joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fd40
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x60], r8d
mov rsi, rcx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 8
mov edx, 0xffff
call rbx
cmp eax, 0xffffffff
je 0x45fdb2
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x45fd90
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov r8d, 3
mov edx, 6
mov rcx, rsi
call rbx
cmp eax, 0xffffffff
jne 0x45fd80
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x45fdc0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp qword [r8], 0xffffffffffffffff
mov eax, 0xfffff00e
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov rbx, r9
mov dword [rsp + 0x48], 1
jne 0x45fec7
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, r9
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x45fee0
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x45fed0
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x45ff50
mov edx, dword [rdi]
cmp dword [rsp + 0xa0], 0x17
je 0x45ff40
mov rax, qword [0x004d3600]
mov ecx, dword [rax]
mov rax, qword [0x004d3580]
mov rax, qword [rax]
test rax, rax
je 0x45fe73
mov r8d, edx
and r8d, 0x100000
or r8d, ecx
je 0x45fef0
test edx, 0x2000000
jne 0x45ff70
test edx, 0x4000000
jne 0x45ff11
cmp dword [rsp + 0xa0], 0x17
mov qword [rsi], rbx
je 0x45ff30
xor eax, eax
and edx, 0x1000000
je 0x45fec7
lea rdx, str.src_win_tcp.c
lea rcx, [0x004cae68]
mov r8d, 0x96
mov dword [rsp + 0x3c], eax
call fcn.0048c6c0
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call rax
test eax, eax
je 0x45ffb5
mov edx, dword [rdi]
or edx, 0x40000
mov dword [rdi], edx
jmp 0x45fe73
mov r8d, 0x3c
mov edx, 1
mov rcx, rbx
call fcn.0045fd40
test eax, eax
jne 0x45fec7
mov edx, dword [rdi]
jmp 0x45fe8b
or edx, 0x1000000
xor eax, eax
mov dword [rdi], edx
jmp 0x45fec7
mov rax, qword [0x004d3610]
mov ecx, dword [rax]
jmp 0x45fe55
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x45fed0
mov edx, dword [rdi]
or edx, 0x100000
mov dword [rdi], edx
jmp 0x45fe3e
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x4c]
mov r8d, 1
mov edx, 6
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x45ffa5
mov edx, dword [rdi]
jmp 0x45fe7f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x45fec7
jmp 0x45ff9e
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 1
jne 0x45ffd0
mov edx, dword [rdi]
jmp 0x45fe73
call rbp
jmp 0x45fec7
Function at 0x45ffe0
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx eax, word [rdx]
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov rsi, rdx
mov r12d, r8d
mov ebp, r9d
cmp rcx, 0xffffffffffffffff
je 0x460040
cmp ax, 0x17
je 0x4600b0
mov r8d, r12d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4600f0
or dword [rbx + 0x58], 0x200
xor edi, edi
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r9b, 1
je 0x460051
cmp ax, 0x17
mov edi, 0x57
jne 0x460030
xor r8d, r8d
movzx ecx, ax
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x4600e1
movzx eax, word [rsi]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x58]
lea r8, [rbx + 0x110]
mov dword [rsp + 0x28], 0
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.0045fdc0
test eax, eax
mov edi, eax
jne 0x460112
movzx eax, word [rsi]
mov rcx, qword [rbx + 0x110]
cmp ax, 0x17
jne 0x460012
nop dword [rax + rax]
and ebp, 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], ebp
mov r8d, 0x1b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
jmp 0x460012
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
jmp 0x460030
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
mov edi, eax
jne 0x460030
mov dword [rbx + 0x118], 0x2740
jmp 0x460027
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x460030

Function at 0x460ed0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x110]
cmp rax, 0xffffffffffffffff
je 0x460f11
mov ecx, dword [rcx + 0x118]
test ecx, ecx
jne 0x460f08
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x460f00
add rsp, 0x28
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
add rsp, 0x28
jmp fcn.0044c5f0
mov eax, 0xfffff019
jmp 0x460ef8
Function at 0x4613e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x45f520
test eax, 0x10000
je 0x45f530
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x45f510
cmp r9d, 0xe
je 0x45f500
cmp r9d, 7
mov eax, 0xfffff008
je 0x45f4fb
lea rdx, str.src_win_stream.c
lea rcx, [0x004cad31]
mov r8d, 0xc8
call fcn.0048c6c0
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.00468c90
add rsp, 0x28
jmp 0x4613e0
mov eax, 0xfffff00d
jmp 0x45f4fb
mov eax, 0xfffff031
jmp 0x45f4fb
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x461450
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
mov edx, dword [rsp + 0x4c]
je 0x461430
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0044c5f0
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x461423
Function at 0x461b70
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x461b9f
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
mov r8d, 0x462
call fcn.0048c6c0
mov rcx, qword [rsi + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x461c20
mov eax, dword [rsi + 0x40]
test eax, eax
js 0x461bdc
mov dword [rsp + 0x20], 8
lea r9, [rbx + 0x110]
mov r8d, 0x700b
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x461cd4
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
test byte [rbx + 0x59], 8
mov qword [rsi + 0x70], 0xffffffffffffffff
jne 0x461d05
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x461c90
sub eax, 1
mov edx, dword [rbx + 0x58]
test eax, eax
mov dword [rbx + 0x78], eax
jne 0x461c15
test dl, 1
jne 0x461cb1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x58]
test ah, 8
je 0x461bf4
mov edx, eax
and dh, 0xf7
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x461d15
test al, 1
jne 0x461c60
test al, 0x40
je 0x461c60
mov edx, eax
and edx, 0xfffff7bf
test al, 0x20
mov dword [rbx + 0x58], edx
je 0x461c60
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
nop dword [rax]
cmp qword [rbx + 0x100], 0
je 0x461bf4
mov rcx, qword [rsi + 0x40]
call fcn.0046d3d0
mov ecx, eax
mov rsi, qword [rbx + 0x100]
call fcn.0044c5f0
mov rcx, rbx
mov edx, eax
call rsi
jmp 0x461bf4
lea rdx, str.src_win_tcp.c
lea rcx, [0x004caf2f]
mov r8d, 0x48a
call fcn.0048c6c0
mov eax, dword [rbx + 0x78]
jmp 0x461bff
test dl, 8
jne 0x461c15
mov rax, qword [rdi + 0x50]
or edx, 8
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0x130]
mov qword [rsi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rsi
test rax, rax
je 0x461bf4
xor edx, edx
mov rcx, rbx
call rax
jmp 0x461bf4
mov rdx, rsi
mov rcx, rbx
call fcn.0045f6e0
jmp 0x461bf4
jns 0x461c60
lea rdx, str.src_win_tcp.c
lea rcx, [0x004cb069]
mov r8d, 0x46b
call fcn.0048c6c0
jmp 0x461c60
Function at 0x461d40
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x461d70
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
mov r8d, 0x492
call fcn.0048c6c0
sub dword [rbx + 0x7c], 1
jne 0x461e70
mov eax, dword [rbx + 0x58]
test al, 1
je 0x461ec0
lea rax, [rdi + 0x20]
cmp qword [rdi + 0x20], rax
je 0x461e9d
mov rax, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov qword [rax], rdx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov qword [rax + 8], rdx
mov rcx, qword [rsi + 0x40]
test ecx, ecx
js 0x461ef0
xor r9d, r9d
mov rcx, qword [rbx + 0x110]
mov dword [rsp + 0x20], 0
mov r8d, 0x7010
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x461ee5
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x100], 0
mov dword [rbx + 0x88], 0xe
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xf8], 0xffffffffffffffff
or edx, 0x19000
mov qword [rbx + 0x80], rbx
mov dword [rbx + 0x58], edx
add dword [rdi + 0xa8], 1
mov ecx, eax
mov rbp, qword [rsi + 0x70]
call fcn.0044c5f0
mov rcx, rsi
mov edx, eax
call rbp
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x461f00
sub eax, 1
mov edx, dword [rbx + 0x58]
test eax, eax
mov dword [rbx + 0x78], eax
jne 0x461e63
test dl, 1
jne 0x461f21
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
jns 0x461d85
lea rdx, str.src_win_tcp.c
lea rcx, [0x004caef8]
mov r8d, 0x494
call fcn.0048c6c0
lea rax, [rdi + 0x20]
cmp qword [rdi + 0x20], rax
jne 0x461d93
lea rdx, str.src_win_tcp.c
lea rcx, [0x004caf13]
mov r8d, 0x494
call fcn.0048c6c0
jmp 0x461d93
test al, 0x40
je 0x461d85
mov edx, eax
and edx, 0xffffffbf
test al, 0x20
mov dword [rbx + 0x58], edx
je 0x461d85
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x461d85
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x461e30
call fcn.0046d3d0
jmp 0x461e30
lea rdx, str.src_win_tcp.c
lea rcx, [0x004caf2f]
mov r8d, 0x4a8
call fcn.0048c6c0
mov eax, dword [rbx + 0x78]
jmp 0x461e4d
test dl, 8
jne 0x461e63
mov rax, qword [rdi + 0x50]
or edx, 8
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x462080
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x4620c1
test esi, esi
mov eax, dword [rbx + 0x58]
jne 0x4620b0
and eax, 0xfdffffff
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
or eax, 0x2000000
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov r8d, 1
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x462098
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x4620a9
jmp 0x462098
Function at 0x462bf0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rcx
mov ecx, 0x18
mov rdi, rdx
mov rsi, r8
call fcn.00449730
test rax, rax
mov rbx, rax
je 0x462cd4
mov qword [rax], rdi
mov qword [rax + 8], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rax
lea r8, [0x004636e0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
jne 0x462c80
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
mov rcx, rbx
call fcn.00449740
cmp esi, 0xb
je 0x462cb0
jle 0x462cc0
cmp esi, 0xd
je 0x462ca0
cmp esi, 0x16
jne 0x462cc4
mov esi, 0xfffff019
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor esi, esi
mov qword [rbp], rax
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xfffff004
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xfffff008
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test esi, esi
je 0x462c93
mov esi, 0xfffff01a
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xfffff027
jmp 0x462c93

Function at 0x4636c0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4636d5
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
call fcn.00449740
cmp byte [0x004e5990], 0
jne 0x463713
lea rdx, [0x00462bb0]
lea rcx, [0x004e5990]
call fcn.00462a10
lea rcx, [0x004e59a0]
mov rdx, rdi
call fcn.004636c0
mov rcx, rsi
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x465020
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rdi, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r12d, byte [rsp + 0xc0]
mov rsi, rcx
mov r14d, edx
mov r13d, r9d
movzx ebp, r8b
lea rbx, [rsp + 0x30]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x465091
mov r9d, r13d
mov r8d, ebp
mov edx, r14d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call fcn.00464e00
mov rcx, qword [rsi + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x4650b3
call r15
cmp eax, 0x57
jne 0x4650d0
mov rcx, qword [rsi + 0x110]
mov rdx, rbx
call rdi
test eax, eax
jne 0x465060
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x465060
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x4650b5
Function at 0x468700
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xfe
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x468750
test cl, 1
je 0x468770
test edx, 0x20000
je 0x46873d
test edx, 0x2000000
jne 0x468790
and edx, 0x400000
je 0x4687e0
xor esi, esi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
jns 0x468721
lea rdx, [0x004cb230]
lea rcx, [0x004cb7c7]
mov r8d, 0x406
call fcn.0048c6c0
mov edx, dword [rbx + 0x58]
jmp 0x468721
test cl, 0x40
je 0x468721
mov edx, ecx
and edx, 0xfffffebf
and ecx, 0x20
mov dword [rbx + 0x58], edx
je 0x468721
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x468721
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x46873d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x46873f
lea rcx, [0x004e59b8]
call fcn.00463190
mov eax, 2
xchg dword [0x004e59dc], eax
cmp eax, 1
je 0x468814
lea rcx, [0x004e59b8]
call fcn.00463160
or dword [rbx + 0x58], 0x400000
jmp 0x46873d
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str.conout_
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x468869
lea rdx, [0x004e59c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x468902
mov ecx, 1
movabs rax, 0xd000100000001
xor edx, edx
mov word [rsp + 0x50], cx
mov qword [rsp + 0x54], rax
mov ecx, 0xd
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov word [rsp + 0x5c], ax
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], r8w
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x4688e1
cmp rdi, 0xffffffffffffffff
je 0x468808
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x468808
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rdi, 0xffffffffffffffff
mov ebp, eax
jne 0x468974
mov esi, eax
test ebp, ebp
jne 0x46873f
jmp 0x468808
lock or dword [0x004e59d8], 1
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
mov word [rsp + 0x5c], ax
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
lea r9, [rsp + 0x4c]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x4688d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov esi, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4688f5
Function at 0x469590
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov eax, 0xfffff00e
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
mov ebp, r9d
mov dword [rsp + 0x2c], 1
jne 0x4695e1
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x4695f0
mov r9d, ebp
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.00469430
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x469600
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor esi, esi
test byte [rcx + 0x59], 2
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
mov edi, r9d
mov dword [rsp + 0x38], 0
jne 0x46966b
mov r13d, r9d
and r13d, 1
jne 0x469680
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x469710
and edi, 4
jne 0x469690
cmp word [rbp], 0x17
je 0x4696c6
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x469700
or dword [rbx + 0x58], 0x200
xor esi, esi
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp word [rdx], 0x17
mov esi, 0x57
je 0x469633
jmp 0x46966b
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov r8d, 4
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x469700
cmp word [rbp], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x46964d
or dword [rbx + 0x58], 0x1000000
test r13d, r13d
jne 0x46964d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x46964d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x46966b
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov r14, rax
je 0x469700
movzx r9d, word [rbp]
mov rcx, qword [rbx + 8]
mov r8, rax
mov rdx, rbx
call fcn.00469590
test eax, eax
mov esi, eax
jne 0x469750
mov rcx, qword [rbx + 0x70]
jmp 0x469641
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x46966b
Function at 0x46a1a0
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
mov rsi, rcx
mov r12, rdx
mov rbp, r8
mov edi, r9d
and eax, 0x1000200
cmp eax, 0x200
je 0x46a280
mov rdx, qword [0x004d35f0]
mov r9d, 4
mov r8d, 0x1c
call fcn.00469600
test eax, eax
mov ebx, eax
jne 0x46a292
test rbp, rbp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
je 0x46a225
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbp
call fcn.0044a8d0
test eax, eax
jne 0x46a280
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
mov rax, qword [r12 + 8]
mov rdx, qword [r12 + 0x10]
test edi, edi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
je 0x46a2b0
cmp edi, 1
jne 0x46a280
mov r8d, 0xc
mov rcx, qword [rsi + 0x70]
mov dword [rsp + 0x20], 0x14
lea r9, [rsp + 0x30]
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x46a285
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0044c5f0
mov ebx, eax
jmp 0x46a285
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, eax
call fcn.0044c5f0
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x46a248
Function at 0x46ab50
Capabilities:
Send data
Send data on socket

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf0
mov ebp, dword [rsp + 0x140]
test r8d, r8d
mov rbx, rcx
mov r12, rdx
mov esi, r8d
je 0x46ac20
lea rdi, [rsp + 0x70]
mov rcx, r9
mov rdx, rdi
call fcn.0046dd10
test eax, eax
jne 0x46ac0e
cmp qword [rbx + 0x68], 0
jne 0x46ac90
test byte [rbx + 0x59], 2
jne 0x46abce
cmp ebp, 0x10
je 0x46ac70
cmp ebp, 0x1c
jne 0x46ac80
mov rdx, qword [0x004d35f0]
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
call fcn.00469600
test eax, eax
jne 0x46ac56
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], ebp
mov r8d, esi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov rdx, r12
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
jne 0x46ac50
mov eax, dword [rsp + 0x6c]
add rsp, 0xf0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
mov r8d, 0x3a1
mov qword [rsp + 0x58], r9
call fcn.0048c6c0
mov r9, qword [rsp + 0x58]
jmp 0x46ab76
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0044c5f0
add rsp, 0xf0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x004d35e0]
jmp 0x46abb8
mov eax, 0xfffff019
jmp 0x46ac0e
mov eax, 0xfffff008
jmp 0x46ac0e

Function at 0x46b2d0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rsi, [rsp + 0x20]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x46b31f
jmp 0x46b340
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x46b340
cmp dword [rsp + 0x28], edi
jne 0x46b310
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
mov esi, 0xffffffff
jmp 0x46b329
Function at 0x46c760
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
test rcx, rcx
mov rbx, rcx
je 0x46c8b1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x46c840
lea rsi, [rsp + 0x34]
lea rdi, [rsp + 0x250]
mov dword [rsp + 0x34], 0x104
mov rcx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x46c7f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x7a
je 0x46c8d6
mov ecx, ebx
call fcn.0044c5f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x46c860
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x46c8d6
mov ecx, eax
call fcn.0044c5f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0044c5f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea r8, [rbx + 0x18]
mov qword [rbx + 0x18], 0
mov edx, 0xffffffff
mov rcx, rdi
call fcn.0046c0f0
test eax, eax
jne 0x46c7e5
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.0046c0f0
test eax, eax
jne 0x46c8c0
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x46c7e5
mov eax, 0xfffff019
jmp 0x46c7e5
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.00449740
mov eax, dword [rsp + 0x2c]
jmp 0x46c7e5
mov eax, 0xfffff027
jmp 0x46c7e5