joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6cd400
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rdi, qword [sym.imp.KERNEL32.DLL_ReadFile]
xor ebx, ebx
mov r13, rcx
mov r12, rdx
lea rbp, [rsp + 0x4c]
mov esi, r8d
mov edx, ebx
mov r8d, esi
mov r9, rbp
mov rcx, r13
mov qword [rsp + 0x20], 0
add rdx, r12
sub r8d, ebx
call rdi
test eax, eax
je 0x6cd490
add ebx, dword [rsp + 0x4c]
cmp esi, ebx
ja 0x6cd423
mov eax, 0
jne 0x6cd460
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x67d
lea rdx, str.src_win_pipe.c
lea rcx, str.bytes_read__count
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x6cd600
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov rbx, rcx
mov esi, edx
mov r12d, r8d
xor edx, edx
xor r8d, r8d
lea rdi, [rsp + 0x50]
mov rcx, rbp
call fcn.006ba840
movdqu xmm0, xmmword [rsp + 0x30]
mov edx, esi
mov r8, rdi
mov rcx, rbx
movaps xmmword [rsp + 0x50], xmm0
call qword [rbx + 0x68]
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x6cd695
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x6cd695
cmp r8d, r12d
mov rcx, qword [rbx + 0x118]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
cmova r8d, r12d
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x6cd6b2
mov edx, dword [rsp + 0x4c]
mov r8, rdi
mov rcx, rbx
call qword [rbx + 0x70]
mov eax, dword [rsp + 0x4c]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rdi
mov rdx, 0xfffffffffffff024
mov rcx, rbx
call qword [rbx + 0x70]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movdqa xmm1, xmmword [rsp + 0x50]
mov r8, rbp
mov rcx, rbx
mov edx, eax
movaps xmmword [rsp + 0x30], xmm1
call fcn.006cd590
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6cd9a0
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r13, qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov r12, qword [sym.imp.KERNEL32.DLL_CreateNamedPipeA]
lea rbp, str._pipeuv_p__lu
mov r15, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r14, qword [rsp + 0xc0]
mov edi, r8d
mov qword [rsp + 0xa0], rcx
mov rsi, r9
mov rbx, rdx
mov qword [rsp + 0xa8], rdx
or edi, 0x400c0000
jmp 0x6cda0e
call r15
mov edx, eax
cmp eax, 0xe7
je 0x6cda0a
cmp eax, 5
jne 0x6cdab8
add rbx, 1
call r13
mov r9, rbx
mov r8, rbp
mov rdx, r14
mov dword [rsp + 0x20], eax
mov rcx, rsi
call fcn.006cd880
mov r9d, 1
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x38], 0
mov rcx, rsi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call r12
mov r10, rax
cmp rax, 0xffffffffffffffff
je 0x6cd9f5
mov rax, qword [rsp + 0xa0]
xor r9d, r9d
mov rcx, r10
mov qword [rsp + 0x40], r10
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
mov r10, qword [rsp + 0x40]
test rax, rax
je 0x6cdacb
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x40], r10
call fcn.006cbd00
mov rax, qword [rsp + 0xa8]
mov r10, qword [rsp + 0x40]
xor edx, edx
mov qword [rax + 0x118], r10
mov eax, edx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x48], r10
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r10, qword [rsp + 0x48]
mov dword [rsp + 0x40], eax
mov rcx, r10
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [rsp + 0x40]
jmp 0x6cdab8
Function at 0x6d1540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa8]
mov r15, rcx
mov rbx, rdx
mov r14, r8
mov rbp, r9
cmp rdx, 2
jbe 0x6d1670
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x6d1784
cmp ax, 0x2f
je 0x6d1720
cmp word [rcx + 2], 0x3a
je 0x6d17c0
nop dword [rax + rax]
lea rcx, [rbp + r12 + 4]
add rcx, r13
add rcx, rbx
add rcx, rcx
call fcn.006ba730
mov rdx, qword [rsp + 0xa0]
mov r8, r13
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
lea rdi, [rsi + r13*2]
test r13, r13
jne 0x6d1757
mov rcx, rdi
mov r8, rbx
lea rdi, [rdi + rbx*2]
mov rdx, r15
call sub.msvcrt.dll_wcsncpy
test rbx, rbx
jne 0x6d16f0
mov r8, rbp
mov rdx, r14
lea rbx, [rdi + rbp*2]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
test r12, r12
je 0x6d1638
test rbp, rbp
je 0x6d1621
cmp word [rbx - 2], 0x2e
je 0x6d1621
mov edx, 0x2e
add rbx, 2
mov word [rbx - 2], dx
mov rdx, qword [rsp + 0x90]
mov rcx, rbx
mov r8, r12
lea rbx, [rbx + r12*2]
call sub.msvcrt.dll_wcsncpy
xor eax, eax
mov rcx, rsi
mov word [rbx], ax
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6d16e0
test al, 0x10
jne 0x6d16e0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x6d15a0
movzx eax, word [rcx]
cmp ax, 0x2f
je 0x6d1720
cmp ax, 0x5c
je 0x6d1720
cmp rdx, 2
jne 0x6d15a0
cmp word [rcx + 2], 0x3a
jne 0x6d15a0
cmp r13, 1
jbe 0x6d178b
mov r8d, 2
mov rdx, r15
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x6d178b
add r15, 4
sub rbx, 2
lea rdi, [r13 + r13]
jmp 0x6d172b
mov rcx, rsi
xor esi, esi
call fcn.006ba750
jmp 0x6d1657
movzx edx, word [rdi - 2]
lea rcx, [0x00af369e]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x6d15f1
mov ecx, 0x5c
add rdi, 2
mov word [rdi - 2], cx
jmp 0x6d15f1
mov edi, 4
mov r13d, 2
lea rcx, [rbp + r12 + 4]
add rcx, rbx
add rcx, r13
add rcx, rcx
call fcn.006ba730
mov rdx, qword [rsp + 0xa0]
mov r8, r13
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
add rdi, rsi
movzx edx, word [rdi - 2]
lea rcx, [0x00af369e]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x6d15d6
mov r8d, 0x5c
add rdi, 2
mov word [rdi - 2], r8w
jmp 0x6d15d6
cmp word [rcx + 2], 0x5c
jne 0x6d1720
lea rcx, [rbp + r12 + 4]
add rcx, rbx
add rcx, rcx
call fcn.006ba730
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov rdi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, rdi
jmp 0x6d15d6
movzx eax, word [r15 + 4]
cmp ax, 0x2f
je 0x6d178b
cmp ax, 0x5c
jne 0x6d16a5
jmp 0x6d178b
Function at 0x6d1a20
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov ebx, edx
cmp edx, 0x1c
ja 0x6d1af0
cmp edx, 2
je 0x6d1a7f
jg 0x6d1a70
mov eax, 0xfffff02a
test edx, edx
jne 0x6d1a63
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x6d1ab0
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
cmp edx, 9
je 0x6d1a7f
mov eax, 0xfffff02a
cmp edx, 0xf
jne 0x6d1a63
mov edx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x6d1a63
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x6d1ac0
mov ecx, ebx
call fcn.006bf1f0
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.006bf1f0
jmp 0x6d1a63
lea rdx, [rsp + 0x2c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x6d1aa2
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x6d1a63
jmp 0x6d1aa2
mov eax, 0xfffff019
jmp 0x6d1a63
Function at 0x6d4570
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x6d45e0
test ah, 0x80
je 0x6d45f0
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x6d45c0
cmp r9d, 0xe
je 0x6d45d0
mov eax, 0xfffff008
cmp r9d, 7
je 0x6d45ba
mov r8d, 0xc0
lea rdx, str.src_win_stream.c
lea rcx, [0x00af3da1]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x6d6300
add rsp, 0x28
jmp fcn.006dcd00
mov eax, 0xfffff00d
jmp 0x6d45ba
mov eax, 0xfffff031
jmp 0x6d45ba
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x6d6370
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov edx, dword [rsp + 0x4c]
cmp eax, 0xffffffff
je 0x6d6350
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006bf1f0
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x6d6343
Function at 0x6d4df0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x58], edx
mov rsi, rcx
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov dword [rsp + 0x60], r8d
mov r8d, 8
mov dword [rsp + 0x20], 4
call rbx
cmp eax, 0xffffffff
je 0x6d4e62
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x6d4e40
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov edx, 6
mov rcx, rsi
mov r8d, 3
call rbx
cmp eax, 0xffffffff
jne 0x6d4e30
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x6d4e70
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp qword [r8], 0xffffffffffffffff
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov rbx, r9
mov dword [rsp + 0x48], 1
jne 0x6d5093
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, r9
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6d4f60
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetHandleInformation]
test eax, eax
je 0x6d4f50
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
test rax, rax
je 0x6d4f70
mov edx, dword [rdi]
mov eax, edx
and eax, 0x80000
cmp dword [rsp + 0xa0], 0x17
je 0x6d4f98
mov rcx, qword [0x00afb2f0]
mov ecx, dword [rcx]
or ecx, eax
je 0x6d5053
test edx, 0x1000000
jne 0x6d4fe0
test edx, 0x2000000
jne 0x6d501c
cmp dword [rsp + 0xa0], 0x17
mov qword [rsi], rbx
je 0x6d5040
xor eax, eax
and edx, 0x400000
jne 0x6d4fb0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x6d4f50
mov edx, dword [rdi]
mov eax, 0x80000
or edx, 0x80000
cmp dword [rsp + 0xa0], 0x17
mov dword [rdi], edx
jne 0x6d4efe
mov rcx, qword [0x00afb300]
mov ecx, dword [rcx]
jmp 0x6d4f07
mov dword [rsp + 0x3c], eax
mov r8d, 0x93
lea rdx, str.src_win_tcp.c
lea rcx, [0x00af3ea8]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6d4f42
mov dword [rsp + 0x4c], 1
lea r9, [rsp + 0x4c]
mov r8d, 1
mov rcx, rbx
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6d5080
mov edx, dword [rdi]
test edx, 0x2000000
je 0x6d4f27
mov r8d, 0x3c
mov edx, 1
mov rcx, rbx
call fcn.006d4df0
test eax, eax
jne 0x6d4f42
mov edx, dword [rdi]
jmp 0x6d4f27
or edx, 0x400000
xor eax, eax
mov dword [rdi], edx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileCompletionNotificationModes]
test eax, eax
je 0x6d4f50
mov edx, dword [rdi]
or edx, 0x20000
mov dword [rdi], edx
jmp 0x6d4f0f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x6d4f42
jmp 0x6d500e
mov eax, 0xfffff00e
jmp 0x6d4f42
Function at 0x6d50a0
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx eax, word [rdx]
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov rsi, rdx
mov r12d, r8d
mov ebp, r9d
cmp rcx, 0xffffffffffffffff
je 0x6d5100
cmp ax, 0x17
je 0x6d5170
mov r8d, r12d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x6d51a1
or dword [rbx + 0x58], 0x2000
xor edi, edi
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r9b, 1
je 0x6d5111
mov edi, 0x57
cmp ax, 0x17
jne 0x6d50f0
movzx ecx, ax
xor r8d, r8d
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6d51c3
movzx eax, word [rsi]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x58]
mov r9, r13
mov dword [rsp + 0x28], 0
lea r8, [rbx + 0x110]
mov dword [rsp + 0x20], eax
call fcn.006d4e70
mov edi, eax
test eax, eax
jne 0x6d51d0
movzx eax, word [rsi]
mov rcx, qword [rbx + 0x110]
cmp ax, 0x17
jne 0x6d50d2
nop
and ebp, 1
lea r9, [rsp + 0x3c]
mov edx, 0x29
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x3c], ebp
mov r8d, 0x1b
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
jmp 0x6d50d2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2740
jne 0x6d50f0
mov dword [rbx + 0x118], 0x2740
jmp 0x6d50e7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
jmp 0x6d50f0
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6d50f0
Function at 0x6d6300
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x6d45e0
test ah, 0x80
je 0x6d45f0
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x6d45c0
cmp r9d, 0xe
je 0x6d45d0
mov eax, 0xfffff008
cmp r9d, 7
je 0x6d45ba
mov r8d, 0xc0
lea rdx, str.src_win_stream.c
lea rcx, [0x00af3da1]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x6d6300
add rsp, 0x28
jmp fcn.006dcd00
mov eax, 0xfffff00d
jmp 0x6d45ba
mov eax, 0xfffff031
jmp 0x6d45ba
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x6d6370
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov edx, dword [rsp + 0x4c]
cmp eax, 0xffffffff
je 0x6d6350
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006bf1f0
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x6d6343
Function at 0x6d6a80
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x6d6ab0
mov r8d, 0x44a
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
mov rcx, qword [rsi + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x6d6b80
mov eax, dword [rsi + 0x40]
test eax, eax
js 0x6d6b44
mov dword [rsp + 0x20], 8
mov r8d, 0x700b
mov edx, 0xffff
lea r9, [rbx + 0x110]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x6d6b40
mov rax, qword [rbx + 0x130]
mov qword [rsi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rsi
test rax, rax
je 0x6d6b5c
xor edx, edx
mov rcx, rbx
call rax
mov eax, dword [rbx + 0x78]
test eax, eax
jne 0x6d6b63
nop dword [rax + rax]
mov r8d, 0x471
lea rdx, str.src_win_tcp.c
lea rcx, [0x00af3f6f]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x6d6b63
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rsi + 0x70], 0xffffffffffffffff
test byte [rbx + 0x58], 0x40
jne 0x6d6c00
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x6d6b20
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x6d6b73
test dl, 1
jne 0x6d6be0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x58]
test al, 0x40
je 0x6d6b5c
mov edx, eax
and edx, 0xffffffbf
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6d6c10
test al, 1
jne 0x6d6bb1
test al, 4
je 0x6d6bb1
mov edx, eax
and edx, 0xffffffbb
mov dword [rbx + 0x58], edx
test al, 8
je 0x6d6bb1
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
cmp qword [rbx + 0x100], 0
je 0x6d6b5c
mov rcx, qword [rsi + 0x40]
call fcn.006e1ae0
mov rsi, qword [rbx + 0x100]
mov ecx, eax
call fcn.006bf1f0
mov rcx, rbx
mov edx, eax
call rsi
jmp 0x6d6b5c
test dl, 0x20
jne 0x6d6b73
mov rax, qword [rdi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
call fcn.006d4720
jmp 0x6d6b5c
jns 0x6d6bb1
mov r8d, 0x452
lea rdx, str.src_win_tcp.c
lea rcx, [0x00af4045]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6d6bb1
Function at 0x6d6c30
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x6d6c61
mov r8d, 0x479
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
sub dword [rbx + 0x7c], 1
jne 0x6d6cd0
mov eax, dword [rbx + 0x58]
test al, 1
je 0x6d6d50
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x6d6cf3
mov rcx, qword [rsi + 0x40]
sub eax, 1
mov dword [rdi + 0x20], eax
test ecx, ecx
js 0x6d6d22
mov ecx, 0x3e3
test byte [rbx + 0x58], 1
je 0x6d6d75
mov rbp, qword [rsi + 0x70]
call fcn.006bf1f0
mov rcx, rsi
mov edx, eax
call rbp
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x6d6db1
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x6d6cc5
test dl, 1
jne 0x6d6d30
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
jns 0x6d6c72
mov r8d, 0x47b
lea rdx, str.src_win_tcp.c
lea rcx, [0x00af3f38]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rdi + 0x20]
test eax, eax
jne 0x6d6c79
lea rcx, [0x00af3f53]
mov r8d, 0x47b
lea rdx, str.src_win_tcp.c
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rdi + 0x20]
mov rcx, qword [rsi + 0x40]
sub eax, 1
mov dword [rdi + 0x20], eax
test ecx, ecx
jns 0x6d6c8b
call fcn.006e1ae0
mov ecx, eax
jmp 0x6d6c9a
test dl, 0x20
jne 0x6d6cc5
mov rax, qword [rdi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test al, 4
je 0x6d6c72
mov edx, eax
and edx, 0xfffffffb
mov dword [rbx + 0x58], edx
test al, 8
je 0x6d6c72
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6d6c72
mov rcx, qword [rbx + 0x110]
xor r9d, r9d
mov edx, 0xffff
mov dword [rsp + 0x20], 0
mov r8d, 0x7010
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, eax
test eax, eax
jne 0x6d6dd3
or dword [rbx + 0x58], 0xc080
add dword [rdi + 0xa8], 1
jmp 0x6d6c9a
mov r8d, 0x492
lea rdx, str.src_win_tcp.c
lea rcx, [0x00af3f6f]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x6d6cb5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x6d6c9a

Function at 0x6d6fa0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x6d6fe1
mov eax, dword [rbx + 0x58]
test esi, esi
jne 0x6d6fd0
and eax, 0xfeffffff
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
or eax, 0x1000000
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov dword [rsp + 0x3c], edx
lea r9, [rsp + 0x3c]
mov edx, 6
mov r8d, 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6d6fb8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x6d6fc9
jmp 0x6d6fb8
Function at 0x6d7890
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
mov rbp, rdx
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
mov rsi, rax
test rax, rax
je 0x6d786e
xor eax, eax
lock cmpxchg qword [rdi + 8], rsi
mov rbx, rax
test rax, rax
jne 0x6d7830
call rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEvent]
test eax, eax
je 0x6d7810
mov byte [rdi], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x36
lea rdx, str.src_win_thread.c
lea rcx, str.result
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6d77fc
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x6d77ff
mov r8d, 0x3e
lea rdx, str.src_win_thread.c
lea rcx, str.result__WAIT_OBJECT_0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.msvcrt.dll__assert]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.CreateEvent
mov ecx, eax
call fcn.006bf130
nop
nop dword [rax]
nop word cs:[rax + rax]
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov dword [0x00de2240], eax
cmp eax, 0xffffffff
je 0x806110
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop

Function at 0x6d78d0
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov r12, rcx
mov rbp, r8
mov rdi, r9
test byte [rdx], 1
je 0x6d79c0
mov rsi, qword [rdx + 8]
test rsi, rsi
jne 0x6d7990
mov ecx, 0x18
call fcn.006ba730
mov rbx, rax
test rax, rax
je 0x6d79c7
mov qword [rax], rbp
xor ecx, ecx
mov r9, rax
lea r8, [0x006d8210]
mov qword [rax + 8], rdi
mov edx, esi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
jne 0x6d7970
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, rbx
mov esi, dword [rax]
call fcn.006ba750
mov eax, 0xfffff01a
cmp esi, 0x16
ja 0x6d7983
lea rax, [0x00af41c0]
mov eax, dword [rax + rsi*4]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [r12], rax
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_GetNativeSystemInfo]
mov edx, dword [rsp + 0x34]
lea rsi, [rsi + rdx - 1]
neg rdx
and rsi, rdx
mov eax, esi
cmp rax, rsi
je 0x6d78f9
mov eax, 0xfffff019
jmp 0x6d7983
xor esi, esi
jmp 0x6d78f9
mov eax, 0xfffff027
jmp 0x6d7983
Function at 0x6d81f0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
je 0x80614c
add rsp, 0x28
ret

Function at 0x6d8f20
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rdi, qword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
mov r15, qword [sym.imp.KERNEL32.DLL_GetLastError]
movzx r12d, byte [rsp + 0xc0]
mov rsi, rcx
mov r14d, edx
mov r13d, r9d
movzx ebp, r8b
lea rbx, [rsp + 0x30]
jmp 0x6d8f91
mov dword [rsp + 0x20], r12d
mov edx, r14d
mov rcx, rbx
mov r9d, r13d
mov r8d, ebp
call fcn.006d8d10
mov rcx, qword [rsi + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.DLL_SetConsoleCursorPosition]
test eax, eax
jne 0x6d8fb3
call r15
cmp eax, 0x57
jne 0x6d8fd0
mov rcx, qword [rsi + 0x110]
mov rdx, rbx
call rdi
test eax, eax
jne 0x6d8f60
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x6d8f60
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x6d8fb5