mov rdx, r13
movsxd rax, r8d
cmp dword [rbx + rax*8 + 0x12c], 2
jne 0x53708d
mov eax, 0xffffffff
jmp 0x5370f5
cmp dword [rbx + 0x218], 0
jne 0x5370f3
mov r8d, ecx
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
cmp rdi, 0xffffffffffffffff
jne 0x5370c7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, reloc.WS2_32.dll_getservbyport
mov edx, edi
cmp eax, 0x2733
cmove ecx, edi
mov eax, ecx
jmp 0x5370f5
test eax, eax
js 0x5370f3
test bpl, bpl
je 0x5370f0
mov rdx, qword [rbx + 0x240]
mov r8, rdi
mov rcx, r13
call fcn.004435a0
mov qword [rbx + 0x250], rdi
mov qword [rbx + 0x248], rdi
add qword [rsi], rdi
xor eax, eax
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x5371d0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x118
mov rax, qword [0x005ca070]
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x388], 0
mov rax, qword [rsp + 0x140]
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov rbp, r9
lea r13, [0x0058dd38]
mov r12, r8
movsxd rsi, edx
mov rbx, rcx
je 0x5372e6
test rax, rax
je 0x5372e6
mov rdx, qword [rax + 0xa8]
test rdx, rdx
je 0x5372e6
mov ecx, esi
lea r9, str.Data
dec ecx
je 0x537270
dec ecx
je 0x537260
dec ecx
je 0x537277
dec ecx
je 0x537267
jmp 0x5372e6
lea r9, str.Header
lea rax, [0x0058dd64]
jmp 0x53727e
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
lea rcx, [rsp + 0x30]
mov edx, 0xa0
mov qword [rsp + 0x20], rax
call fcn.0052b590
mov r10, qword [rbx + 0x1d0]
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
test r10, r10
not rcx
lea rdi, [rcx - 1]
je 0x53730d
mov rax, qword [rbx + 0x138]
lea r9, [rcx - 1]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x537384
mov rdi, qword [rbx + 0x1d0]
test rdi, rdi
je 0x537343
mov rax, qword [rbx + 0x138]
mov r9, rbp
mov r8, r12
mov edx, esi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call rdi
jmp 0x537384
mov r9, qword [rbx + 0x130]
mov edx, 2
mov rcx, r13
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x130]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
jmp 0x5372e6
test esi, esi
js 0x537382
cmp esi, 2
jg 0x537382
mov r9, qword [rbx + 0x130]
mov edx, 2
lea rcx, [rsi + rsi*2]
lea r8d, [rdx - 1]
add rcx, r13
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x130]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.msvcrt.dll_fwrite]
xor eax, eax
mov r13, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xd0]
call fcn.0055e990
add rsp, 0x118
ret
Function at 0x5373d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov r11, rsp
sub rsp, 0x868
mov rax, qword [0x005ca070]
mov qword [rsp + 0x840], rax
test rcx, rcx
mov qword [r11 - 8], rbx
mov rbx, rcx
je 0x5374b1
cmp byte [rcx + 0x3a0], 0
je 0x5374b1
mov r8, rdx
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
mov edx, 0x801
mov qword [r11 - 0x10], rdi
call fcn.0052b530
mov r10, qword [rbx + 0x1d0]
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
test r10, r10
not rcx
lea rdi, [rcx - 1]
je 0x537471
mov rax, qword [rbx + 0x138]
lea r9, [rcx - 1]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
jmp 0x5374a9
mov r9, qword [rbx + 0x130]
mov edx, 2
lea rcx, [0x0058dd38]
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x130]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
mov rdi, qword [rsp + 0x858]
mov rbx, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x840]
call fcn.0055e990
add rsp, 0x868
ret

Function at 0x5374d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x58
mov rax, qword [0x005ca070]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rbx
mov r8, rdx
mov rbx, rcx
lea r9, [rsp + 0x70]
add rcx, 0x678
mov edx, 0x4000
mov qword [rsp + 0x48], rsi
call fcn.0052b530
mov rcx, qword [rbx + 0x140]
test rcx, rcx
je 0x537549
cmp byte [rbx + 0x86c8], 0
jne 0x537549
lea r9, [rbx + 0x678]
lea r8, [0x005626ec]
mov edx, 0x100
call fcn.0052b590
mov byte [rbx + 0x86c8], 1
cmp byte [rbx + 0x3a0], 0
je 0x5375fc
mov qword [rsp + 0x40], rdi
xor eax, eax
lea rdi, [rbx + 0x678]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x3fff
mov rdi, rcx
jae 0x537591
inc rdi
mov byte [rcx + rbx + 0x678], 0xa
mov byte [rdi + rbx + 0x678], al
mov r10, qword [rbx + 0x1d0]
test r10, r10
je 0x5375bd
mov rax, qword [rbx + 0x138]
lea r8, [rbx + 0x678]
mov r9, rdi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
jmp 0x5375f7
mov r9, qword [rbx + 0x130]
mov edx, 2
lea rcx, [0x0058dd38]
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbx + 0x130]
lea rcx, [rbx + 0x678]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.0055e990
add rsp, 0x58
ret
Function at 0x537620
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
movsxd rax, edx
mov r10, r9
mov r11, r8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rcx
mov rcx, qword [rcx + rax*8 + 0x118]
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x537694
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x537678
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov edx, eax
mov rcx, rdi
call fcn.0052a9d0
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.005374d0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret

Function at 0x537710
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x38
mov r10, r9
mov r11, r8
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
xor esi, esi
cmp rdx, qword [rcx + 0x120]
mov rax, rsi
sete al
mov qword [rsp + 0x20], rdi
mov rdi, rcx
mov rcx, qword [rcx + rax*8 + 0x118]
mov r8d, r10d
xor r9d, r9d
mov rdx, r11
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x537789
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x53776d
mov rbx, rsi
jmp 0x537789
mov edx, eax
mov rcx, rdi
call fcn.0052a9d0
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.005374d0
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x20]
cmp rbx, 0xffffffffffffffff
mov qword [rax], rbx
mov rbx, qword [rsp + 0x30]
mov eax, reloc.WS2_32.dll_getservbyname
cmovne eax, esi
mov rsi, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x5379b0
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov r11, rsp
sub rsp, 0x138
mov rax, qword [0x005ca070]
mov qword [rsp + 0xe0], rax
mov qword [r11 - 0x10], rbp
mov rbp, qword [rdx]
mov qword [r11 - 0x18], rsi
mov rsi, rdx
mov qword [rsp + 0x38], rcx
lea rdx, [r11 + 0x20]
mov rcx, r8
mov qword [r11 - 0x40], r15
call fcn.0052c230
test rax, rax
mov r15, rax
mov qword [rsp + 0x30], rax
jne 0x537a0c
lea eax, [r15 + 0x1b]
jmp 0x537c46
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x100], r14
mov rdi, r15
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov r14, r15
mov r15, qword [rsp + 0x38]
not rcx
mov qword [rsp + 0x130], rbx
xor edi, edi
lea r13, [rcx - 1]
lea rdx, [0x0058dd64]
mov qword [rsp + 0x110], r12
nop
nop
cmp r15, qword [rsi + 0x120]
mov eax, edi
sete al
movsxd rcx, eax
cmp dword [rsi + rcx*8 + 0x12c], 2
jne 0x537a82
mov rbx, 0xffffffffffffffff
jmp 0x537ae9
cmp dword [rsi + 0x218], 0
je 0x537a94
mov rbx, 0xffffffffffffffff
jmp 0x537ae9
mov rcx, qword [rsi + rcx*8 + 0x118]
xor r9d, r9d
mov r8d, r13d
mov rdx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x537ae2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x537ac6
mov rbx, rdi
jmp 0x537ae2
mov edx, eax
mov rcx, rsi
call fcn.0052a9d0
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.005374d0
lea rdx, [0x0058dd64]
cmp rbx, 0xffffffffffffffff
mov r12d, reloc.WS2_32.dll_getservbyname
cmovne r12d, edi
test r12d, r12d
jne 0x537c10
cmp byte [rbp + 0x3a0], r12b
je 0x537bf9
cmp byte [rbp + 0x388], r12b
je 0x537b8d
mov rax, qword [rsi + 0xa8]
test rax, rax
je 0x537b8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, str.Data
lea r8, str.__s__s__s_
lea rcx, [rsp + 0x40]
mov edx, 0xa0
call fcn.0052b590
mov r10, qword [rbp + 0x1d0]
xor eax, eax
lea rdi, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
test r10, r10
not rcx
lea rdi, [rcx - 1]
je 0x537bb9
mov rax, qword [rbp + 0x138]
lea r9, [rcx - 1]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x537bf3
mov rdi, qword [rbp + 0x1d0]
test rdi, rdi
je 0x537bf7
mov rax, qword [rbp + 0x138]
mov r9, rbx
mov r8, r14
mov edx, 4
mov rcx, rbp
mov qword [rsp + 0x20], rax
call rdi
xor edi, edi
jmp 0x537bf9
mov r9, qword [rbp + 0x130]
mov edx, 2
lea rcx, [0x0058dd38]
lea r8d, [rdx - 1]
call qword [sym.imp.msvcrt.dll_fwrite]
mov r9, qword [rbp + 0x130]
lea rcx, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_fwrite]
jmp 0x537b8d
xor edi, edi
jmp 0x537bf9
xor edi, edi
cmp rbx, r13
je 0x537c10
sub r13, rbx
lea rdx, [0x0058dd64]
add r14, rbx
jmp 0x537a60
mov rcx, qword [rsp + 0x30]
call qword [fcn.00443590]
mov r14, qword [rsp + 0x100]
mov r13, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x130]
mov eax, r12d
mov r12, qword [rsp + 0x110]
mov r15, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
mov rcx, qword [rsp + 0xe0]
call fcn.0055e990
add rsp, 0x138
ret
Function at 0x5382e0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x53832f
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x538350
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret