joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400093bc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [0x140274ec8], 0
mov rbp, r9
mov ebx, edx
mov rdi, rcx
je 0x140009439
cmp edx, 2
jl 0x140009423
movzx ecx, word [rcx]
call qword [sym.imp.WS2_32.dll_ntohs]
cmp ax, 0xa
jne 0x140009423
and qword [rsp + 0x28], 0
lea r8, [0x140008524]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140009423
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140274ec8]
mov r8d, ebx
mov rdx, rdi
call fcn.1400800b8
mov eax, ebx
jmp 0x14000945e
xor esi, esi
jmp 0x14000944c
add esi, eax
mov edx, ebx
sub edx, esi
movsxd rcx, esi
add rcx, rdi
mov r9, rbp
lea r8, [0x1400017b0]
call fcn.140008c60
test eax, eax
jne 0x14000943d
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140009e54
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r9
mov r8, rcx
test rdx, rdx
je 0x140009ea2
cmp dword [0x140274d4c], 1
jne 0x140009e7e
cmp dword [0x140272120], 0
jne 0x140009e7e
xor eax, eax
jmp 0x140009f11
and dword [0x140274d48], 0
lea r9, [0x1400017b0]
mov dword [reloc.WS2_32.dll_accept], 1
mov qword [rsp + 0x20], rdi
call fcn.140009d54
jmp 0x140009f11
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call fcn.1400780d8
cmp dword [0x140274d4c], 1
lea rcx, [0x1400017b0]
mov dword [0x140274d78], 1
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
jne 0x140009eed
cmp dword [0x140272120], 0
jne 0x140009eed
mov rcx, rax
call fcn.140174cc8
jmp 0x140009e77
and qword [rsp + 0x28], 0
lea r8, [fcn.140009808]
and dword [rsp + 0x20], 0
mov r9, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x140009f18
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x140274ec8]
mov dword [0x140272120], 1
test rbx, rbx
je 0x140009f57
mov rcx, rbx
call fcn.14007805c
test eax, eax
je 0x140009f4f
mov rcx, qword [rbx + 0x48]
mov edx, 0x42b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
and qword [0x140274ec8], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14000a100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r15
mov r10d, dword [0x140274d94]
mov ebp, edx
mov r11d, dword [0x140274d84]
mov eax, r10d
cdq
xor r13d, r13d
idiv r11d
mov r15, r8
mov r12d, ecx
mov r9d, r13d
mov ebx, edx
test edx, edx
je 0x14000a14b
mov r8d, r11d
sub r8d, edx
add r8d, r10d
jmp 0x14000a14e
mov r8d, r10d
sub r8d, ebp
sub r8d, dword [0x140274d60]
test ebx, ebx
je 0x14000a166
mov eax, r11d
sub eax, ebx
add eax, r10d
jmp 0x14000a169
mov eax, r10d
sub eax, ebp
cmp r8d, eax
jge 0x14000a1f7
mov eax, dword [0x140274d50]
cdq
idiv r11d
test edx, edx
je 0x14000a18f
mov eax, r11d
sub eax, edx
add eax, dword [0x140274d50]
jmp 0x14000a195
mov eax, dword [0x140274d50]
imul eax, r8d
mov rdi, r13
add eax, r12d
imul eax, dword [0x140274da0]
movsxd rdx, eax
mov eax, dword [0x140274da0]
add rdx, r15
imul eax, r11d
movsxd rcx, eax
sar rcx, 2
lea rax, [rdx + rcx*4]
lea rcx, [rcx*4 + 3]
shr rcx, 2
cmp rdx, rax
cmova rcx, r13
test rcx, rcx
je 0x14000a1ef
imul r9d, r9d, 0x1000193
inc rdi
xor r9d, dword [rdx]
lea rdx, [rdx + 4]
cmp rdi, rcx
jb 0x14000a1d9
inc r8d
jmp 0x14000a158
mov rbx, qword [rsp + 0x18]
mov eax, r9d
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
pop r15
pop r13
ret
Function at 0x14000b704
Capabilities:
Create thread
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov r14d, edx
mov ebx, ecx
test ecx, ecx
jne 0x14000b73b
xor eax, eax
jmp 0x14000b8c5
cmp ebx, 6
jne 0x14000b75c
lea ecx, [rbx - 4]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea ecx, [rbx - 2]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov eax, 1
jmp 0x14000b8c5
cmp ebx, 7
jne 0x14000b766
lea ecx, [rbx - 6]
jmp 0x14000b74c
cmp ebx, 8
jne 0x14000b776
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14000b752
cmp ebx, 9
jne 0x14000b7ac
mov qword [rsp + 0x28], rsi
lea r8, [0x140008524]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14000b752
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b752
cmp ebx, 5
jg 0x14000b734
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000b734
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000b828
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b734
sub ebx, 1
je 0x14000b877
sub ebx, 1
je 0x14000b85f
sub ebx, 1
je 0x14000b855
sub ebx, 1
je 0x14000b84e
cmp ebx, 1
jne 0x14000b8b9
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
jmp 0x14000b890
mov ecx, 1
jmp 0x14000b843
mov dword [rsp + 0x20], 1
jmp 0x14000b863
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x1e]
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x14000b890
mov edx, 0x80000000
test r14d, r14d
je 0x14000b888
mov ecx, 4
jmp 0x14000b88a
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14000b8b9
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0xc], esi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14016d990
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14000bb54
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x14000bbbe
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x14000bb84
mov rcx, qword [rsp + 0x40]
lea rdx, str.KeyStore
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x140048fdc
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rax, rdx
lea r9, [rsp + 0x30]
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x14004918f
cmp byte [rsp + 0x50], 0
je 0x14004918f
mov rcx, rbx
call fcn.140011d88
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400118a8
mov esi, 0xfffffffe
lea r8, str.name
mov edx, esi
mov rcx, rbx
call fcn.14000ef34
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea r9, [rsp + 0x40]
mov edi, eax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x1400490ee
mov rcx, qword [rsp + 0x38]
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
test rcx, rcx
jns 0x1400490a2
addsd xmm1, qword [0x1402552e8]
mov rcx, rbx
call fcn.1400116d8
lea r8, str.size
mov edx, esi
mov rcx, rbx
call fcn.14000ef34
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x1400490d5
addsd xmm1, qword [0x1402552e8]
mov rcx, rbx
call fcn.1400116d8
lea r8, str.free
mov edx, esi
mov rcx, rbx
call fcn.14000ef34
sub edi, 2
je 0x140049137
sub edi, 1
je 0x14004912e
sub edi, 1
je 0x140049125
sub edi, 1
je 0x14004911c
mov rcx, rbx
cmp edi, 1
je 0x140049113
lea rdx, str.UNKNOWN
jmp 0x140049141
lea rdx, str.RAMDISK
jmp 0x140049141
lea rdx, str.CDROM
jmp 0x14004913e
lea rdx, str.REMOTE
jmp 0x14004913e
lea rdx, str.FIXED
jmp 0x14004913e
lea rdx, str.REMOVABLE
mov rcx, rbx
call fcn.1400118a8
lea r8, [0x1401e7678]
mov edx, esi
mov rcx, rbx
call fcn.14000ef34
mov r9d, 0x18075380
mov dword [rsp + 0x20], 6
xor r8d, r8d
lea rdx, [0x140048fac]
mov rcx, rbx
call fcn.140011fd0
lea r8, str.toString
mov edx, esi
mov rcx, rbx
call fcn.14000ef34
mov eax, 1
jmp 0x140049191
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14016d990
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14004ebcc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rbx, rcx
lea edi, [rbp + 1]
cmp dword [rcx + 8], ebp
jne 0x14004ebf9
mov rax, qword [rbx + 0x70]
cmp dword [rax + 8], 0
jle 0x14004ec9f
mov rax, qword [rbx + 0x70]
xor esi, esi
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14004ec0b
mov rsi, qword [rcx]
mov rcx, qword [rsi]
lea rdx, [rsi + 0x10]
mov r8d, dword [rsi + 0xc]
lea r9, [rsp + 0x50]
mov ebp, dword [rsi + 8]
lea rax, [rcx + 0x38]
mov rcx, qword [rcx + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14d, eax
cmp eax, edi
jne 0x14004ec58
cmp dword [rbx + 8], 0
jne 0x14004ecb6
mov rcx, qword [rsi]
mov rcx, qword [rcx + 0x70]
call fcn.14007924c
mov rcx, rsi
call fcn.140174cc8
cmp dword [rbx + 8], 0
je 0x14004ebeb
test r14d, r14d
jne 0x14004ec9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14004ec8d
mov rdx, qword [rbx + 0x50]
lea rax, [0x14004eb48]
mov rcx, qword [rbx + 0x58]
xor edi, edi
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.14007e1e8
jmp 0x14004ecb8
mov rcx, qword [rbx]
mov rdx, rbx
mov edi, 0xfffffffc
call fcn.14004ea20
jmp 0x14004ecb8
cmp dword [rbx + 8], 0
jne 0x14004ecb6
test ebp, ebp
je 0x14004ecb8
mov rcx, qword [rbx]
mov rdx, rbx
call fcn.14004eaf0
jmp 0x14004ecb8
xor edi, edi
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14004ed00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rdx]
mov rbx, rdx
mov rcx, qword [rcx + 0x70]
call fcn.14007c6e4
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x70]
cmp dword [rax + 8], 1
jne 0x14004ed2c
add rsp, 0x20
pop rbx
jmp fcn.14004ebcc
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14004ef08
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rdx + 0x70]
mov rbx, rdx
call fcn.14007924c
mov rcx, rax
call fcn.140174cc8
mov rax, qword [rbx + 0x70]
cmp dword [rax + 8], 0
jne 0x14004ef3c
mov rcx, qword [rbx]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14004eaf0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14004ebcc
Function at 0x14005e6b8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rdx
cmp dword [rdx + 0x58], edi
jne 0x14005e857
lea esi, [rdi + 1]
mov dword [rdx + 0x58], esi
cmp qword [rdx + 0x60], rdi
jne 0x14005e702
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x1000
call fcn.1400780d8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], 0x1000
mov dword [rbx + 0x70], edi
cmp dword [rbx + 0x70], edi
jg 0x14005e718
mov r8d, dword [rbx + 0x68]
mov rdx, qword [rbx + 0x60]
mov qword [rbx + 0x6c], rdi
jmp 0x14005e7f5
mov rdx, qword [rbx + 0x50]
mov rax, qword [rdx]
cmp dword [rax + 0x50], edi
jne 0x14005e854
mov rcx, rdx
mov dword [rbx + 0x74], edi
call fcn.14007805c
test eax, eax
je 0x14005e75b
mov rax, qword [rbx + 0x50]
test rax, rax
je 0x14005e745
mov rcx, qword [rax]
jmp 0x14005e748
mov rcx, rdi
movsxd r8, dword [rbx + 0x6c]
xor edx, edx
add r8, qword [rbx + 0x60]
mov r9d, dword [rbx + 0x70]
call fcn.140068874
mov ecx, dword [rbx + 0x74]
test ecx, ecx
jle 0x14005e77a
mov eax, dword [rbx + 0x70]
sub eax, ecx
add dword [rbx + 0x6c], eax
cmp dword [rbx + 0x70], ecx
jne 0x14005e772
mov dword [rbx + 0x74], edi
mov ecx, dword [rbx + 0x74]
mov dword [rbx + 0x70], ecx
jmp 0x14005e77e
mov qword [rbx + 0x6c], rdi
mov rdx, qword [rbx + 0x50]
mov rax, qword [rdx]
mov r8d, dword [rax + 0x50]
test r8d, r8d
jne 0x14005e854
mov eax, dword [rbx + 0x70]
test eax, eax
je 0x14005e7a7
jle 0x14005e79f
test ecx, ecx
je 0x14005e7a7
test r8d, r8d
jmp 0x14005e722
mov ecx, dword [rbx + 0x68]
mov eax, ecx
sub eax, dword [rbx + 0x70]
cmp eax, dword [rbx + 0x6c]
jne 0x14005e7da
lea eax, [rcx + 0x1000]
mov rcx, qword [rbx + 0x60]
movsxd rdx, eax
call fcn.14017b474
mov qword [rbx + 0x60], rax
test rax, rax
je 0x14005e867
add dword [rbx + 0x68], 0x1000
mov r8d, dword [rbx + 0x68]
sub r8d, dword [rbx + 0x6c]
movsxd rdx, dword [rbx + 0x6c]
movsxd rax, dword [rbx + 0x70]
sub r8d, dword [rbx + 0x70]
add rdx, rax
add rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x28]
lea rax, [fcn.14005e5d4]
mov dword [rcx + 0x58], esi
mov qword [rcx], rdx
mov dword [rcx + 8], r8d
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x50], rax
lea rax, [0x140080124]
mov r9, qword [rcx + 0x78]
mov rcx, qword [rcx + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14005e838
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14005e83a
mov eax, edi
test eax, eax
je 0x14005e854
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], edi
mov rdx, rbx
call fcn.14005e5d4
mov dword [rbx + 0x58], edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xfe
lea rdx, str...microscriptILibDuktape_net.c
mov ebx, 0x386
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8d, ebx
xor ecx, ecx
call fcn.14007ddcc
mov r8d, ebx
lea rdx, str...microscriptILibDuktape_net.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.140170088
int3
Function at 0x14006a0e4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
or ebx, 0xffffffff
mov rbp, rcx
mov edx, ebx
call fcn.14000e59c
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, rbp
mov r14, rax
call fcn.14001011c
mov rcx, rbp
call fcn.140011b5c
lea r8, [0x14024f688]
mov edx, ebx
mov rcx, rbp
call fcn.1400503dc
mov rcx, rbp
mov rdi, rax
call fcn.1400126d4
mov rbx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
test rdi, rdi
je 0x14006a1a0
lea ecx, [rbx + 9]
call fcn.1400780d8
mov r9, rbx
mov r8, r14
mov rdx, rbx
mov rsi, rax
lea rcx, [rax + 8]
mov qword [rax], rdi
call section..text
mov byte [rsi + rbx + 8], 0
mov rcx, qword [rdi + 0x18]
call fcn.14007df68
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x14006a196
mov r9, rsi
lea r8d, [rax + 1]
lea rdx, [fcn.14006e248]
call fcn.1400782a8
jmp 0x14006a1f6
mov rdx, rsi
call fcn.14006e248
jmp 0x14006a1f6
lea esi, [rbx + 4]
mov ecx, esi
call fcn.1400780d8
mov r9, rbx
mov r8, r14
mov rdx, rbx
mov rdi, rax
lea rcx, [rax + 4]
mov dword [rax], esi
call section..text
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov rcx, rax
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call fcn.1400126d4
mov rcx, rdi
call fcn.140174cc8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140074650
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
add rcx, 0xc4
mov r10, r9
mov rdi, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], eax
and dword [rbx + 0x1e0], eax
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x1e8], rax
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x1f0], rax
test r9, r9
je 0x1400746b7
cmp word [r10], 0x17
mov edx, 0x1c
mov r8, r10
lea r9d, [rdx - 0xc]
cmove r9d, edx
call section..text
mov rax, qword [rsp + 0x78]
mov r8, rdi
mov r9, qword [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400742bc

Function at 0x1400746dc
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
or edx, 0xffffffff
mov rcx, qword [rcx + 0x280]
mov edi, 0xfffffffc
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rbx + 0x2c8]
cmp qword [rax], 0
jbe 0x1400747b1
cmp qword [rbx + 0x278], 0
jne 0x1400747b1
cmp dword [rbx + 0x250], 0
je 0x140074770
mov rcx, qword [rbx + 0x2b8]
lea edx, [rdi + 0x13]
call fcn.1400accb0
mov rdx, qword [rbx + 0x2c8]
xor r9d, r9d
mov rcx, qword [rbx + 0x60]
mov r8d, dword [rdx]
mov rdx, qword [rdx + 8]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x1400747b1
mov rdx, qword [rbx + 0x2c8]
cmp eax, dword [rdx]
jge 0x140074799
movsxd rcx, eax
add qword [rdx + 8], rcx
mov rax, qword [rbx + 0x2c8]
sub qword [rax], rcx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x38]
call fcn.1400780d8
xor edi, edi
mov dword [rax + 0x2c], 3
mov qword [rbx + 0x278], rax
mov qword [rbx + 0x270], rax
jmp 0x1400747b1
jne 0x1400747b1
and qword [rdx], 0
mov edi, 1
mov rcx, qword [rbx + 0x2c8]
cdqe
add qword [rcx + 8], rax
mov rcx, qword [rbx + 0x280]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140075c40
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
and dword [rcx + 0x68], 0
lea rax, [0x140287180]
and dword [rcx + 0x6c], 0
mov rbx, rcx
and dword [rcx + 0x24c], 0
and dword [rcx + 0x29c], 0
mov qword [rcx + 0x60], rdx
mov qword [rcx + 0x218], r8
mov qword [rcx + 0x238], r9
mov dword [rcx + 0x250], 1
mov rcx, qword [rcx + 0x260]
cmp rcx, rax
je 0x140075cb2
movsxd rdx, dword [rbx + 0x26c]
call fcn.14017b474
test rax, rax
je 0x140075ce2
mov qword [rbx + 0x260], rax
mov eax, dword [rbx + 0x26c]
mov dword [rbx + 0x268], eax
and dword [rbx + 0x254], 0
lea r8, [rsp + 0x40]
and dword [rbx + 0x258], 0
mov edx, 0x8004667e
mov rcx, qword [rbx + 0x60]
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x8a5
lea rdx, str...microstackILibAsyncSocket.c
mov r8d, ebx
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
xor ecx, ecx
call fcn.14007ddcc
mov r8d, ebx
lea rdx, str...microstackILibAsyncSocket.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, 0xfe
call fcn.140170088
int3

Function at 0x140075d88
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x8c]
mov esi, 0x1c
cmp word [rdi], 0
mov rax, rdx
mov dword [rsp + 0x30], esi
je 0x140075dd5
cmp word [rdi], 0x17
lea ebx, [rsi - 0xc]
mov edx, ebx
mov r8, rdi
cmove edx, esi
mov rcx, rax
mov r9d, edx
call section..text
cmp word [rdi], 0x17
cmove ebx, esi
mov eax, ebx
jmp 0x140075de8
mov rcx, qword [rcx + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140075df8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140271510]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, word [rcx + 0x8c]
mov dword [rsp + 0x20], 0x1c
cmp ax, 0x17
jne 0x140075e2f
movzx ecx, word [rcx + 0x8e]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x140075e62
cmp ax, 2
je 0x140075e20
mov rcx, qword [rcx + 0x60]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp word [rsp + 0x28], 0x17
jne 0x140075e58
movzx ecx, word [rsp + 0x2a]
jmp 0x140075e27
cmp word [rsp + 0x28], 2
je 0x140075e51
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016d990
add rsp, 0x58
ret
Function at 0x140075fb0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
and dword [rax + 0x18], 0
mov r14d, edx
and dword [rax - 0x38], 0
xor edx, edx
and dword [rax - 0x34], 0
mov ebp, r9d
mov rsi, r8
mov dword [rax + 0x20], r9d
mov r15, rcx
xor r9d, r9d
lea ecx, [rdx + 0x30]
xor r8d, r8d
call fcn.1400780d8
mov r8, qword [rsp + 0xb0]
mov edx, 2
mov rcx, qword [rsp + 0xb8]
mov rbx, rax
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 0x20], r8
lea r8d, [rdx + 0xf]
mov qword [rax], rcx
movzx ecx, word [rsi]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007603e
mov rcx, rbx
call fcn.140174cc8
xor eax, eax
jmp 0x140076167
cmp ebp, 1
jne 0x14007606d
lea r9, [rsp + 0xa8]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
lea r8d, [rbp + 3]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14007617b
cmp word [rsi], 0x17
jne 0x14007609d
mov edx, 0x29
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xa0]
mov rcx, rdi
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400761a8
cmp word [rsi], 0x17
mov eax, 0x1c
mov rdx, rsi
mov rcx, rdi
lea r8d, [rax - 0xc]
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, rdi
test eax, eax
je 0x1400760cc
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14007602f
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov r9d, 4
and dword [rsp + 0x28], 0
mov edx, 0x9800000c
and qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSAIoctl]
movzx ecx, word [rsi + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
and dword [rsp + 0x30], 0
lea rbp, [0x14000d938]
mov word [rbx + 0x18], ax
lea r8, [0x140075ef4]
lea rax, [0x140075f94]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov edx, r14d
mov rcx, r15
mov qword [rsp + 0x20], rbp
call fcn.140073938
mov rsi, rax
test rax, rax
jne 0x140076153
mov rcx, rdi
jmp 0x1400760c1
mov r9, rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.140075c40
mov rax, rsi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
and dword [rsp + 0x20], 0
lea rdx, str...microstackILibAsyncUDPSocket.c
mov r9d, eax
mov r8d, 0x7f
xor ecx, ecx
call fcn.14007ddcc
mov ecx, 0xfd
call fcn.140170088
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
and dword [rsp + 0x20], 0
lea rdx, str...microstackILibAsyncUDPSocket.c
mov r9d, eax
mov r8d, 0x83
xor ecx, ecx
call fcn.14007ddcc
mov ecx, 0xfd
call fcn.140170088
int3

Function at 0x1400761d8
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x60]
mov rbx, r8
lea r8, [rdx + 4]
mov edx, 4
mov r9d, edx
lea rcx, [rsp + 0x40]
call fcn.140075e74
mov eax, dword [rbx + 4]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov rcx, rdi
mov dword [rsp + 0x20], 8
lea r8d, [rdx + 0xc]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret