joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6bd4b0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xef
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6bd500
test cl, 1
je 0x6bd521
test edx, 0x10000
je 0x6bd4ec
test edx, 0x2000000
jne 0x6bd540
and edx, 0x200000
je 0x6bd5a0
xor esi, esi
mov eax, esi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
jns 0x6bd4d0
lea rdx, str.src_win_tty.c
mov r8d, 0x402
lea rcx, [0x0090f4f7]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x6bd4d0
test cl, 4
je 0x6bd4d0
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x6bd4d0
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6bd4d0
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r10d, 0x10
mov qword [rsp + 0x52], 0
mov qword [rsp + 0x5a], 0
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rdx + 0x12], r9w
lea r9, [rsp + 0x4c]
mov word [rsp + 0x50], r10w
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x6bd4ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x6bd4ee
lea rcx, [0x00c2c698]
call fcn.006b8b90
mov eax, 2
xchg dword [0x00c2c6bc], eax
cmp eax, 1
je 0x6bd5d4
lea rcx, [0x00c2c698]
call fcn.006b8b60
or dword [rbx + 0x58], 0x200000
jmp 0x6bd4ec
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str.conout_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x6bd6a0
lea rdx, [0x00c2c6a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x6bd733
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov dword [rsp + 0x60], 0
lea rdx, [rsp + 0x50]
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x6bd720
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6bd5c8
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x6bd5c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x6bd4ee
jmp 0x6bd5c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6bd70a
lock or dword [0x00c2c6b8], 1
jmp 0x6bd62d
Function at 0x6bdf00
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov ebp, r9d
mov dword [rsp + 0x48], 1
jne 0x6be0a0
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6bdfe2
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x6bdfd0
xor r9d, r9d
mov rdx, qword [rdi + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x6bdfd0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x4c], 0x274
mov qword [rsp + 0x20], rax
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6bdfd0
cmp dword [rsp + 0x78], 1
je 0x6be040
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x70], rbx
cmp ebp, 0x17
je 0x6be020
xor eax, eax
and edx, 0x400000
jne 0x6bdff4
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x79
lea rdx, str.src_win_udp.c
lea rcx, str.__handle__flags__UV_HANDLE_IPV6_
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6bdfc4
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x6be080
mov rax, qword [0x0091ea70]
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x198], rax
mov rax, qword [0x0091ea80]
or edx, 0x20000
mov dword [rsi + 0x58], edx
mov qword [rsi + 0x1a0], rax
jmp 0x6bdfb1
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 1
je 0x6bdfae
call rdi
jmp 0x6bdfc4
mov eax, 0xfffff00e
jmp 0x6bdfc4
Function at 0x6bee10
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rsi, rcx
mov r12, rdx
mov rbp, r8
mov edi, r9d
cmp eax, 0x2000
je 0x6beee0
mov rdx, qword [0x0091ea40]
mov r9d, 4
mov r8d, 0x1c
call fcn.006be0b0
mov ebx, eax
test eax, eax
jne 0x6bef00
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test rbp, rbp
je 0x6bee95
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, rbp
call fcn.0069deb0
test eax, eax
jne 0x6beee0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [r12 + 8]
movaps xmmword [rsp + 0x30], xmm0
test edi, edi
je 0x6beef2
mov r8d, 0xc
cmp edi, 1
jne 0x6beee0
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6bef20
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x6beeb0
mov ecx, eax
call fcn.0069fed0
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0069fed0
mov ebx, eax
jmp 0x6beed1
Function at 0x6bf5f0
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov edi, dword [rsp + 0xd8]
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13d, r9d
test byte [rdx + 0x59], 0x20
jne 0x6bf644
cmp edi, 0x10
je 0x6bf850
cmp edi, 0x1c
jne 0x6bf870
mov rdx, qword [0x0091ea40]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call fcn.006be0b0
test eax, eax
jne 0x6bf7be
mov rbp, qword [rbx + 8]
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x6c]
mov r8d, r13d
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x40], 0
mov rdx, r12
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x78], rax
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 0
mov rcx, qword [rbx + 0x70]
mov dword [rsi + 8], 5
mov qword [rsi + 0x70], rbx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x6bf720
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x6bf7b0
mov edx, r13d
mov rcx, r12
call fcn.0069e460
mov qword [rsi + 0x60], rax
add qword [rbx + 0x60], rax
mov eax, dword [rbx + 0x7c]
add dword [rbx + 0x78], 1
lea edx, [rax + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], edx
test eax, eax
jne 0x6bf7d2
mov eax, dword [rbx + 0x58]
test al, 4
je 0x6bf800
add dword [rbp + 0x20], 1
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x58]
test edx, 0x20000
je 0x6bf6d4
mov ecx, dword [rbx + 0x7c]
mov qword [rsi + 0x60], 0
add dword [rbx + 0x78], 1
lea r8d, [rcx + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], r8d
test ecx, ecx
je 0x6bf820
test r8d, r8d
jg 0x6bf776
mov dword [rsp + 0x5c], eax
mov r8d, 0x1ba
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x5c]
mov rdx, qword [rbp + 0x48]
add dword [rbp + 0x20], 1
mov qword [rsi + 0x68], 0
test rdx, rdx
je 0x6bf860
mov rcx, qword [rdx + 0x68]
mov qword [rsi + 0x68], rcx
mov qword [rdx + 0x68], rsi
mov qword [rbp + 0x48], rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x6bf712
mov ecx, eax
call fcn.0069fed0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test edx, edx
jg 0x6bf70c
mov r8d, 0x1c2
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6bf70c
mov edx, eax
or edx, 4
mov dword [rbx + 0x58], edx
test al, 8
je 0x6bf70c
mov rax, qword [rbx + 8]
add dword [rax + 8], 1
jmp 0x6bf70c
test dl, 4
jne 0x6bf776
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rbx + 0x58], ecx
je 0x6bf776
mov rdx, qword [rbx + 8]
add dword [rdx + 8], 1
jmp 0x6bf776
mov rdx, qword [0x0091ea30]
jmp 0x6bf62e
mov qword [rsi + 0x68], rsi
mov qword [rbp + 0x48], rsi
jmp 0x6bf712
mov eax, 0xfffff019
jmp 0x6bf712
Function at 0x6bf880
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov esi, dword [rsp + 0x130]
mov rbx, rcx
mov rbp, rdx
mov edi, r8d
test r8d, r8d
je 0x6bf970
test r9, r9
je 0x6bf8be
lea rdx, [rsp + 0x60]
mov rcx, r9
call fcn.006c31a0
test eax, eax
jne 0x6bf941
cmp qword [rbx + 0x68], 0
jne 0x6bf9b3
test byte [rbx + 0x59], 0x20
jne 0x6bf8fa
cmp esi, 0x10
je 0x6bf9a0
cmp esi, 0x1c
jne 0x6bf9ac
mov rdx, qword [0x0091ea40]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.006be0b0
test eax, eax
jne 0x6bf956
lea rax, [rsp + 0x60]
mov rdx, rbp
mov rcx, qword [rbx + 0x70]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
mov r8d, edi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov edx, eax
mov eax, dword [rsp + 0x5c]
test edx, edx
jne 0x6bf950
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0069fed0
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsp + 0x128], r9
mov r8d, 0x3e5
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x128]
jmp 0x6bf8a4
mov rdx, qword [0x0091ea30]
jmp 0x6bf8e8
mov eax, 0xfffff019
jmp 0x6bf941
mov eax, 0xfffff008
jmp 0x6bf941

Function at 0x6bfd00
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x6bfe40
test rdx, rdx
je 0x6bfe40
lea rbx, [rsp + 0x40]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x6bfe04
cmp eax, 0x104
ja 0x6bfe47
mov edx, eax
xor ecx, ecx
mov word [rsp + rdx*2 + 0x40], cx
lea edx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x6bfe20
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
je 0x6bfe04
mov rdx, qword [rsi]
mov ecx, edx
cmp edx, eax
jl 0x6bfe4e
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, rbx
mov qword [rsp + 0x38], 0
cmova ecx, eax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rbp
test eax, eax
je 0x6bfe04
sub eax, 1
cdqe
mov qword [rsi], rax
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0069fed0
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 3
je 0x6bfe31
xor eax, eax
mov word [rsp + rdx*2 + 0x40], ax
jmp 0x6bfd61
cmp word [rsp + 0x42], 0x3a
jne 0x6bfe25
jmp 0x6bfd61
mov eax, 0xfffff019
jmp 0x6bfdf8
mov eax, 0xfffff01a
jmp 0x6bfdf8
cdqe
mov qword [rsi], rax
mov eax, 0xfffff024
jmp 0x6bfdf8
Function at 0x6c22f0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
mov rsi, rax
test rax, rax
je 0x6c2494
lea rdx, str.RtlGetVersion
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, rsi
mov qword [0x00cae660], rax
call rbx
mov qword [0x00cae688], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
mov qword [0x00cae658], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
mov qword [0x00cae678], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
mov qword [0x00cae648], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
mov qword [0x00cae640], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x00cae640], 0
mov qword [0x00cae680], rax
je 0x6c2480
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
mov qword [0x00cae670], rax
test rax, rax
je 0x6c2480
lea rdx, str.NtQueryInformationProcess
mov rcx, rsi
call rbx
mov qword [0x00cae668], rax
test rax, rax
je 0x6c2480
lea rcx, [0x0090fe15]
call rdi
test rax, rax
je 0x6c2494
mov rcx, rax
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x00cae690], rax
call rsi
test rax, rax
je 0x6c2457
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x00cae698], rax
lea rcx, str.user32.dll
call rsi
test rax, rax
je 0x6c2478
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x00cae650], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.0069fe10
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.0069fe10
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6c2580
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x00cae6b0]
lea rcx, str.0.0.0.0
call fcn.0069de60
test eax, eax
jne 0x86ebf0
xor edx, edx
lea r8, [0x00cae6c0]
lea rcx, [0x0090fea8]
call fcn.0069deb0
test eax, eax
jne 0x86ebf0
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x6c26e4
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x6c2772
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x6c26f0
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6c2794
test byte [rsp + 0x1e2], 2
jne 0x6c265d
mov dword [0x00cae6a4], 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x6c27a8
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x6c2730
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6c2780
test byte [rsp + 0x1e2], 2
jne 0x6c26d6
mov dword [0x00cae6a0], 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x6c275e
add rsp, 0x468
pop rbx
pop rsi
ret
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x6c266f
sub eax, 0x273e
cmp eax, 1
jbe 0x6c266f
call rbx
lea rdx, [0x0090fecd]
mov ecx, eax
call fcn.0069fe10
nop word cs:[rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x6c26e4
sub eax, 0x273e
cmp eax, 1
jbe 0x6c26e4
call rbx
lea rdx, [0x0090fecd]
mov ecx, eax
call fcn.0069fe10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.0069fe10
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.0069fe10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.0069fe10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.0069fe10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.0069fe10
nop dword [rax]
Function at 0x6d0c10
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x9c], 1
mov dword [rcx + 0x29c], 1
mov rbx, rcx
jne 0x6d0c37
mov dword [rcx + 0x29c], 0
lea rcx, str.HWLOC_GROUPING
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6d0c70
mov rcx, rax
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x6d0c70
mov dword [rbx + 0x29c], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x29c]
test eax, eax
je 0x6d0c5e
movabs rax, 0x3c23d70a00000000
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2a4], 5
mov qword [rbx + 0x2a8], rax
movabs rax, 0x3d4ccccd3ca3d70a
mov qword [rbx + 0x2b0], rax
mov qword [rbx + 0x2b8], 0x3dcccccd
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6d0d40
mov ecx, 4
lea rdi, [0x00912598]
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
seta dl
sbb dl, 0
test dl, dl
jne 0x6d0d12
mov dword [rbx + 0x2a0], 0
lea rcx, str.HWLOC_GROUPING_VERBOSE
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6d0c5e
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbx + 0x2a0], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x2a4], 1
mov rcx, rax
call sub.msvcrt.dll_atof
pxor xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [rbx + 0x2a8], xmm1
jmp 0x6d0cdd
mov dword [rbx + 0x2a4], 1
jmp 0x6d0cdd
Function at 0x6d9f00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x88], rdx
mov edx, 0x29
mov ebx, r8d
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x20], rcx
call sub.msvcrt.dll_strchr
mov r8, qword [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x28], rax
je 0x6da172
movzx eax, byte [r8]
xor r15d, r15d
xor r13d, r13d
xor r14d, r14d
lea rbp, [0x00913ebe]
lea r12, [0x00913eb0]
cmp al, 0x29
je 0x6d9ff2
lea eax, [rbx - 4]
cmp eax, 7
jbe 0x6da080
mov ecx, 7
lea rsi, str.memory
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x6da0e0
mov ecx, 8
mov rsi, rbp
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x6da101
lea r13, [r8 + 8]
lea rdx, [0x00913ec7]
mov rcx, r13
mov qword [rsp + 0x80], r13
call sub.msvcrt.dll_strcspn
lea rsi, [r13 + rax]
mov r15, rax
mov qword [rsp + 0x80], rsi
movzx eax, byte [rsi]
cmp al, 0x20
je 0x6da0c1
cmp al, 0x29
jne 0x6da122
mov rax, qword [rsp + 0x98]
mov qword [rax], r14
test r13, r13
je 0x6da056
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
je 0x6da040
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x6da040
mov ecx, 2
call qword [fcn.007116c0]
mov r8d, 0x3c
mov edx, 1
lea rcx, str.Overwriting_duplicate_indexes_attribute_with_last_occurence_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rax, qword [rsp + 0xa0]
mov qword [rax], r13
mov rax, qword [rsp + 0xa8]
mov dword [rax], r15d
mov r15, qword [rsp + 0x28]
mov rax, qword [rsp + 0x88]
add r15, 1
mov qword [rax], r15
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 5
mov rsi, r12
mov rdi, r8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x6d9f9a
lea rcx, [r8 + 5]
lea rdx, [rsp + 0x80]
call fcn.006d86d0
mov rsi, qword [rsp + 0x80]
mov r14, rax
movzx eax, byte [rsi]
cmp al, 0x20
jne 0x6d9fea
lea r8, [rsi + 1]
mov qword [rsp + 0x80], r8
movzx eax, byte [rsi + 1]
jmp 0x6d9f68
lea rcx, [r8 + 7]
lea rdx, [rsp + 0x80]
call fcn.006d86d0
mov rsi, qword [rsp + 0x80]
mov r14, rax
jmp 0x6d9fdf
mov ecx, dword [rsp + 0xb0]
test ecx, ecx
jne 0x6da14c
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x6da06c
mov edx, dword [rsp + 0xb0]
test edx, edx
je 0x6da10c
mov ecx, 2
call qword [fcn.007116c0]
mov r8, rsi
lea rdx, str.Missing_parameter_separator_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6da10c
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.007116c0]
mov r8, qword [rsp + 0x20]
lea rdx, str.Unknown_attribute_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6da10c
mov r9d, dword [rsp + 0xb0]
test r9d, r9d
je 0x6da10c
mov qword [rsp + 0x20], r8
mov ecx, 2
call qword [fcn.007116c0]
mov r8, qword [rsp + 0x20]
lea rdx, str.Missing_attribute_closing_bracket_in_synthetic_string_doesnt_have_a_number_of_objects_at__s_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x6da10c
Function at 0x6e32f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rdi, [0x00915f76]
mov rbx, rcx
mov ecx, 2
mov r13, rdx
mov qword [rsp + 0xb0], r8
mov rsi, rbx
lea rdx, [0x00915f78]
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
lea rax, str._dev_stdin
cmove rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_fopen
mov r14, rax
test rax, rax
je 0x6e344c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.00707560
test eax, eax
je 0x6e3405
mov ecx, 0x1001
mov edi, 0x1000
call sub.msvcrt.dll_malloc
mov rsi, rax
test rax, rax
je 0x6e343d
movabs r15, 0x7fffffffffffffff
mov rbp, rdi
xor ebx, ebx
jmp 0x6e33b7
lea r12, [rbp + rbp]
mov rcx, rsi
lea rdx, [r12 + 1]
call sub.msvcrt.dll_realloc
test rax, rax
je 0x6e3435
mov rdi, rbp
mov rsi, rax
mov rbp, r12
and rdi, r15
lea rcx, [rsi + rbx]
mov r9, r14
mov r8, rdi
mov edx, 1
call sub.msvcrt.dll_fread
add rbx, rax
mov byte [rsi + rbx], 0
cmp rdi, rax
je 0x6e3390
mov rcx, r14
add rbx, 1
call fcn.00710f78
mov rax, qword [rsp + 0xb0]
mov qword [r13], rsi
mov qword [rax], rbx
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [rsp + 0x26]
mov ecx, 0x1001
mov edi, 0x1000
and ax, 0xf000
cmp ax, 0x8000
jne 0x6e336b
mov eax, dword [rsp + 0x34]
lea edi, [rax + 1]
movsxd rdi, edi
lea rcx, [rdi + 1]
jmp 0x6e336b
mov rcx, rsi
call fcn.00710f20
mov rcx, r14
call fcn.00710f78
mov eax, 0xffffffff
jmp 0x6e33f4
mov eax, 0xffffffff
jmp 0x6e33f4

Function at 0x6e5e90
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [0x00876030]
mov eax, dword [rsp + 0x40]
cmp ebx, 1
jbe 0x6e5ed6
mov rdx, qword [0x00c2d1f8]
mov eax, ebx
shl eax, 6
test rdx, rdx
je 0x6e5ed6
lea ecx, [rbx - 1]
add ebx, 0x3ffffff
movzx ecx, cx
shl ebx, 6
call rdx
movzx eax, ax
add eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x703e50
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00cadae0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00cadac0]
test rbx, rbx
je 0x703ea4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x703e9b
test r12, r12
je 0x703e9b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x703e80
lea rcx, [0x00cadae0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x7041e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0091dbb0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x704259
mov rcx, r10
call fcn.007040b0
test eax, eax
je 0x704259
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x704256
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x70424d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x704259
add r8, 0x28
cmp r8, r9
jne 0x704238
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret