joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011ca60
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov edx, Ordinal_46
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x14011cb4b
xor r14d, r14d
nop dword [rax + rax]
mov rax, qword [0x1402d9140]
lea rdx, [rsp + 0x20]
mov edi, 4
mov r8d, 4
cmp rsi, rdi
mov rcx, rbp
cmovb rdi, rsi
call qword [rax + 0x50]
cmp eax, 4
je 0x14011cacd
mov edx, eax
jmp 0x14011cafb
cmp byte [0x1402db619], r14b
jne 0x14011cb05
mov r9d, 2
mov dword [rsp + 0x20], r14d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 2]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
sbb edx, edx
and edx, 2
mov eax, edx
test eax, eax
jne 0x14011cb4d
mov eax, dword [rsp + 0x20]
jmp 0x14011cb24
imul eax, dword [0x1402db758], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1402db758], eax
ror eax, 0x10
mov dword [rsp + 0x20], eax
test rdi, rdi
je 0x14011cb42
sub rsi, rdi
nop dword [rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x14011cb30
mov dword [rsp + 0x20], eax
test rsi, rsi
jne 0x14011caa0
mov eax, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14016b380
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14011cb70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
sub rsi, 1
je 0x14011cc29
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop dword [rax]
mov rax, qword [0x1402d9140]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, rbx
call qword [rax + 0x50]
cmp eax, 4
jne 0x14011cbf5
cmp byte [0x1402db619], bpl
jne 0x14011cc4e
lea r9d, [rax - 2]
mov dword [rsp + 0x20], ebp
mov r8d, eax
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x14011cc2e
mov ecx, dword [rsp + 0x20]
cmp ecx, 0xfffffffc
jae 0x14011cbb0
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rdi], al
inc rdi
sub rsi, 1
jne 0x14011cbb0
mov byte [rdi], 0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14016b380
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x1402db758], 0x41c64e6d
add ecx, 0x3039
mov dword [0x1402db758], ecx
ror ecx, 0x10
mov dword [rsp + 0x20], ecx
jmp 0x14011cbfd
Function at 0x14011d1c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [0x1402d9120]
mov rdi, rax
test rax, rax
je 0x14011d23d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x14011d268
cmp ebx, esi
je 0x14011d268
cmp ebx, 0x8000
ja 0x14011d268
cmp ebx, esi
jb 0x14011d263
mov edx, ebx
mov rcx, rdi
call qword [0x1402d9120]
mov rdi, rax
test rax, rax
jne 0x14011d200
mov rcx, rbp
call qword [fcn.14016c458]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x14011d248
mov rcx, rdi
jmp 0x14011d240
Function at 0x140120630
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r8
mov dword [rsp + 0x40], 4
xor r14d, r14d
mov rbx, r9
mov rbp, rdx
mov qword [rsp + 0x48], r14
mov rsi, rcx
mov qword [rsp + 0x38], r14
mov rcx, rdi
mov dword [rsp + 0x30], r14d
mov r8, r9
mov dword [rsp + 0x44], ebx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9d, [r14 + 0x18]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14012074a
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140120728
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140120728
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], r14d
lea edx, [r14 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140120728
mov eax, dword [rsp + 0x30]
cmp rbx, rax
jb 0x140120728
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x44]
mov r8, rdi
mov dword [rsp + 0x20], r14d
lea edx, [r14 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140120738
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14012074a
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14016b380
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140120e50
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rsp + 0x50]
xor eax, eax
mov qword [r9], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [r14], rax
test r8, r8
jne 0x140120e98
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], al
jne 0x140120e90
lea rcx, [rbx + 2]
movabs rbp, 0xaaaaaaaaaaaaaaab
mov rax, rbp
mul rcx
shr rdx, 1
lea rcx, [rdx*4 + 1]
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov r9, rax
test rax, rax
jne 0x140120ed1
lea eax, [r9 + 0x1b]
jmp 0x140120fc2
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp rbx, 3
jb 0x140120f57
mov rax, rbp
mul rbx
mov r8, rdx
shr r8, 1
imul rax, r8, 0xfffffffffffffffd
add rbx, rax
movzx eax, byte [rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rdi]
movzx eax, byte [rdi + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
movzx edx, byte [rdi + 1]
movzx eax, byte [rdi + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + r10]
mov byte [rcx + 2], al
movzx eax, byte [rdi + 2]
add rdi, 3
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rcx + 3], al
add rcx, 4
sub r8, 1
jne 0x140120ef1
test rbx, rbx
je 0x140120fb4
movzx eax, byte [rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rdi]
and edx, 3
shl rdx, 4
cmp rbx, 1
jne 0x140120f8a
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
mov word [rcx + 2], 0x3d3d
jmp 0x140120fb0
movzx eax, byte [rdi + 1]
shr rax, 4
or rax, rdx
movzx eax, byte [rax + r10]
mov byte [rcx + 1], al
movzx eax, byte [rdi + 1]
and eax, 0xf
movzx eax, byte [r10 + rax*4]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
add rcx, 4
mov byte [rcx], 0
sub rcx, r9
mov qword [r14], rcx
xor eax, eax
mov qword [rsi], r9
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140131fa0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x1402db830]
mov rbx, rcx
mov dword [rsp + 0x34], 0x4020
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 4
test eax, eax
jne 0x14013201c
xor r8d, r8d
mov dword [rsp + 0x20], 3
xor edx, edx
lea ecx, [rax + 6]
call fcn.14011cfa0
test al, al
je 0x140132010
mov dword [0x1402db830], 2
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14016b380
add rsp, 0x50
pop rbx
ret
mov dword [0x1402db830], 1
jmp 0x140132021
cmp eax, 2
je 0x140132073
lea rax, [rsp + 0x38]
mov edx, 0xffff
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140132052
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jg 0x140132073
lea r9, [rsp + 0x34]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14016b380
add rsp, 0x50
pop rbx
ret
Function at 0x140132820
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, qword [rcx]
mov rsi, r9
mov rdi, rcx
mov rbp, r8
mov r14, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [r14 + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x1401328bd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x140132887
mov dword [rsi], 0x51
jmp 0x1401328b6
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.1400f5c00
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.140115830
mov rax, qword [rdi + 8]
mov dword [rax + 0xcfc], ebx
mov dword [rsi], gethostname
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu__fd_qd______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x30], edx
mov rdx, qword [r14 + 0x98]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi]
call fcn.140115a70
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14016b380
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140132bc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rdx + 0x20]
mov rsi, rdx
mov rbx, qword [rcx + 0x10]
mov rcx, qword [rax + 0x360]
test dword [rcx + 0x84], 0x800
jne 0x140132d69
mov rcx, qword [rbx + 0x98]
lea r8, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], Ordinal_133
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140132c93
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, [rsp + 0xb0]
mov ebx, eax
call fcn.1400f5c00
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.140115830
mov eax, 2
jmp 0x140132d6b
movzx ecx, word [rsp + 0x30]
sub ecx, 1
je 0x140132d32
cmp ecx, 1
jne 0x140132cd9
lea r8d, [rcx + 0x2d]
lea rcx, [rsp + 0x34]
lea rdx, [rbx + 0x10e]
call fcn.14012f710
test rax, rax
je 0x140132cd9
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx + 0x140], eax
jmp 0x140132d69
mov byte [rbx + 0x10e], 0
mov dword [rbx + 0x140], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x273f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1400f5c00
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140115830
mov eax, 2
jmp 0x140132d6b
cmp dword [rsp + 0x20], 2
jle 0x140132d58
lea r9, [rsp + 0x32]
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea r8, [0x1402a6310]
lea rcx, [rbx + 0x10e]
call sym.CheraxLoader.exe_curl_msnprintf
jmp 0x140132d5f
mov byte [rbx + 0x10e], 0
mov dword [rbx + 0x140], 0
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14016b380
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140136630
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x1402dbf21], 0
mov rbp, rdx
mov rbx, rcx
je 0x140136693
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x1402dbf18]
mov rax, qword [rsp + 0x20]
cqo
idiv r8
mov rsi, rax
mov rax, qword [rsp + 0x20]
cqo
idiv r8
imul rax, rdx, 0xf4240
cqo
idiv r8
mov r14, rax
jmp 0x1401366b9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
mov esi, edx
imul edx, edx, 0x3e8
sub r8d, edx
imul r14d, r8d, 0x3e8
mov rcx, rbx
mov qword [rsp + 0x70], r15
call fcn.14011cc70
mov rcx, rbp
mov rdi, rax
call fcn.14011cc70
mov r8d, 1
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1401367c4
movabs rbp, 0x20c49ba5e353f6
movabs r15, 0x4189374bc6a7ec
cmp byte [0x1402dbf21], 0
je 0x14013673c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [0x1402dbf18]
mov r9, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x1402dbf18]
mov rcx, rax
jmp 0x140136763
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov r9d, edx
sub r8d, ecx
imul ecx, r8d, 0x3e8
sub r9, rsi
lea rax, [r9 + rbp]
cmp rax, r15
ja 0x1401367ff
sub ecx, r14d
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r9, 0x3e8
movsxd rcx, edx
add rcx, rax
js 0x1401367ff
cmp rcx, 0x3e8
jg 0x1401367ff
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140136702
test rdi, rdi
je 0x1401367d2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1401367e0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14016b380
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rdi, rdi
je 0x14013680d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14013681b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x1401367e2
Function at 0x14013f240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov eax, dword [rcx + 0xd0c]
xor edi, edi
xor r12d, r12d
mov esi, r8d
mov r14d, edx
mov r13, rcx
cmp r8d, eax
jg 0x14013f2a8
cmp r8d, 0xffffffff
cmove esi, eax
test r9, r9
je 0x14013f285
mov r9, qword [r9 + 0x28]
test r9, r9
je 0x14013f2a8
mov r9, qword [r9 + 0x10]
jmp 0x14013f28c
mov r9, qword [rcx + 0x11e8]
test r9, r9
je 0x14013f2a8
mov rbx, qword [r9]
test byte [rbx + 0x2c], r14b
je 0x14013f29f
cmp dword [rbx + 0x28], esi
je 0x14013f2bc
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x14013f291
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
mov r10, qword [rcx + 0x11e8]
mov qword [rsp + 0x30], r15
test r10, r10
je 0x14013f374
mov qword [rsp + 0x28], rbp
mov rbp, qword [rbx + 0x18]
nop word [rax + rax]
mov r11, qword [r10]
mov r8, qword [r11 + 0x18]
test rbp, rbp
je 0x14013f345
test r8, r8
je 0x14013f359
cmp byte [rbp], 0
mov rax, rbp
je 0x14013f32a
nop word [rax + rax]
movzx ecx, byte [r8]
test cl, cl
je 0x14013f32a
movzx edx, byte [rax]
lea rbp, [0x140269d90]
movzx ecx, byte [rcx + rbp]
cmp byte [rdx + rbp], cl
mov rbp, qword [rbx + 0x18]
jne 0x14013f341
inc rax
inc r8
cmp byte [rax], 0
jne 0x14013f300
xor ecx, ecx
cmp byte [rax], cl
sete cl
xor eax, eax
cmp byte [r8], al
setne al
xor ecx, eax
test ecx, ecx
je 0x14013f359
jmp 0x14013f34a
xor ecx, ecx
jmp 0x14013f33b
test r8, r8
jne 0x14013f359
cmp dword [r11 + 0x28], esi
jne 0x14013f359
test byte [r11 + 0x2c], r14b
je 0x14013f359
inc rdi
cmp r10, r9
jne 0x14013f362
lea r12, [rdi - 1]
mov r10, qword [r10 + 0x10]
test r10, r10
jne 0x14013f2e0
mov rbp, qword [rsp + 0x28]
mov rcx, qword [rbx + 0x18]
lea rax, [r13 + 0x1238]
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
movzx ecx, byte [rbx + 0x2c]
mov rbx, qword [rsp + 0x38]
bts ecx, 0x1b
mov dword [rax + 0x20], ecx
mov qword [rax + 0x28], r9
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401469d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x20]
mov rsi, rcx
xor r9d, r9d
xor ebx, ebx
mov rdi, qword [rax + 0x628]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], Ordinal_133
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rdi + 0x144]
mov rdx, qword [rdi + 0x150]
add r8d, 4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rdi + 0x13c], eax
cmp dword [rdi + 0x138], ebx
jne 0x140146a66
movsxd r8, dword [rsp + 0x34]
lea rcx, [rdi + 0xb8]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x138], eax
mov r8d, dword [rdi + 0x13c]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], r14
cmp r8d, 4
jge 0x140146ac6
lea rdx, str.Received_too_short_packet
mov rcx, rsi
call fcn.140115830
mov dword [rdi + 0xc], 7
mov eax, ebx
mov r14, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14016b380
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [rdi + 0x150]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rdi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x140146afc.1
movsxd rax, ecx
lea r9, [0x140000000]
mov ecx, dword [r9 + rax*4 + 0x146c30]
add rcx, r9
jmp rcx
cmp r8d, 4
jle case.0x140146afc.4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rdi + 0x14c]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x140146afc.4
lea eax, [r8 - 4]
lea r14, [rdx + 4]
movsxd rbp, eax
cmp qword [rsi + 0x158], rbx
jne 0x140146b4b
mov rcx, rsi
call fcn.1401188a0
mov ebx, eax
test eax, eax
jne 0x140146b7d
mov rdx, qword [rsi + 0x158]
test rdx, rdx
jne 0x140146b5c
lea ebx, [rdx + 0x17]
jmp 0x140146b75
mov rax, qword [rdx]
mov r9, r14
mov r8d, 1
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [rax + Ordinal_26]
mov ebx, eax
test ebx, ebx
je case.0x140146afc.4
mov edx, 5
mov rcx, rdi
call fcn.1401466b0
jmp 0x140146a99
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd r14, eax
lea rbp, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, r14
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rdi + 8], ecx
mov rcx, rbp
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je case.0x140146afc.4
sub rax, rbp
cmp rax, r14
jae case.0x140146afc.4
mov r8, rbp
lea rdx, str.TFTP_error:__s
mov rcx, rsi
call fcn.140115960
jmp case.0x140146afc.4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rdi
call fcn.140145410
mov ebx, eax
test eax, eax
je case.0x140146afc.4
jmp 0x140146a9b
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rsi
lea rdx, [0x1402a6310]
call fcn.140115830
mov rcx, rsi
call fcn.140126530
test eax, eax
je 0x140146a99
mov edx, 5
mov rcx, rdi
call fcn.1401466b0
mov eax, Ordinal_46
jmp 0x140146a9b
Function at 0x1401495f0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402d9040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rcx + 0x20]
lea r8, [rsp + 0x28]
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rdi, qword [rsi + 0x228]
mov rcx, rdi
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14014975a
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x20], rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14014975a
lea rdx, str.Connection_accepted_from_server
mov rcx, rbx
call fcn.140115960
lea r8, [rsp + 0x2c]
mov byte [rsi + 0x34d], 0
mov edx, 0x8004667e
mov dword [rsp + 0x2c], 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.140134570
test eax, eax
jne 0x14014976e
cmp qword [rbx + 0x298], 0
je 0x140149756
mov rax, qword [rbx + 0xe0]
lea rdi, [rbx + 0xd8]
test rax, rax
jne 0x1401496de
mov rax, qword [rdi]
test rax, rax
je 0x1401496e5
mov byte [rax + 0x1cb], 1
mov rdx, qword [rsp + 0x20]
mov r8d, 1
mov rcx, qword [rbx + 0x2a0]
call qword [rbx + 0x298]
mov rcx, qword [rbx + 0xe0]
mov edx, eax
test rcx, rcx
je 0x140149714
mov byte [rcx + 0x1cb], 0
jmp 0x140149723
mov rax, qword [rdi]
test rax, rax
je 0x140149723
mov byte [rax + 0x1cb], 0
test edx, edx
je 0x140149756
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0x258]
test rcx, rcx
je 0x140149740
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x20]
lea rcx, [rsi + 0x258]
mov rdx, rbx
call fcn.1401063f0
mov eax, Ordinal_46
jmp 0x14014976e
xor eax, eax
jmp 0x14014976e
lea rdx, str.Error_accept__ing_server_connect
mov rcx, rbx
call fcn.140115830
mov eax, 0x1e
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14016b380
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret