joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180203290
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1802032c9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
or edx, 0xffffffff
mov ecx, 0x38
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1802032e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdi, r9
mov rcx, qword [rax + 0x10]
mov r13, r8
mov r14, rdx
test rcx, rcx
je 0x18020331e
call fcn.18020f550
test al, al
je 0x18020331e
mov bpl, 1
jmp 0x180203321
xor bpl, bpl
mov rsi, qword [rsp + 0x60]
xor r8d, r8d
cmp r14, qword [rbx + 0x128]
sete r8b
mov qword [rsp + 0x40], r12
mov qword [rsi], 0
test bpl, bpl
je 0x1802033a6
mov rcx, qword [rbx + 0x240]
mov rax, qword [rbx + 0x248]
mov r12, rdi
sub rax, rcx
cmp rax, rdi
cmovb r12, rax
test r12, r12
je 0x180203391
mov rax, qword [rbx + 0x238]
mov r8, r12
lea rdx, [rcx + rax]
mov rcx, r13
call sub.MSVCR100.dll_memcpy
add qword [rbx + 0x240], r12
mov byte [rbx + 0x1bc], 0
mov qword [rsi], r12
jmp 0x180203444
mov rdx, qword [rbx + 0x238]
mov ecx, 0x4000
cmp rdi, rcx
cmovb rcx, rdi
jmp 0x1802033cc
mov rax, qword [rbx]
mov ecx, 0x4000
mov edx, dword [rax + 0x388]
mov eax, ecx
test edx, edx
cmovne eax, edx
cmp edi, eax
jl 0x1802033c6
test edx, edx
cmovne ecx, edx
mov edi, ecx
movsxd rcx, edi
mov rdx, r13
movsxd rax, r8d
cmp dword [rbx + rax*8 + 0x134], 2
jne 0x1802033de
or eax, 0xffffffff
jmp 0x180203446
cmp dword [rbx + 0x218], 0
jne 0x180203444
mov r8d, ecx
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
cmp rdi, 0xffffffffffffffff
jne 0x180203418
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
or edx, edi
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
jmp 0x180203446
test eax, eax
js 0x180203444
test bpl, bpl
je 0x180203441
mov rdx, qword [rbx + 0x238]
mov r8, rdi
mov rcx, r13
call sub.MSVCR100.dll_memcpy
mov qword [rbx + 0x248], rdi
mov qword [rbx + 0x240], rdi
add qword [rsi], rdi
xor eax, eax
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rdi
ret
Function at 0x180203470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rcx + 0x218]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test r10, r10
je 0x1802034b3
mov rax, qword [rcx + 0x190]
mov qword [rsp + 0x20], rax
call r10
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test edx, edx
js 0x1802034fc
cmp edx, 2
jg 0x1802034fc
mov r9, qword [rbx + 0x188]
movsxd rax, edx
mov edx, 2
lea rcx, [rax + rax*2]
lea rax, [0x18034ca48]
lea r8d, [rdx - 1]
add rcx, rax
call qword [sym.imp.MSVCR100.dll_fwrite]
mov r9, qword [rbx + 0x188]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fwrite]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x180203510
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xe0
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0xd0], rax
cmp byte [rcx + 0x3c0], 0
mov rax, qword [rsp + 0x130]
mov r12, r9
mov rbp, r8
mov esi, edx
mov rbx, rcx
je 0x180203640
test rax, rax
je 0x180203640
mov rdx, qword [rax + 0xb8]
test rdx, rdx
je 0x180203640
mov ecx, esi
lea r9, str.Data
dec ecx
je 0x180203597
dec ecx
je 0x180203587
dec ecx
je 0x18020359e
dec ecx
je 0x18020358e
jmp 0x180203640
lea r9, str.Header
lea rax, [0x18034ca74]
jmp 0x1802035a5
lea r9, str.Header
lea rax, str.from
mov qword [rsp + 0x28], rdx
lea r8, str.__s__s__s_
lea rcx, [rsp + 0x30]
mov edx, 0xa0
mov qword [rsp + 0x20], rax
call fcn.180212380
mov r10, qword [rbx + 0x218]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
test r10, r10
je 0x180203608
mov rax, qword [rbx + 0x190]
lea r9, [rcx - 1]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call r10
test eax, eax
je 0x180203640
jmp 0x180203650
mov r9, qword [rbx + 0x188]
mov edx, 2
lea rcx, [0x18034ca48]
lea r8d, [rdx - 1]
call qword [sym.imp.MSVCR100.dll_fwrite]
mov r9, qword [rbx + 0x188]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
call qword [sym.imp.MSVCR100.dll_fwrite]
mov r9, r12
mov r8, rbp
mov edx, esi
mov rcx, rbx
call fcn.180203470
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180227610
add rsp, 0xe0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1802037f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rax, edx
mov r10, r9
mov r11, r8
mov rdi, rcx
mov rcx, qword [rcx + rax*8 + 0x120]
xor r9d, r9d
mov r8d, r10d
mov rdx, r11
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x18020385c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x180203840
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, eax
mov rcx, rdi
call fcn.180213960
mov rcx, qword [rdi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.180203720
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180203c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x180203c4c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
mov r8, rax
add rdx, 4
mov ecx, 2
jmp fcn.180213b50
Function at 0x18020e310
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov dword [rsp + 0x38], edx
lea r8, [rsp + 0x38]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret
Function at 0x18020e760
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx]
mov r10, rdx
mov edx, 6
movzx eax, byte [rbx + 0x3ee]
mov rdi, rcx
lea r9, [rsp + 0x40]
lea r8d, [rdx - 5]
mov rcx, r10
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x18020e7ce
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov edx, eax
call fcn.180213960
lea rdx, str.Could_not_set_TCP_NODELAY:__s_n
mov rcx, rbx
mov r8, rax
call fcn.180203670
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rdx, str.TCP_NODELAY_set_n
mov rcx, rbx
call fcn.180203670
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18020ecb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rcx
movsxd rcx, dword [rcx + 0x680]
mov rbx, rdx
cmp ecx, 0xffffffff
je 0x18020ed16
mov rax, qword [rax + 0x670]
mov rdx, qword [rax]
cmp qword [rdx + rcx*8], 0
je 0x18020ed16
mov rcx, qword [rdx + rcx*8]
test r8, r8
je 0x18020ece5
mov qword [r8], rcx
mov eax, dword [rcx + 0x120]
mov dword [rbx], eax
cmp byte [rcx + 0x130], 0
jne 0x18020ed16
mov rcx, qword [rcx + 0x120]
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x18020ed1c
mov dword [rbx], 0xffffffff
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180214700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, rdx
mov edx, 1
mov rsi, rcx
lea ecx, [rdx + 0x3f]
mov r12d, r8d
call qword [case.0x18020c598.3]
xor r13d, r13d
mov rdi, rax
xor eax, eax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rax
test rdi, rdi
jne 0x180214751
lea ecx, [rax + 0xc]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1802148e1
mov rcx, qword [rsi + 0x390]
mov qword [rsp + 0x60], rbx
call fcn.180204200
mov rcx, rbp
call qword [case.0x18020c598.1]
mov qword [rsi + 0x390], rax
test rax, rax
jne 0x180214792
mov rcx, rdi
call qword [case.0x1800ec9ae.0]
mov ecx, ntohl
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1802148dc
xor r8d, r8d
mov dword [rsi + 0x398], r12d
mov byte [rsi + 0x3a8], r13b
mov dword [rsi + 0x3ac], r13d
mov qword [rsi + 0x3a0], r13
mov qword [rsi + 0x3b0], rdi
lea edx, [r8 + 1]
xor ecx, ecx
mov qword [rdi + 0x10], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x18021483c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x18021483c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rdi + 0x30], rax
test rax, rax
je 0x18021483c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x38], rax
test rax, rax
je 0x18021483c
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x18021485a
lea rcx, [rsi + 0x390]
call fcn.180214600
mov ecx, ntohl
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1802148dc
lea rax, [rdi + 8]
lea r8, [0x1802144b0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.MSVCR100.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
jne 0x1802148a2
call qword [sym.imp.MSVCR100.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 0x390]
call fcn.180214600
xor al, al
jmp 0x1802148dc
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 0x28]
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, 2
mov ecx, edx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi + 0x10], rax
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x180214900
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, qword [rcx]
mov rbp, qword [rcx + 0x3b0]
mov r13, rdx
mov edx, dword [r12 + 0x27c]
mov rdi, rcx
test edx, edx
jne 0x180214946
mov eax, dword [r12 + 0x278]
mov edx, 0x493e0
test eax, eax
cmovne edx, eax
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x18]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
xor esi, esi
mov qword [rbp + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x20], rsi
test ebx, ebx
jne 0x1802149a0
mov rcx, qword [rbp]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1802149f5
mov rcx, qword [rbp]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rbx, [rbp + 0xc]
mov byte [rdi + 0x3a8], 1
mov dword [rbx], 0xffffffff
test r13, r13
je 0x1802149c1
mov rax, qword [rdi + 0x3a0]
mov qword [r13], rax
cmp qword [rdi + 0x3a0], rsi
jne 0x180214aa5
mov eax, dword [rbx]
cmp eax, 0x1b
jne 0x180214a14
mov ecx, eax
mov esi, eax
call fcn.1802130f0
lea rdx, str.Could_not_resolve_host:__s
mov rcx, r12
mov r8, rax
call fcn.180203720
jmp 0x180214aa5
mov ecx, dword [rdi + 0x3ac]
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, qword [rbp]
lea rbx, [rbp + 0xc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x1802149b1
cmp byte [rdi + 0x3a8], sil
je 0x180214a79
mov edx, dword [rdi + 0x3ac]
mov rcx, rdi
cmp byte [rdi + 0x1ab], sil
je 0x180214a54
call fcn.180213960
mov r8, qword [rdi + 0xd8]
lea rdx, str.Could_not_resolve_proxy:__s___s
mov r9, rax
mov rcx, r12
call fcn.180203720
mov esi, 5
jmp 0x180214aa5
call fcn.180213960
mov r8, qword [rdi + 0xb0]
lea rdx, str.Could_not_resolve_host:__s___s
mov r9, rax
mov rcx, r12
call fcn.180203720
mov esi, 6
jmp 0x180214aa5
cmp eax, 0xffffffff
je 0x180214a8a
cmp dword [rdi + 0x3ac], 0x2afc
jne 0x180214aa0
mov r8, qword [rdi + 0xb0]
lea rdx, str.Resolving_host_timed_out:__s
mov rcx, r12
call fcn.180203720
mov esi, 0x1c
lea rcx, [rdi + 0x390]
call fcn.180214600
cmp qword [rdi + 0x3a0], 0
mov eax, esi
jne 0x180214ac4
mov byte [rdi + 0x1a8], 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x180214bb0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov r12, qword [rcx]
mov ebx, r8d
mov rbp, rcx
lea r8, [rsp + 0x50]
mov ecx, 2
mov rsi, r9
mov rdi, rdx
mov dword [r9], 0
call fcn.180224420
test eax, eax
jle 0x180214c05
lea rdx, [rsp + 0x50]
mov r9d, ebx
mov r8, rdi
mov ecx, 2
call fcn.1802141b0
jmp 0x180214c8c
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call fcn.180214700
test al, al
je 0x180214c21
mov dword [rsi], 1
xor eax, eax
jmp 0x180214c8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
mov edx, eax
call fcn.180213960
lea rdx, str.init_resolve_thread___failed_for__s___s_n
mov r8, rdi
mov r9, rax
mov rcx, r12
call fcn.180203670
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x180214c82
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rbp
mov edx, eax
call fcn.180213960
lea rdx, str.gethostbyname_2__failed_for__s:_d___s_n
mov r9d, ebx
mov r8, rdi
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.180203670
xor eax, eax
jmp 0x180214c8c
mov edx, ebx
mov rcx, rax
call fcn.180214040
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x180214dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx]
mov r13, rcx
mov edx, 0x5c
mov rdi, qword [rax + 0x8820]
mov rcx, qword [rdi]
call qword [sym.imp.MSVCR100.dll_strchr]
mov rsi, qword [r13]
xor r15d, r15d
lea r12, [rsi + 0x698]
mov rbp, rax
mov r14d, r15d
call fcn.1802208b0
mov rcx, qword [rsi + 0x208]
mov qword [r13 + 0x260], rcx
mov rcx, qword [rsi + 0x1b0]
mov rbx, rax
mov qword [r13 + 0x268], rcx
mov rcx, qword [r13]
mov qword [rcx + 0x178], r12
test rbp, rbp
jne 0x180214e58
mov eax, 0x25
jmp 0x180215005
cmp byte [rbp + 1], r14b
je 0x180214e4e
mov rcx, qword [rdi]
cmp qword [rsi + 0x8818], r14
je 0x180214e73
lea rdx, [0x18034f0a4]
jmp 0x180214ebb
mov rax, qword [r13]
mov edx, 0x8301
mov r8d, dword [rax + 0x3fc]
call qword [sym.imp.MSVCR100.dll__open]
test eax, eax
jns 0x180214ea9
mov r8, qword [rdi]
lea rdx, str.Cant_open__s_for_writing
mov rcx, rsi
call fcn.180203720
mov eax, reloc.WS2_32.dll_socket
jmp 0x180215005
mov ecx, eax
call qword [sym.imp.MSVCR100.dll__close]
mov rcx, qword [rdi]
lea rdx, [0x18030a8d8]
call qword [sym.imp.MSVCR100.dll_fopen]
mov rbp, rax
test rax, rax
je 0x180214e8d
mov rdx, qword [rsi + 0x288]
cmp rdx, 0xffffffffffffffff
je 0x180214ede
mov rcx, rsi
call fcn.180220e30
cmp qword [rsi + 0x8818], r14
jge 0x180214f32
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll__fileno]
lea rdx, [rsp + 0x28]
mov ecx, eax
call qword [sym.imp.MSVCR100.dll__fstat64]
test eax, eax
je 0x180214f26
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_fclose]
mov r8, qword [rdi]
lea rdx, str.Cant_get_the_size_of__s
mov rcx, rsi
call fcn.180203720
mov eax, reloc.WS2_32.dll_socket
jmp 0x180215005
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x8818], rax
lea r8, [rsp + 0x20]
mov edx, 0x4000
mov rcx, r13
call fcn.180209800
mov edi, eax
test eax, eax
jne 0x180214ffa
movsxd rax, dword [rsp + 0x20]
test eax, eax
jle 0x180214fe4
mov rdi, rax
mov rax, qword [rsi + 0x8818]
test rax, rax
je 0x180214f7c
cmp rdi, rax
jg 0x180214fc6
sub rax, rdi
mov rdi, r15
mov qword [rsi + 0x8818], rax
mov rcx, r12
mov r9, rbp
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR100.dll_fwrite]
cmp rax, rdi
jne 0x180214fdd
add r14, rdi
mov rcx, rsi
mov rdx, r14
call fcn.180220e00
mov rcx, r13
call fcn.180220e50
test eax, eax
jne 0x180214fd6
mov rdx, rbx
mov rcx, rsi
call fcn.180222060
mov edi, eax
test eax, eax
je 0x180214f32
jmp 0x180214ffa
lea rcx, [rax + r12]
sub rdi, rax
mov qword [rsi + 0x8818], r15
jmp 0x180214f7f
mov edi, 0x2a
jmp 0x180214ffa
mov edi, reloc.WS2_32.dll_getservbyname
jmp 0x180214ffa
mov rcx, r13
call fcn.180220e50
mov ecx, edi
mov edi, 0x2a
test eax, eax
cmovne ecx, edi
mov edi, ecx
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_fclose]
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180227610
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180215530
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180215576
lea rdx, str.WSAStartup_failed___d_
mov r8d, eax
mov rcx, rbx
call fcn.180203720
jmp 0x1802155a5
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx r11d, word [rsp + 0x20]
cmp r11b, 2
jne 0x180215596
shr r11w, 8
test r11b, r11b
jne 0x180215596
xor eax, eax
jmp 0x1802155aa
lea rdx, str.insufficient_winsock_version_to_support_telnet
mov rcx, rbx
call fcn.180203720
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180227610
add rsp, 0x1d0
pop rbx
ret

Function at 0x1802157a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
xor r9d, r9d
mov rbx, rcx
mov rcx, qword [rcx + 0x120]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x11], dl
mov byte [rax + 0x12], r8b
lea r8d, [r9 + 3]
lea rdx, [rax + 0x10]
mov byte [rax + 0x10], 0xff
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1802157fe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180203720
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.180215660
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180215900
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x8820]
mov r10d, dword [r8 + r9*4 + 0xc08]
test r10d, r10d
je 0x1802159b4
sub r10d, 2
je 0x18021596a
dec r10d
jne 0x18021599e
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x180215959
dec ecx
jne 0x18021599e
mov dword [r8 + r9*4 + 0xc08], 1
mov dword [r8 + r9*4 + 0x1008], ecx
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x1802159a3
dec ecx
jne 0x18021599e
mov dword [r8 + r9*4 + 0x1008], ecx
mov dword [r8 + r9*4 + 0xc08], 3
mov rcx, r11
mov r8d, edx
mov edx, 0xfe
call fcn.1802157a0
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 0xc08], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x1408], 1
jne 0x180215991
mov dword [r8 + r9*4 + 0xc08], 1
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1802157a0
Function at 0x1802159e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x8820]
mov r10d, dword [r8 + r9*4 + 0xc08]
dec r10d
je 0x180215a7f
dec r10d
je 0x180215a58
dec r10d
jne 0x180215a96
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x180215a49
dec ecx
jne 0x180215a96
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x1008], eax
mov r8d, edx
mov edx, 0xfd
add rsp, 0x28
jmp fcn.1802157a0
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x1008]
test ecx, ecx
je 0x180215a49
dec ecx
jne 0x180215a96
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov dword [r8 + r9*4 + 0x1008], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 0xc08], eax
mov r8d, edx
mov edx, 0xfe
call fcn.1802157a0
add rsp, 0x28
ret

Function at 0x180215b60
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x8820]
mov r10d, dword [r8 + r9*4 + 8]
test r10d, r10d
je 0x180215c05
sub r10d, 2
je 0x180215bc1
dec r10d
jne 0x180215bf2
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x180215bb3
dec ecx
jne 0x180215bf2
mov dword [r8 + r9*4 + 8], 1
mov dword [r8 + r9*4 + 0x408], ecx
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 8], 0
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x180215bf7
dec ecx
jne 0x180215bf2
mov dword [r8 + r9*4 + 0x1008], ecx
mov dword [r8 + r9*4 + 8], 3
mov rcx, r11
mov r8d, edx
mov edx, 0xfc
call fcn.1802157a0
add rsp, 0x28
ret
mov dword [r8 + r9*4 + 8], 1
add rsp, 0x28
ret
cmp dword [r8 + r9*4 + 0x808], 1
jne 0x180215be5
mov dword [r8 + r9*4 + 8], 1
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.1802157a0

Function at 0x180215c30
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
movsxd r9, edx
mov r11, rcx
mov r8, qword [rax + 0x8820]
mov r10d, dword [r8 + r9*4 + 8]
dec r10d
je 0x180215cbf
dec r10d
je 0x180215c9b
dec r10d
jne 0x180215cd3
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x180215c8f
dec ecx
jne 0x180215cd3
xor eax, eax
mov dword [r8 + r9*4 + 8], 2
mov rcx, r11
mov dword [r8 + r9*4 + 0x408], eax
mov r8d, edx
mov edx, 0xfb
add rsp, 0x28
jmp fcn.1802157a0
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
add rsp, 0x28
ret
mov ecx, dword [r8 + r9*4 + 0x408]
test ecx, ecx
je 0x180215c8f
dec ecx
jne 0x180215cd3
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov dword [r8 + r9*4 + 0x408], eax
add rsp, 0x28
ret
xor eax, eax
mov dword [r8 + r9*4 + 8], eax
mov r8d, edx
mov edx, 0xfc
call fcn.1802157a0
add rsp, 0x28
ret