joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e5d70
Capabilities:
Set socket configuration

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [rdx + 0x10], 0xc
mov rsi, rcx
mov rbx, rdx
mov r12, r8
je 0x6e5da2
mov r8d, 0x489
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
sub dword [rbx + 0x7c], 1
jne 0x6e5eb0
mov eax, dword [rbx + 0x58]
test al, 1
je 0x6e5e48
mov eax, dword [rsi + 0x20]
test eax, eax
je 0x6e5edb
mov rcx, qword [r12 + 0x40]
sub eax, 1
mov dword [rsi + 0x20], eax
test ecx, ecx
js 0x6e5f0b
mov ecx, 0x3e3
test byte [rbx + 0x58], 1
je 0x6e5e70
mov rdi, qword [r12 + 0x70]
call fcn.006cf860
mov rcx, r12
mov edx, eax
call rdi
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x6e5f20
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x6e5e10
test dl, 1
jne 0x6e5e20
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
test dl, 0x20
jne 0x6e5e10
mov rax, qword [rsi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
test al, 4
je 0x6e5db7
mov edx, eax
and edx, 0xfffffffb
mov dword [rbx + 0x58], edx
test al, 8
je 0x6e5db7
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6e5db7
mov rcx, qword [rbx + 0x110]
xor r9d, r9d
mov edx, 0xffff
mov dword [rsp + 0x20], 0
mov r8d, 0x7010
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, eax
test eax, eax
jne 0x6e5f48
or dword [rbx + 0x58], 0xc080
add dword [rsi + 0xa8], 1
jmp 0x6e5de4
jns 0x6e5db7
mov r8d, 0x48b
lea rdx, str.src_win_tcp.c
lea rcx, [0x00959b50]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsi + 0x20]
test eax, eax
jne 0x6e5dc2
lea rcx, [0x00959b6b]
mov r8d, 0x48b
lea rdx, str.src_win_tcp.c
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsi + 0x20]
mov rcx, qword [r12 + 0x40]
sub eax, 1
mov dword [rsi + 0x20], eax
test ecx, ecx
jns 0x6e5dd5
call fcn.006f16d0
mov ecx, eax
jmp 0x6e5de4
mov r8d, 0x4a2
lea rdx, str.src_win_tcp.c
lea rcx, [0x00959b87]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x6e5e00
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x6e5de4

Function at 0x6e6140
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x6e6188
mov eax, dword [rbx + 0x58]
test esi, esi
jne 0x6e6170
and eax, 0xfeffffff
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
or eax, 0x1000000
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov dword [rsp + 0x3c], edx
lea r9, [rsp + 0x3c]
mov edx, 6
mov r8d, 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6e6158
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x6e6169
jmp 0x6e6158
Function at 0x6e6a80
Capabilities:
Allocate thread local storage

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov rbx, rcx
mov rsi, rdx
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov r12, rax
test rax, rax
je 0x6e6a60
xor eax, eax
lock cmpxchg qword [rbx + 8], r12
mov r13, rax
test rax, rax
jne 0x6e6a20
call rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x6e6a00
mov byte [rbx], 1
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8d, 0x36
lea rdx, str.src_win_thread.c
lea rcx, str.result
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6e69ee
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x6e69f1
mov r8d, 0x3e
lea rdx, str.src_win_thread.c
lea rcx, str.result__WAIT_OBJECT_0
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp qword [sym.imp.msvcrt.dll__assert]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateEvent
mov ecx, eax
call fcn.006cf7a0
nop
nop word cs:[rax + rax]
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00c808e0], eax
cmp eax, 0xffffffff
je 0x8b17c0
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop

Function at 0x6e6b20
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rdi, r8
mov rbp, r9
test byte [rdx], 1
je 0x6e6c18
mov rbx, qword [rdx + 8]
test rbx, rbx
jne 0x6e6be8
mov ecx, 0x18
call fcn.006cb300
mov r12, rax
test rax, rax
je 0x6e6c1f
mov qword [rax], rdi
xor ecx, ecx
mov r9, rax
lea r8, [0x006e6aa0]
mov qword [rax + 8], rbp
mov edx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rcx, rax
test rax, rax
jne 0x6e6bc8
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, r12
mov ebx, dword [rax]
call fcn.006cb320
mov eax, 0xfffff01a
cmp ebx, 0x16
ja 0x6e6bd8
lea rax, [0x00959de0]
mov eax, dword [rax + rbx*4]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [rsi], rax
mov qword [r12 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x34]
lea rbx, [rbx + rax - 1]
neg rax
and rbx, rax
mov eax, ebx
cmp rax, rbx
je 0x6e6b49
mov eax, 0xfffff019
jmp 0x6e6bd8
xor ebx, ebx
jmp 0x6e6b49
mov eax, 0xfffff027
jmp 0x6e6bd8
Function at 0x6e80c0
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r13, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, byte [rsp + 0xc0]
mov rbx, rcx
mov r12d, edx
mov ebp, r9d
movzx edi, r8b
lea rsi, [rsp + 0x30]
jmp 0x6e8131
mov dword [rsp + 0x20], r14d
mov edx, r12d
mov rcx, rsi
mov r9d, ebp
mov r8d, edi
call fcn.006e8010
mov rcx, qword [rbx + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x6e8158
call r15
cmp eax, 0x57
jne 0x6e8170
mov rcx, qword [rbx + 0x110]
mov rdx, rsi
call r13
test eax, eax
jne 0x6e8100
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x6e8100
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x6e815a
Function at 0x6ebb80
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xef
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6ebc60
test cl, 1
je 0x6ebbd8
test edx, 0x10000
je 0x6ebbc2
test edx, 0x2000000
jne 0x6ebc00
and edx, 0x200000
je 0x6ebc90
xor r12d, r12d
mov eax, r12d
add rsp, 0x70
pop rbx
pop r12
pop r13
ret
test cl, 4
je 0x6ebba6
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x6ebba6
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6ebba6
mov r9d, 0x10
mov dword [rsp + 0x60], 0
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], 0
mov r8d, 1
mov word [rsp + 0x50], r9w
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x6ebbc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x6ebbc5
jns 0x6ebba6
lea rdx, str.src_win_tty.c
mov r8d, 0x422
lea rcx, [0x0095a3c7]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x6ebba6
lea rcx, [0x00c80918]
call fcn.006e7120
mov eax, 2
xchg dword [0x00c8096c], eax
cmp eax, 1
je 0x6ebcc8
lea rcx, [0x00c80918]
call fcn.006e70f0
or dword [rbx + 0x58], 0x200000
jmp 0x6ebbc2
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str.conout_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6ebd98
lea rdx, [0x00c80950]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x6ebe30
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x6ebe18
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6ebcb8
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x6ebcb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
test r12d, r12d
jne 0x6ebbc5
jmp 0x6ebcb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r13
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6ebe03
lock or dword [0x00c80968], 1
jmp 0x6ebd21
Function at 0x6ec710
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
mov dword [rsp + 0x48], 1
jne 0x6ec8b0
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6ec7f8
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x6ec7e0
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x6ec7e0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x4c], 0x274
mov qword [rsp + 0x20], rax
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6ec7e0
cmp dword [rsp + 0x78], 1
je 0x6ec850
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x70], rbx
cmp edi, 0x17
je 0x6ec838
xor eax, eax
and edx, 0x400000
jne 0x6ec810
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x79
lea rdx, str.src_win_udp.c
lea rcx, str.__handle__flags__UV_HANDLE_IPV6_
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6ec7d4
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x6ec890
mov rax, qword [0x0096a5a0]
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x198], rax
mov rax, qword [0x0096a5b0]
or edx, 0x20000
mov dword [rsi + 0x58], edx
mov qword [rsi + 0x1a0], rax
jmp 0x6ec7c1
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 1
je 0x6ec7be
call rbp
jmp 0x6ec7d4
mov eax, 0xfffff00e
jmp 0x6ec7d4
Function at 0x6ec8c0
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor r12d, r12d
mov rbx, rcx
mov r13, rdx
mov edi, r8d
mov esi, r9d
mov dword [rsp + 0x38], 0
test byte [rcx + 0x59], 0x20
jne 0x6ec939
mov ebp, r9d
and ebp, 1
je 0x6ec8ff
cmp word [rdx], 0x17
mov r12d, 0x57
jne 0x6ec939
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x6ec9c0
and esi, 4
jne 0x6ec950
cmp word [r13], 0x17
je 0x6ec98b
mov r8d, edi
mov rdx, r13
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x6eca00
or dword [rbx + 0x58], 0x2000
xor r12d, r12d
mov eax, r12d
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], 1
mov edx, 0xffff
mov r8d, 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6eca00
cmp word [r13], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x6ec91a
or dword [rbx + 0x58], 0x400000
test ebp, ebp
jne 0x6ec91a
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x6ec91a
movzx ecx, word [r13]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6eca00
mov rcx, qword [rbx + 8]
movzx r9d, word [r13]
mov r8, rax
mov rdx, rbx
call fcn.006ec710
mov r12d, eax
test eax, eax
jne 0x6eca10
mov rcx, qword [rbx + 0x70]
jmp 0x6ec90d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r12d, eax
jmp 0x6ec939
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6ec939
Function at 0x6ecc40
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov ebp, dword [rsp + 0x1c0]
lea r13, [rsp + 0x50]
mov r12, rcx
mov ecx, 0x21
mov rsi, rdx
mov rdi, r13
mov r10, r8
mov rbx, r9
rep stosq qword [rdi], rax
test r8, r8
je 0x6ecc94
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.006cd490
test eax, eax
jne 0x6ecd04
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov rax, qword [rsi + 0x10]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbx]
mov qword [rsp + 0x68], rax
mov eax, dword [rsi + 0x18]
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x70], eax
mov rax, qword [rbx + 0x10]
movups xmmword [rsp + 0xd8], xmm1
mov qword [rsp + 0xe8], rax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0xf0], eax
cmp ebp, 1
je 0x6ecd30
test ebp, ebp
jne 0x6ecd38
mov r8d, 0x2e
mov dword [rsp + 0x20], 0x108
mov rcx, qword [r12 + 0x70]
mov r9, r13
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x6ecd18
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006cf860
jmp 0x6ecd04
mov r8d, 0x2d
jmp 0x6eccde
mov eax, 0xfffff019
jmp 0x6ecd04
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov edi, dword [rsp + 0x70]
and eax, 0x402000
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
cmp eax, 0x2000
je 0x6ed948
mov rdx, qword [0x0096a570]
mov r9d, 4
mov r8d, 0x1c
call fcn.006ec8c0
test eax, eax
jne 0x6ed930
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x70], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x6ecc40
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.006cf860
mov eax, 0xfffff019
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x6ed7a0
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rbx, rcx
mov rdi, rdx
mov r13, r8
mov esi, r9d
cmp eax, 0x2000
je 0x6ed870
mov rdx, qword [0x0096a570]
mov r9d, 4
mov r8d, 0x1c
call fcn.006ec8c0
mov r12d, eax
test eax, eax
jne 0x6ed890
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test r13, r13
je 0x6ed827
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, r13
call fcn.006cd490
test eax, eax
jne 0x6ed870
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [rdi + 8]
movaps xmmword [rsp + 0x30], xmm0
test esi, esi
je 0x6ed888
mov r8d, 0xc
cmp esi, 1
jne 0x6ed870
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6ed8a8
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r12d, 0xfffff019
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0xd
jmp 0x6ed840
mov ecx, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.006cf860
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006cf860
mov r12d, eax
jmp 0x6ed861
Function at 0x6ed8c0
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
xor eax, eax
mov ebp, dword [rsp + 0x1c0]
lea r13, [rsp + 0x50]
mov r12, rcx
mov ecx, 0x21
mov rsi, rdx
mov rdi, r13
mov r10, r8
mov rbx, r9
rep stosq qword [rdi], rax
test r8, r8
je 0x6ecc94
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.006cd490
test eax, eax
jne 0x6ecd04
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov rax, qword [rsi + 0x10]
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rbx]
mov qword [rsp + 0x68], rax
mov eax, dword [rsi + 0x18]
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x70], eax
mov rax, qword [rbx + 0x10]
movups xmmword [rsp + 0xd8], xmm1
mov qword [rsp + 0xe8], rax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0xf0], eax
cmp ebp, 1
je 0x6ecd30
test ebp, ebp
jne 0x6ecd38
mov r8d, 0x2e
mov dword [rsp + 0x20], 0x108
mov rcx, qword [r12 + 0x70]
mov r9, r13
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov r8d, eax
xor eax, eax
cmp r8d, 0xffffffff
je 0x6ecd18
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006cf860
jmp 0x6ecd04
mov r8d, 0x2d
jmp 0x6eccde
mov eax, 0xfffff019
jmp 0x6ecd04
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x58]
mov edi, dword [rsp + 0x70]
and eax, 0x402000
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov rsi, r9
cmp eax, 0x2000
je 0x6ed948
mov rdx, qword [0x0096a570]
mov r9d, 4
mov r8d, 0x1c
call fcn.006ec8c0
test eax, eax
jne 0x6ed930
mov r9, rsi
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x70], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x6ecc40
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.006cf860
mov eax, 0xfffff019
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x6ee270
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r14, qword [rsp + 0xe0]
mov ebp, dword [rsp + 0xe8]
mov r15, qword [rsp + 0xf0]
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13d, r9d
test byte [rdx + 0x59], 0x20
jne 0x6ee2d8
cmp ebp, 0x10
je 0x6ee4e0
cmp ebp, 0x1c
jne 0x6ee500
mov rdx, qword [0x0096a570]
xor r9d, r9d
mov r8d, ebp
mov rcx, rbx
call fcn.006ec8c0
test eax, eax
jne 0x6ee446
lea rax, [rsi + 0x40]
mov rdi, qword [rbx + 8]
mov dword [rsp + 0x30], ebp
mov r8d, r13d
mov qword [rsi + 0x40], 0
lea r9, [rsp + 0x6c]
mov rdx, r12
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 0
mov rcx, qword [rbx + 0x70]
mov dword [rsi + 8], 5
mov qword [rsi + 0x70], rbx
mov qword [rsi + 0x78], r15
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x6ee3b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x6ee438
mov edx, r13d
mov rcx, r12
call fcn.006cdb10
mov qword [rsi + 0x60], rax
add qword [rbx + 0x60], rax
mov eax, dword [rbx + 0x7c]
add dword [rbx + 0x78], 1
lea edx, [rax + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], edx
test eax, eax
jne 0x6ee460
mov eax, dword [rbx + 0x58]
test al, 4
je 0x6ee490
add dword [rdi + 0x20], 1
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [rbx + 0x58]
test edx, 0x20000
je 0x6ee358
mov ecx, dword [rbx + 0x7c]
mov qword [rsi + 0x60], 0
add dword [rbx + 0x78], 1
lea r8d, [rcx + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], r8d
test ecx, ecx
je 0x6ee4b0
test r8d, r8d
jg 0x6ee406
mov dword [rsp + 0x5c], eax
mov r8d, 0x1ae
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x5c]
mov rdx, qword [rdi + 0x48]
add dword [rdi + 0x20], 1
mov qword [rsi + 0x68], 0
test rdx, rdx
je 0x6ee4f0
mov rcx, qword [rdx + 0x68]
mov qword [rsi + 0x68], rcx
mov qword [rdx + 0x68], rsi
mov qword [rdi + 0x48], rsi
jmp 0x6ee396
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x6ee396
mov ecx, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.006cf860
test edx, edx
jg 0x6ee390
mov r8d, 0x1b6
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6ee390
mov edx, eax
or edx, 4
mov dword [rbx + 0x58], edx
test al, 8
je 0x6ee390
mov rax, qword [rbx + 8]
add dword [rax + 8], 1
jmp 0x6ee390
test dl, 4
jne 0x6ee406
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rbx + 0x58], ecx
je 0x6ee406
mov rdx, qword [rbx + 8]
add dword [rdx + 8], 1
jmp 0x6ee406
mov rdx, qword [0x0096a560]
jmp 0x6ee2c2
mov qword [rsi + 0x68], rsi
mov qword [rdi + 0x48], rsi
jmp 0x6ee396
mov eax, 0xfffff019
jmp 0x6ee396
Function at 0x6ee510
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov edi, dword [rsp + 0x130]
mov rbx, rcx
mov r13, rdx
mov esi, r8d
mov r12, r9
test r8d, r8d
je 0x6ee610
test r12, r12
je 0x6ee554
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.006f1f10
test eax, eax
jne 0x6ee5d9
cmp qword [rbx + 0x68], 0
jne 0x6ee643
test byte [rbx + 0x59], 0x20
jne 0x6ee590
cmp edi, 0x10
je 0x6ee630
cmp edi, 0x1c
jne 0x6ee63c
mov rdx, qword [0x0096a570]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call fcn.006ec8c0
test eax, eax
jne 0x6ee5f6
lea rax, [rsp + 0x60]
mov r8d, esi
mov dword [rsp + 0x30], edi
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
mov rdx, r13
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov r8d, eax
mov eax, dword [rsp + 0x5c]
test r8d, r8d
jne 0x6ee5f0
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006cf860
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0x471
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6ee53a
mov rdx, qword [0x0096a560]
jmp 0x6ee57e
mov eax, 0xfffff019
jmp 0x6ee5d9
mov eax, 0xfffff008
jmp 0x6ee5d9