joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037c50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x140037cb1
mov edx, 1
call fcn.140036f90
mov r11, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.140036f90
mov eax, ebx
jmp 0x140037cf7
test edx, edx
js 0x140037cf5
cmp ebx, 2
jg 0x140037cf5
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400924f0]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14006e18c
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.14006e18c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140037d10
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140037e6b
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x860
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp dword [rcx + 0x1018], 0
mov rbx, rcx
je 0x140037e53
mov r8, rdx
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
mov edx, 0x801
mov qword [r11 - 0x10], rdi
call fcn.140053cd0
cmp eax, 0x801
jb 0x140037dc2
mov rdx, qword [rsp + 0x878]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rdx - 2], 0xa
jne 0x140037da9
lea r8, str...._n
lea edx, [rax + 5]
lea rcx, [rsp + 0x82c]
call fcn.140053d40
jmp 0x140037dc2
lea r8, [0x140092508]
lea rcx, [rsp + 0x82d]
mov edx, 4
call fcn.140053d40
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
cmp qword [rbx + 0x718], rax
je 0x140037e15
lea edx, [rax + 1]
mov rcx, rbx
call fcn.140036f90
mov rdx, qword [rbx + 0x670]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x718]
xor edx, edx
mov rcx, rbx
call fcn.140036f90
jmp 0x140037e4b
mov r9, qword [rbx + 0x668]
mov edx, 2
lea rcx, [0x1400924f0]
lea r8d, [rdx - 1]
call fcn.14006e18c
mov r9, qword [rbx + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.14006e18c
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x860
pop rbx
repz ret
Function at 0x140037d19
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x140037e6b
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x860
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp dword [rcx + 0x1018], 0
mov rbx, rcx
je 0x140037e53
mov r8, rdx
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
mov edx, 0x801
mov qword [r11 - 0x10], rdi
call fcn.140053cd0
cmp eax, 0x801
jb 0x140037dc2
mov rdx, qword [rsp + 0x878]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rdx - 2], 0xa
jne 0x140037da9
lea r8, str...._n
lea edx, [rax + 5]
lea rcx, [rsp + 0x82c]
call fcn.140053d40
jmp 0x140037dc2
lea r8, [0x140092508]
lea rcx, [rsp + 0x82d]
mov edx, 4
call fcn.140053d40
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
cmp qword [rbx + 0x718], rax
je 0x140037e15
lea edx, [rax + 1]
mov rcx, rbx
call fcn.140036f90
mov rdx, qword [rbx + 0x670]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9, rdi
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x718]
xor edx, edx
mov rcx, rbx
call fcn.140036f90
jmp 0x140037e4b
mov r9, qword [rbx + 0x668]
mov edx, 2
lea rcx, [0x1400924f0]
lea r8d, [rdx - 1]
call fcn.14006e18c
mov r9, qword [rbx + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call fcn.14006e18c
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x860
pop rbx
repz ret

Function at 0x140037e70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x160
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp dword [rcx + 0x1018], 0
mov rbx, rcx
jne 0x140037eb3
cmp qword [rcx + 0x678], 0
je 0x140037fb5
mov r8, rdx
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x158], rdi
call fcn.140053cd0
mov rdx, qword [rbx + 0x678]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
test rdx, rdx
je 0x140037f1c
cmp dword [rbx + 0x17f4], eax
jne 0x140037f1c
lea rcx, [rsp + 0x30]
movzx eax, byte [rcx]
inc rdx
inc rcx
mov byte [rdx - 1], al
test al, al
jne 0x140037f02
mov dword [rbx + 0x17f4], 1
cmp dword [rbx + 0x1018], 0
je 0x140037fad
cmp qword [rbx + 0x718], 0
mov byte [rsp + rdi + 0x30], 0xa
mov byte [rsp + rdi + 0x31], 0
je 0x140037f76
mov edx, 1
mov rcx, rbx
call fcn.140036f90
mov rdx, qword [rbx + 0x670]
lea r9, [rdi + 1]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x30]
mov rcx, rbx
xor edx, edx
call qword [rbx + 0x718]
xor edx, edx
mov rcx, rbx
call fcn.140036f90
jmp 0x140037fad
mov r9, qword [rbx + 0x668]
mov edx, 2
lea rcx, [0x1400924f0]
lea r8d, [rdx - 1]
call fcn.14006e18c
mov r9, qword [rbx + 0x668]
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x30]
mov r8d, 1
call fcn.14006e18c
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x160
pop rbx
ret
Function at 0x140038430
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, edx
mov rax, qword [rbx + 0x720]
mov rbp, qword [rbx + rcx*8 + 0x4c0]
mov rdi, rcx
shl rdi, 5
mov rsi, qword [rdi + rbx + 0x510]
sub rsi, qword [rdi + rbx + 0x518]
test byte [rax + 0x7c], 3
je 0x14003854c
lea rax, [0x140038130]
cmp qword [rbx + rcx*8 + 0x4e8], rax
jne 0x14003854c
cmp qword [rdi + rbx + 0x508], 0
je 0x1400384a3
test rsi, rsi
je 0x14003854c
or r8, 0xffffffffffffffff
xor r9d, r9d
mov rcx, rbp
or rdx, r8
call fcn.1400529e0
cmp eax, 0xffffffff
je 0x14003854c
test al, 1
je 0x14003854c
cmp qword [rdi + rbx + 0x508], 0
jne 0x14003851e
mov rax, qword [rbx]
mov ecx, dword [rax + 0xbe0]
add ecx, ecx
movsxd rcx, ecx
mov qword [rdi + rbx + 0x510], rcx
call qword [fcn.14006efe4]
mov rsi, qword [rdi + rbx + 0x510]
xor ecx, ecx
mov qword [rdi + rbx + 0x508], rax
mov qword [rdi + rbx + 0x518], rcx
mov qword [rdi + rbx + 0x520], rcx
test rax, rax
jne 0x14003851e
mov qword [rdi + rbx + 0x510], rcx
jmp 0x14003854c
mov rdx, qword [rdi + rbx + 0x508]
xor r9d, r9d
mov r8d, esi
add rdx, qword [rdi + rbx + 0x518]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x14003854c
add qword [rdi + rbx + 0x518], rcx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140038570
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x130
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbp, qword [rsp + 0x180]
movsxd rax, edx
mov rsi, r9
mov rbx, qword [rcx + rax*8 + 0x4c0]
mov rdi, r8
mov r12, rcx
call fcn.140038430
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp], 0
movsxd rdi, eax
cmp rdi, 0xffffffffffffffff
jne 0x140038624
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x1400385ed
mov dword [rbp], 0x51
xor eax, eax
jmp 0x140038627
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov ecx, eax
call fcn.140034b60
mov rcx, qword [r12]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.140037e70
mov r11, qword [r12]
mov dword [r11 + 0x1350], ebx
mov dword [rbp], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x130
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140038d10
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov eax, esi
lea r9, [rsp + 0x70]
lea r8d, [rsi + 8]
cmp dword [rcx + 0x1050], eax
mov edx, 0xffff
mov rcx, rdi
setne al
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x70], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140038d7e
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov r8, rdi
mov rcx, rbx
call fcn.140037d10
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov ecx, dword [rbx + 0xf2c]
mov dword [rsp + 0x50], 1
call fcn.140034220
mov ecx, dword [rbx + 0xf30]
imul eax, eax, 0x3e8
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x54], eax
call fcn.140034220
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x50]
mov r9d, ntohl
mov edx, 0x98000004
imul eax, eax, 0x3e8
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x140038e10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov r8d, edi
mov r9d, eax
mov rcx, rbx
call fcn.140037d10
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140039730
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x32c], 3
mov rdi, rdx
mov rbx, rcx
jne 0x140039963
cmp dword [rcx + 0x688], 0
jne 0x140039963
cmp dword [rcx + 0x6d4], 0
jne 0x140039963
mov rsi, qword [rcx]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0xb0]
mov rcx, rdi
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x1400397dd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x130]
mov r8d, pe_nt_image_headers64
mov ecx, eax
mov ebx, eax
call fcn.140034b60
lea rdx, str.getpeername___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140037e70
jmp 0x14003996b
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x80
mov dword [rsp + 0x24], 0x80
call fcn.1400717b0
lea r8, [rsp + 0x24]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140039845
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x130]
mov r8d, pe_nt_image_headers64
mov ecx, eax
mov ebx, eax
call fcn.140034b60
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov r9, rax
mov rcx, rsi
call fcn.140037e70
jmp 0x14003996b
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x42c]
lea r8, [rbx + 0x3fe]
lea rcx, [rsp + 0xb0]
call fcn.1400396a0
test eax, eax
jne 0x1400398a7
call fcn.14007044c
mov rbx, rax
call fcn.14007044c
mov ecx, dword [rbx]
lea rdx, [rsp + 0x130]
mov r8d, pe_nt_image_headers64
mov rdi, rax
call fcn.140034b60
mov r8d, dword [rdi]
lea rdx, str.ssrem_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140037e70
jmp 0x14003996b
mov rax, qword [rbx + 0x3fe]
mov edx, dword [rsp + 0x24]
lea r9, [rbx + 0x460]
mov qword [rbx + 0x2f8], rax
mov rax, qword [rbx + 0x406]
lea r8, [rbx + 0x430]
mov qword [rbx + 0x300], rax
mov rax, qword [rbx + 0x40e]
lea rcx, [rsp + 0x30]
mov qword [rbx + 0x308], rax
mov rax, qword [rbx + 0x416]
mov qword [rbx + 0x310], rax
mov rax, qword [rbx + 0x41e]
mov qword [rbx + 0x318], rax
mov eax, dword [rbx + 0x426]
mov dword [rbx + 0x320], eax
movzx eax, word [rbx + 0x42a]
mov word [rbx + 0x324], ax
call fcn.1400396a0
test eax, eax
jne 0x140039963
call fcn.14007044c
mov rbx, rax
call fcn.14007044c
mov ecx, dword [rbx]
lea rdx, [rsp + 0x130]
mov r8d, pe_nt_image_headers64
mov rdi, rax
call fcn.140034b60
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.140037e70
jmp 0x14003996b
mov rcx, rbx
call fcn.140039580
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14006d1b0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140039b10
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, qword [rcx]
mov rax, rdx
mov edx, 6
lea r9, [rsp + 0x30]
lea r8d, [rdx - 5]
mov rcx, rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x140039b86
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, [rsp + 0x40]
mov r8d, pe_nt_image_headers64
mov ecx, eax
call fcn.140034b60
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.140037d10
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x150
pop rbx
ret

Function at 0x140039ba0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1400b8e90]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140039bfd
lea r9d, [rax + 3]
lea r8d, [rax + 2]
lea ecx, [rax + 6]
xor edx, edx
call fcn.140035f10
test eax, eax
je 0x140039bf1
mov dword [0x1400b8e90], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x1400b8e90], 1
jmp 0x140039c02
cmp eax, 2
je 0x140039c54
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140039c33
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140039c54
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x140039c60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x558], 0
je 0x140039c7d
call fcn.140031200
test eax, eax
jne 0x140039ca8
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x140039c76
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x140039ca8
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x1400403d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0xd0
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa58]
mov rdi, qword [rcx]
mov dword [rsp + 0x30], 0x80
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov r12, rcx
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x40]
add r8d, 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140040467
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.14006ecb0
mov r11d, dword [rsp + 0x30]
mov dword [rbx + 0x150], r11d
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400404c8
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.140037e70
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0xd0
pop r12
pop rdi
pop rbx
ret
mov rcx, qword [rbx + 0x168]
movzx eax, byte [rcx]
shl ax, 8
movzx edx, ax
movzx eax, byte [rcx + 1]
or edx, eax
mov dword [rbx + 0xc], edx
sub edx, 3
je 0x1400405a0
sub edx, 1
je 0x14004061e
sub edx, 1
je 0x14004053d
cmp edx, 1
je 0x140040519
lea r8, str.Internal_error:_Unexpected_packet
lea rdx, [0x14009f498]
mov rcx, rdi
call fcn.140037e70
jmp 0x14004061e
mov rdx, qword [rbx + 0x168]
add r8d, 0xfffffffe
mov rcx, rbx
add rdx, 2
call fcn.14003ef40
test eax, eax
je 0x14004061e
jmp 0x14004049c
mov rdx, qword [rbx + 0x168]
mov rsi, qword [rbx + 0x168]
lea eax, [r8 - 4]
movsxd rbp, eax
movzx eax, byte [rdx + 2]
add rsi, 4
shl ax, 8
mov r8, rbp
movzx ecx, ax
movzx eax, byte [rdx + 3]
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call fcn.14006fbc4
test rax, rax
je 0x14004061e
sub rax, rsi
cmp rax, rbp
jae 0x14004061e
lea rdx, str.TFTP_error:__s_n
mov r8, rsi
mov rcx, rdi
call fcn.140037d10
jmp 0x14004061e
cmp r8d, 4
jle 0x14004061e
mov rcx, qword [rbx + 0x168]
movzx eax, byte [rcx + 2]
shl ax, 8
movzx edx, ax
movzx eax, byte [rcx + 3]
or edx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, edx
jne 0x14004061e
lea eax, [r8 - 4]
lea r8, [rcx + 4]
mov edx, 1
movsxd r9, eax
mov rcx, r12
call fcn.1400383f0
mov esi, eax
test eax, eax
je 0x1400405fd
mov edx, 5
mov rcx, rbx
call fcn.140040350
mov eax, esi
jmp 0x14004049c
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.140055fa0
mov rcx, r12
call fcn.140056760
test eax, eax
je 0x14004049a
mov edx, 5
mov rcx, rbx
call fcn.140040350
mov eax, Ordinal_45
jmp 0x14004049c
Function at 0x1400408c0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1400b6f80]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140040906
lea rdx, str.WSAStartup_failed___d_
mov r8d, eax
mov rcx, rbx
call fcn.140037e70
jmp 0x140040935
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx r11d, word [rsp + 0x20]
cmp r11b, 2
jne 0x140040926
shr r11w, 8
test r11b, r11b
jne 0x140040926
xor eax, eax
jmp 0x14004093a
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.140037e70
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14006d1b0
add rsp, 0x1d0
pop rbx
ret

Function at 0x140040a00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0x1018], 0
movsxd r10, r9d
mov r11, rcx
je 0x140040b2d
cmp r8d, 0xff
jne 0x140040a64
lea eax, [r10 - 0xec]
mov r8, rdx
cmp eax, 0x13
ja 0x140040a51
lea rcx, [0x140000000]
lea rdx, str._s_IAC__s_n
mov r9, qword [rcx + r10*8 + 0x93670]
mov rcx, r11
add rsp, 0x38
jmp fcn.140037d10
lea rdx, str._s_IAC__d_n
mov r9d, r10d
add rsp, 0x38
jmp fcn.140037d10
cmp r8d, 0xfb
jne 0x140040a76
lea r9, str.WILL
jmp 0x140040ab4
cmp r8d, 0xfc
jne 0x140040a88
lea r9, str.WONT
jmp 0x140040ab4
cmp r8d, 0xfd
jne 0x140040a9a
lea r9, [0x140093a64]
jmp 0x140040ab4
xor r9d, r9d
cmp r8d, 0xfe
lea rax, str.DONT
cmove r9, rax
test r9, r9
je 0x140040b16
cmp r10d, 0x27
jg 0x140040aea
lea rcx, [0x140000000]
mov rcx, qword [rcx + r10*8 + 0x93c90]
test rcx, rcx
jne 0x140040afa
mov r8, rdx
lea rdx, str._s__s__d_n
mov rcx, r11
mov dword [rsp + 0x20], r10d
call fcn.140037d10
add rsp, 0x38
ret
cmp r10d, 0xff
jne 0x140040ace
lea rcx, str.EXOPL
mov r8, rdx
mov qword [rsp + 0x20], rcx
lea rdx, str._s__s__s_n
mov rcx, r11
call fcn.140037d10
add rsp, 0x38
ret
mov r9d, r8d
mov r8, rdx
lea rdx, str._s__d__d_n
mov dword [rsp + 0x20], r10d
call fcn.140037d10
add rsp, 0x38
ret

Function at 0x140040b40
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
xor r9d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 0x4c0]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x11], dl
mov byte [rax + 0x12], r8b
lea r8d, [r9 + 3]
lea rdx, [rax + 0x10]
mov byte [rax + 0x10], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140040b9e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.140037e70
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.140040a00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140040bd0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 0xc08]
test r10d, r10d
je 0x140040c8b
sub r10d, 2
je 0x140040c3c
cmp r10d, 1
jne 0x140040c75
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140040c2b
cmp ecx, r10d
jne 0x140040c75
mov dword [r8 + r9*4 + 0xc08], r10d
mov dword [r8 + r9*4 + 0x1008], 0
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140040c7a
cmp ecx, 1
jne 0x140040c75
mov dword [r8 + r9*4 + 0xc08], 3
mov dword [r8 + r9*4 + 0x1008], 0
mov rcx, r11
mov r8d, edx
mov edx, 0xfe
call fcn.140040b40
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x1408], 1
jne 0x140040c68
mov dword [r8 + r9*4 + 0xc08], 1
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.140040b40

Function at 0x140040cc0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 0xc08]
sub r10d, 1
je 0x140040d68
sub r10d, 1
je 0x140040d40
cmp r10d, 1
jne 0x140040d7f
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140040d31
cmp ecx, r10d
jne 0x140040d7f
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x1008], eax
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.140040b40
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x140040d31
cmp ecx, 1
jne 0x140040d7f
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov dword [r8 + r9*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov r8d, edx
mov edx, 0xfe
call fcn.140040b40
add rsp, 0x28
ret

Function at 0x140040d90
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x1a8]
mov r10d, dword [r8 + r9*4 + 8]
sub r10d, 1
je 0x140040e24
sub r10d, 1
je 0x140040dff
cmp r10d, 1
jne 0x140040e38
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x140040df3
cmp ecx, r10d
jne 0x140040e38
xor eax, eax
mov dword [r8 + r9*4 + 8], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x408], eax
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.140040b40
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x140040df3
cmp ecx, 1
jne 0x140040e38
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov dword [r8 + r9*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov r8d, edx
mov edx, 0xfc
call fcn.140040b40
add rsp, 0x28
ret