joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a580
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r9
mov r8, rcx
test rdx, rdx
je 0x14000a5ce
cmp dword [0x1402cfb80], 1
jne 0x14000a5aa
cmp dword [0x1402cda70], 0
jne 0x14000a5aa
xor eax, eax
jmp 0x14000a63d
and dword [0x1402cfb7c], 0
lea r9, [0x1400017b0]
mov dword [reloc.WS2_32.dll_accept], 1
mov qword [rsp + 0x20], rdi
call fcn.14000a480
jmp 0x14000a63d
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x14]
call fcn.1400791e8
cmp dword [0x1402cfb80], 1
lea rcx, [0x1400017b0]
mov dword [0x1402cfbac], 1
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
jne 0x14000a619
cmp dword [0x1402cda70], 0
jne 0x14000a619
mov rcx, rax
call fcn.1401ad038
jmp 0x14000a5a3
and qword [rsp + 0x28], 0
lea r8, [fcn.140009dc0]
and dword [rsp + 0x20], 0
mov r9, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14000a644
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1402cfd00]
mov dword [0x1402cda70], 1
test rbx, rbx
je 0x14000a683
mov rcx, rbx
call fcn.14007916c
test eax, eax
je 0x14000a67b
mov rcx, qword [rbx + 0x48]
mov edx, 0x42b
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
and qword [0x1402cfd00], 0
add rsp, 0x20
pop rbx
ret

Function at 0x14000a82c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r15
mov r10d, dword [0x1402cfbc8]
mov ebp, edx
mov r11d, dword [0x1402cfbb8]
mov eax, r10d
cdq
xor r13d, r13d
idiv r11d
mov r15, r8
mov r12d, ecx
mov r9d, r13d
mov ebx, edx
test edx, edx
je 0x14000a877
mov r8d, r11d
sub r8d, edx
add r8d, r10d
jmp 0x14000a87a
mov r8d, r10d
sub r8d, ebp
sub r8d, dword [0x1402cfb94]
test ebx, ebx
je 0x14000a892
mov eax, r11d
sub eax, ebx
add eax, r10d
jmp 0x14000a895
mov eax, r10d
sub eax, ebp
cmp r8d, eax
jge 0x14000a923
mov eax, dword [0x1402cfb84]
cdq
idiv r11d
test edx, edx
je 0x14000a8bb
mov eax, r11d
sub eax, edx
add eax, dword [0x1402cfb84]
jmp 0x14000a8c1
mov eax, dword [0x1402cfb84]
imul eax, r8d
mov rdi, r13
add eax, r12d
imul eax, dword [0x1402cfbd4]
movsxd rdx, eax
mov eax, dword [0x1402cfbd4]
add rdx, r15
imul eax, r11d
movsxd rcx, eax
sar rcx, 2
lea rax, [rdx + rcx*4]
lea rcx, [rcx*4 + 3]
shr rcx, 2
cmp rdx, rax
cmova rcx, r13
test rcx, rcx
je 0x14000a91b
imul r9d, r9d, 0x1000193
inc rdi
xor r9d, dword [rdx]
lea rdx, [rdx + 4]
cmp rdi, rcx
jb 0x14000a905
inc r8d
jmp 0x14000a884
mov rbx, qword [rsp + 0x18]
mov eax, r9d
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
pop r15
pop r13
ret
Function at 0x14000be30
Capabilities:
Create thread
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1402ccee0]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov r14d, edx
mov ebx, ecx
test ecx, ecx
jne 0x14000be67
xor eax, eax
jmp 0x14000bff1
cmp ebx, 6
jne 0x14000be88
lea ecx, [rbx - 4]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
lea ecx, [rbx - 2]
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov eax, 1
jmp 0x14000bff1
cmp ebx, 7
jne 0x14000be92
lea ecx, [rbx - 6]
jmp 0x14000be78
cmp ebx, 8
jne 0x14000bea2
or ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14000be7e
cmp ebx, 9
jne 0x14000bed8
mov qword [rsp + 0x28], rsi
lea r8, [0x140008af8]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14000be7e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000be7e
cmp ebx, 5
jg 0x14000be60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x20]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000be60
lea r8, [rbp - 0x14]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000bf54
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000be60
sub ebx, 1
je 0x14000bfa3
sub ebx, 1
je 0x14000bf8b
sub ebx, 1
je 0x14000bf81
sub ebx, 1
je 0x14000bf7a
cmp ebx, 1
jne 0x14000bfe5
xor ecx, ecx
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
jmp 0x14000bfbc
mov ecx, 1
jmp 0x14000bf6f
mov dword [rsp + 0x20], 1
jmp 0x14000bf8f
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x1e]
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x14000bfbc
mov edx, 0x80000000
test r14d, r14d
je 0x14000bfb4
mov ecx, 4
jmp 0x14000bfb6
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x14000bfe5
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0xc], esi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, 1
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401a5d00
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14000c280
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareOpen_SourceMeshAgent2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x14000c2ea
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], cx
jne 0x14000c2b0
mov rcx, qword [rsp + 0x40]
lea rdx, str.KeyStore
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret
Function at 0x140049880
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1402ccee0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rax, rdx
lea r9, [rsp + 0x30]
mov rbx, rcx
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
test eax, eax
je 0x140049a33
cmp byte [rsp + 0x50], 0
je 0x140049a33
mov rcx, rbx
call fcn.1400124b4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140011fd4
mov esi, 0xfffffffe
lea r8, str.name
mov edx, esi
mov rcx, rbx
call fcn.14000f660
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea r9, [rsp + 0x40]
mov edi, eax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x140049992
mov rcx, qword [rsp + 0x38]
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
test rcx, rcx
jns 0x140049946
addsd xmm1, qword [0x1402acb78]
mov rcx, rbx
call fcn.140011e04
lea r8, str.size
mov edx, esi
mov rcx, rbx
call fcn.14000f660
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
test rax, rax
jns 0x140049979
addsd xmm1, qword [0x1402acb78]
mov rcx, rbx
call fcn.140011e04
lea r8, str.free
mov edx, esi
mov rcx, rbx
call fcn.14000f660
sub edi, 2
je 0x1400499db
sub edi, 1
je 0x1400499d2
sub edi, 1
je 0x1400499c9
sub edi, 1
je 0x1400499c0
mov rcx, rbx
cmp edi, 1
je 0x1400499b7
lea rdx, str.UNKNOWN
jmp 0x1400499e5
lea rdx, str.RAMDISK
jmp 0x1400499e5
lea rdx, str.CDROM
jmp 0x1400499e2
lea rdx, str.REMOTE
jmp 0x1400499e2
lea rdx, str.FIXED
jmp 0x1400499e2
lea rdx, str.REMOVABLE
mov rcx, rbx
call fcn.140011fd4
lea r8, [0x1402303b8]
mov edx, esi
mov rcx, rbx
call fcn.14000f660
mov r9d, 0x18075380
mov dword [rsp + 0x20], 6
xor r8d, r8d
lea rdx, [0x140049850]
mov rcx, rbx
call fcn.1400126fc
lea r8, str.toString
mov edx, esi
mov rcx, rbx
call fcn.14000f660
mov eax, 1
jmp 0x140049a35
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1401a5d00
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14004f51c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rbx, rcx
lea edi, [rbp + 1]
cmp dword [rcx + 8], ebp
jne 0x14004f549
mov rax, qword [rbx + 0x70]
cmp dword [rax + 8], 0
jle 0x14004f5ef
mov rax, qword [rbx + 0x70]
xor esi, esi
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14004f55b
mov rsi, qword [rcx]
mov rcx, qword [rsi]
lea rdx, [rsi + 0x10]
mov r8d, dword [rsi + 0xc]
lea r9, [rsp + 0x50]
mov ebp, dword [rsi + 8]
lea rax, [rcx + 0x38]
mov rcx, qword [rcx + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14d, eax
cmp eax, edi
jne 0x14004f5a8
cmp dword [rbx + 8], 0
jne 0x14004f606
mov rcx, qword [rsi]
mov rcx, qword [rcx + 0x70]
call fcn.14007a854
mov rcx, rsi
call fcn.1401ad038
cmp dword [rbx + 8], 0
je 0x14004f53b
test r14d, r14d
jne 0x14004f5ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14004f5dd
mov rdx, qword [rbx + 0x50]
lea rax, [0x14004f498]
mov rcx, qword [rbx + 0x58]
xor edi, edi
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.14007f7f0
jmp 0x14004f608
mov rcx, qword [rbx]
mov rdx, rbx
mov edi, 0xfffffffc
call fcn.14004f370
jmp 0x14004f608
cmp dword [rbx + 8], 0
jne 0x14004f606
test ebp, ebp
je 0x14004f608
mov rcx, qword [rbx]
mov rdx, rbx
call fcn.14004f440
jmp 0x14004f608
xor edi, edi
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14004f650
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rdx]
mov rbx, rdx
mov rcx, qword [rcx + 0x70]
call fcn.14007dcec
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x70]
cmp dword [rax + 8], 1
jne 0x14004f67c
add rsp, 0x20
pop rbx
jmp fcn.14004f51c
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14004f858
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [rdx + 0x70]
mov rbx, rdx
call fcn.14007a854
mov rcx, rax
call fcn.1401ad038
mov rax, qword [rbx + 0x70]
cmp dword [rax + 8], 0
jne 0x14004f88c
mov rcx, qword [rbx]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14004f440
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14004f51c
Function at 0x14005f0a8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rdx
cmp dword [rdx + 0x58], edi
jne 0x14005f247
lea esi, [rdi + 1]
mov dword [rdx + 0x58], esi
cmp qword [rdx + 0x60], rdi
jne 0x14005f0f2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x1000
call fcn.1400791e8
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x68], 0x1000
mov dword [rbx + 0x70], edi
cmp dword [rbx + 0x70], edi
jg 0x14005f108
mov r8d, dword [rbx + 0x68]
mov rdx, qword [rbx + 0x60]
mov qword [rbx + 0x6c], rdi
jmp 0x14005f1e5
mov rdx, qword [rbx + 0x50]
mov rax, qword [rdx]
cmp dword [rax + 0x50], edi
jne 0x14005f244
mov rcx, rdx
mov dword [rbx + 0x74], edi
call fcn.14007916c
test eax, eax
je 0x14005f14b
mov rax, qword [rbx + 0x50]
test rax, rax
je 0x14005f135
mov rcx, qword [rax]
jmp 0x14005f138
mov rcx, rdi
movsxd r8, dword [rbx + 0x6c]
xor edx, edx
add r8, qword [rbx + 0x60]
mov r9d, dword [rbx + 0x70]
call fcn.1400695bc
mov ecx, dword [rbx + 0x74]
test ecx, ecx
jle 0x14005f16a
mov eax, dword [rbx + 0x70]
sub eax, ecx
add dword [rbx + 0x6c], eax
cmp dword [rbx + 0x70], ecx
jne 0x14005f162
mov dword [rbx + 0x74], edi
mov ecx, dword [rbx + 0x74]
mov dword [rbx + 0x70], ecx
jmp 0x14005f16e
mov qword [rbx + 0x6c], rdi
mov rdx, qword [rbx + 0x50]
mov rax, qword [rdx]
mov r8d, dword [rax + 0x50]
test r8d, r8d
jne 0x14005f244
mov eax, dword [rbx + 0x70]
test eax, eax
je 0x14005f197
jle 0x14005f18f
test ecx, ecx
je 0x14005f197
test r8d, r8d
jmp 0x14005f112
mov ecx, dword [rbx + 0x68]
mov eax, ecx
sub eax, dword [rbx + 0x70]
cmp eax, dword [rbx + 0x6c]
jne 0x14005f1ca
lea eax, [rcx + 0x1000]
mov rcx, qword [rbx + 0x60]
movsxd rdx, eax
call fcn.1401b3804
mov qword [rbx + 0x60], rax
test rax, rax
je 0x14005f257
add dword [rbx + 0x68], 0x1000
mov r8d, dword [rbx + 0x68]
sub r8d, dword [rbx + 0x6c]
movsxd rdx, dword [rbx + 0x6c]
movsxd rax, dword [rbx + 0x70]
sub r8d, dword [rbx + 0x70]
add rdx, rax
add rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x28]
lea rax, [fcn.14005efc4]
mov dword [rcx + 0x58], esi
mov qword [rcx], rdx
mov dword [rcx + 8], r8d
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x50], rax
lea rax, [0x140081794]
mov r9, qword [rcx + 0x78]
mov rcx, qword [rcx + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14005f228
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14005f22a
mov eax, edi
test eax, eax
je 0x14005f244
mov rcx, qword [rbx + 0x28]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], edi
mov rdx, rbx
call fcn.14005efc4
mov dword [rbx + 0x58], edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0xfe
lea rdx, str...microscriptILibDuktape_net.c
mov ebx, 0x386
mov dword [rsp + 0x20], eax
mov r9d, edi
mov r8d, ebx
xor ecx, ecx
call fcn.14007f3d4
mov r8d, ebx
lea rdx, str...microscriptILibDuktape_net.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, edi
call fcn.1401a83f8
int3
Function at 0x14006ae3c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
or ebx, 0xffffffff
mov rbp, rcx
mov edx, ebx
call fcn.14000ecc8
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, rbp
mov r14, rax
call fcn.140010848
mov rcx, rbp
call fcn.140012288
lea r8, [0x1402a6b98]
mov edx, ebx
mov rcx, rbp
call fcn.140050d2c
mov rcx, rbp
mov rdi, rax
call fcn.140012e00
mov rbx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
test rdi, rdi
je 0x14006aef8
lea ecx, [rbx + 9]
call fcn.1400791e8
mov r9, rbx
mov r8, r14
mov rdx, rbx
mov rsi, rax
lea rcx, [rax + 8]
mov qword [rax], rdi
call section..text
mov byte [rsi + rbx + 8], 0
mov rcx, qword [rdi + 0x18]
call fcn.14007f570
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x14006aeee
mov r9, rsi
lea r8d, [rax + 1]
lea rdx, [fcn.14006f154]
call fcn.1400793b8
jmp 0x14006af4e
mov rdx, rsi
call fcn.14006f154
jmp 0x14006af4e
lea esi, [rbx + 4]
mov ecx, esi
call fcn.1400791e8
mov r9, rbx
mov r8, r14
mov rdx, rbx
mov rdi, rax
lea rcx, [rax + 4]
mov dword [rax], esi
call section..text
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov rcx, rax
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call fcn.140012e00
mov rcx, rdi
call fcn.1401ad038
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400755c4
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
add rcx, 0xc4
mov r10, r9
mov rdi, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], eax
and dword [rbx + 0x1e0], eax
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x1e8], rax
mov rax, qword [rsp + 0x68]
mov qword [rbx + 0x1f0], rax
test r9, r9
je 0x14007562b
cmp word [r10], 0x17
mov edx, 0x1c
mov r8, r10
lea r9d, [rdx - 0xc]
cmove r9d, edx
call section..text
mov rax, qword [rsp + 0x78]
mov r8, rdi
mov r9, qword [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140075230

Function at 0x140075650
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
or edx, 0xffffffff
mov rcx, qword [rcx + 0x280]
mov ebx, 0xfffffffc
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rdi + 0x2c8]
cmp qword [rax], 0
jbe 0x1400757aa
cmp qword [rdi + 0x278], 0
jne 0x1400757aa
cmp dword [rdi + 0x250], 0
jne 0x1400756cb
xor r9d, r9d
lea ecx, [rbx + 0x3c]
xor r8d, r8d
xor edx, edx
call fcn.1400791e8
xor ebx, ebx
mov dword [rax + 0x2c], 3
mov qword [rdi + 0x278], rax
mov qword [rdi + 0x270], rax
jmp 0x1400757aa
mov rcx, qword [rdi + 0x2b8]
mov edx, reloc.WS2_32.dll_ntohs
call fcn.1400af940
mov rdx, qword [rdi + 0x2c8]
xor r9d, r9d
mov rcx, qword [rdi + 0x60]
mov r8d, dword [rdx]
mov rdx, qword [rdx + 8]
call qword [sym.imp.WS2_32.dll_send]
movsxd rsi, eax
test eax, eax
jle 0x1400757aa
mov rax, qword [rdi + 0x2c8]
mov ecx, dword [rax]
cmp esi, ecx
jge 0x14007578d
sub ecx, esi
xor r9d, r9d
mov edx, ecx
xor r8d, r8d
lea ecx, [r9 + 0x38]
call fcn.1400791e8
mov rbx, rax
mov r8, rsi
lea rcx, [rax + 0x3c]
neg rax
sbb r10, r10
and r10, rcx
mov qword [rbx], r10
mov rcx, r10
mov rax, qword [rdi + 0x2c8]
mov edx, dword [rax]
sub edx, esi
mov dword [rbx + 0x2c], 3
mov dword [rbx + 8], edx
mov rax, qword [rdi + 0x2c8]
movsxd rdx, edx
mov r9, rdx
add r8, qword [rax + 8]
call section..text
mov rcx, qword [rdi + 0x2b8]
xor r9d, r9d
mov qword [rdi + 0x278], rbx
xor r8d, r8d
mov qword [rdi + 0x270], rbx
xor ebx, ebx
lea edx, [rbx + 1]
call fcn.1400af970
jmp 0x1400757aa
jne 0x1400757aa
mov rcx, qword [rdi + 0x2b8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call fcn.1400af970
mov ebx, 1
mov rcx, qword [rdi + 0x280]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140076d50
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
and dword [rcx + 0x68], 0
lea rax, [0x1402e1fc0]
and dword [rcx + 0x6c], 0
mov rbx, rcx
and dword [rcx + 0x24c], 0
and dword [rcx + 0x29c], 0
mov qword [rcx + 0x60], rdx
mov qword [rcx + 0x218], r8
mov qword [rcx + 0x238], r9
mov dword [rcx + 0x250], 1
mov rcx, qword [rcx + 0x260]
cmp rcx, rax
je 0x140076dc2
movsxd rdx, dword [rbx + 0x26c]
call fcn.1401b3804
test rax, rax
je 0x140076df2
mov qword [rbx + 0x260], rax
mov eax, dword [rbx + 0x26c]
mov dword [rbx + 0x268], eax
and dword [rbx + 0x254], 0
lea r8, [rsp + 0x40]
and dword [rbx + 0x258], 0
mov edx, 0x8004667e
mov rcx, qword [rbx + 0x60]
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x8cd
lea rdx, str...microstackILibAsyncSocket.c
mov r8d, ebx
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
xor ecx, ecx
call fcn.14007f3d4
mov r8d, ebx
lea rdx, str...microstackILibAsyncSocket.c
lea rcx, str.CRITICALEXIT__FILE:__s__LINE:__d_r_n
call fcn.140001090
mov ecx, 0xfe
call fcn.1401a83f8
int3

Function at 0x140076e98
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x8c]
mov esi, 0x1c
cmp word [rdi], 0
mov rax, rdx
mov dword [rsp + 0x30], esi
je 0x140076ee5
cmp word [rdi], 0x17
lea ebx, [rsi - 0xc]
mov edx, ebx
mov r8, rdi
cmove edx, esi
mov rcx, rax
mov r9d, edx
call section..text
cmp word [rdi], 0x17
cmove ebx, esi
mov eax, ebx
jmp 0x140076ef8
mov rcx, qword [rcx + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140076f08
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1402ccee0]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, word [rcx + 0x8c]
mov dword [rsp + 0x20], 0x1c
cmp ax, 0x17
jne 0x140076f3f
movzx ecx, word [rcx + 0x8e]
call qword [sym.imp.WS2_32.dll_ntohs]
jmp 0x140076f72
cmp ax, 2
je 0x140076f30
mov rcx, qword [rcx + 0x60]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp word [rsp + 0x28], 0x17
jne 0x140076f68
movzx ecx, word [rsp + 0x2a]
jmp 0x140076f37
cmp word [rsp + 0x28], 2
je 0x140076f61
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401a5d00
add rsp, 0x58
ret
Function at 0x1400770c0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
and dword [rax + 0x18], 0
mov r14d, edx
and dword [rax - 0x38], 0
xor edx, edx
and dword [rax - 0x34], 0
mov ebp, r9d
mov rsi, r8
mov dword [rax + 0x20], r9d
mov r15, rcx
xor r9d, r9d
lea ecx, [rdx + 0x30]
xor r8d, r8d
call fcn.1400791e8
mov r8, qword [rsp + 0xb0]
mov edx, 2
mov rcx, qword [rsp + 0xb8]
mov rbx, rax
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 0x20], r8
lea r8d, [rdx + 0xf]
mov qword [rax], rcx
movzx ecx, word [rsi]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007714e
mov rcx, rbx
call fcn.1401ad038
xor eax, eax
jmp 0x140077277
cmp ebp, 1
jne 0x14007717d
lea r9, [rsp + 0xa8]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
lea r8d, [rbp + 3]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14007728b
cmp word [rsi], 0x17
jne 0x1400771ad
mov edx, 0x29
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0xa0]
mov rcx, rdi
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400772b8
cmp word [rsi], 0x17
mov eax, 0x1c
mov rdx, rsi
mov rcx, rdi
lea r8d, [rax - 0xc]
cmove r8d, eax
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, rdi
test eax, eax
je 0x1400771dc
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x14007713f
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov r9d, 4
and dword [rsp + 0x28], 0
mov edx, 0x9800000c
and qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSAIoctl]
movzx ecx, word [rsi + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
and dword [rsp + 0x30], 0
lea rbp, [0x14000e064]
mov word [rbx + 0x18], ax
lea r8, [0x140077004]
lea rax, [0x1400770a4]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov edx, r14d
mov rcx, r15
mov qword [rsp + 0x20], rbp
call fcn.140074844
mov rsi, rax
test rax, rax
jne 0x140077263
mov rcx, rdi
jmp 0x1400771d1
mov r9, rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.140076d50
mov rax, rsi
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
and dword [rsp + 0x20], 0
lea rdx, str...microstackILibAsyncUDPSocket.c
mov r9d, eax
mov r8d, 0x7f
xor ecx, ecx
call fcn.14007f3d4
mov ecx, 0xfd
call fcn.1401a83f8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
and dword [rsp + 0x20], 0
lea rdx, str...microstackILibAsyncUDPSocket.c
mov r9d, eax
mov r8d, 0x83
xor ecx, ecx
call fcn.14007f3d4
mov ecx, 0xfd
call fcn.1401a83f8
int3

Function at 0x1400772e8
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, qword [rcx + 0x60]
mov rbx, r8
lea r8, [rdx + 4]
mov edx, 4
mov r9d, edx
lea rcx, [rsp + 0x40]
call fcn.140076f84
mov eax, dword [rbx + 4]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov rcx, rdi
mov dword [rsp + 0x20], 8
lea r8d, [rdx + 0xc]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret