joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140d105a4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140d02aa4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140d02aa4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140d106f1
cmp rax, 0xffffffffffffffff
je 0x140d106f1
xor edi, edi
test rbp, rbp
jle 0x140d1069f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140d04d40
mov rbx, rax
test rax, rax
jne 0x140d1062c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140d10695
mov edx, 0x8000
mov ecx, r14d
call fcn.140cfc34c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140d02110
cmp eax, 0xffffffff
je 0x140d10675
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140d1063c
mov edx, r15d
mov ecx, r14d
call fcn.140cfc34c
jmp 0x140d10695
cmp byte [rsi + 0x38], dil
je 0x140d1068c
cmp dword [rsi + 0x34], 5
jne 0x140d1068c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x140d10695
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140d04dc0
jmp 0x140d10703
jns 0x140d10703
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140d02aa4
cmp rax, 0xffffffffffffffff
jne 0x140d106bd
cmp byte [rsi + 0x30], dil
je 0x140d10703
jmp 0x140d106f9
mov ecx, r14d
call fcn.140cfb524
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140d10703
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x140d10703
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140d106fe
mov edi, dword [rsi + 0x2c]
jmp 0x140d10703
mov edi, reloc.WS2_32.dll_shutdown
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140d02aa4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140d10774
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140d10794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140cf5194
or eax, 0xffffffff
jmp 0x140d10796
xor eax, eax
add rsp, 0x28
ret
Function at 0x140d12cf0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14100f500]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x140d12d3a
call fcn.140cf51e0
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.140cf5204
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.140cf5aac
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140cd9320
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140d12d45
lea eax, [rbx + 1]
jmp 0x140d12d27
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140d12d25
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x140d12d27
Function at 0x140d14028
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140ceecbc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140d140b2
cmp byte [rbp - 0x21], r15b
je 0x140d140ad
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140d140e8
call fcn.140d0512c
test eax, eax
jne 0x140d140d4
cmp byte [rbp - 0x21], r15b
je 0x140d140cc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140d140e8
cmp byte [rbp - 0x21], r15b
je 0x140d140e5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140cf3df4
test eax, eax
jne 0x140d14188
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140ceecbc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140d14127
cmp byte [rbp - 0x21], r15b
je 0x140d1415c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140d1415c
call fcn.140d0512c
test eax, eax
jne 0x140d14148
cmp byte [rbp - 0x21], r15b
je 0x140d14141
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140d1415c
cmp byte [rbp - 0x21], r15b
je 0x140d14159
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140cf3df4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140d14188
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140d1418b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140d14199
mov rcx, rdi
call fcn.140d04dc0
cmp byte [rbp + 0x3f], r15b
je 0x140d141a8
mov rcx, qword [rbp + 0x27]
call fcn.140d04dc0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140d625a0
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x690
call fcn.140cd95f0
sub rsp, rax
mov rax, qword [0x14100f500]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rsi, qword [rsp + 0x6d8]
mov eax, edx
xor edx, edx
mov r10d, ecx
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x40], edx
cmp ecx, 0xffffffff
je 0x140d62608
test eax, eax
je 0x140d62608
mov qword [rsp + 0x468], r10
mov dword [rsp + 0x460], 1
cmp r8d, 0xffffffff
je 0x140d62629
test r9d, r9d
je 0x140d62629
mov eax, r8d
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x250], 1
cmp r10d, 0xffffffff
je 0x140d6263d
mov edx, 1
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], edx
cmp r8d, 0xffffffff
je 0x140d62672
xor eax, eax
test edx, edx
je 0x140d6265d
mov r9d, r8d
nop dword [rax]
cmp qword [rsp + rax*8 + 0x48], r9
je 0x140d6265d
inc eax
cmp eax, edx
jb 0x140d62650
cmp eax, edx
jne 0x140d62672
cmp edx, 0x40
jae 0x140d62672
mov edx, r8d
mov qword [rsp + rax*8 + 0x48], rdx
inc dword [rsp + 0x40]
mov rbx, qword [rsp + 0x6d0]
cmp r8d, r10d
mov edi, r8d
cmovle edi, r10d
cmp r10d, 0xffffffff
jne 0x140d6269c
cmp r8d, r10d
jne 0x140d6269c
cmp rbx, 0xffffffffffffffff
jb 0x140d6269c
xor eax, eax
jmp 0x140d627d2
mov qword [rsp + 0x6b8], rbp
mov qword [rsp + 0x688], r12
mov qword [rsp + 0x680], r15
test rsi, rsi
je 0x140d626c1
mov rcx, rsi
call fcn.140b004b0
lea ebp, [rdi + 1]
movabs r15, 0x12e0be826d694b2f
movabs r12, 0x624dd2f1a9fbe77
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jae 0x140d6276a
call fcn.140b4e070
cmp rax, rbx
jbe 0x140d626fb
mov ecx, 0x3e7
jmp 0x140d6271f
mov rcx, rbx
sub rcx, rax
mov rax, rcx
not rax
cmp rax, 0x3e7
jae 0x140d62718
mov rcx, 0xffffffffffffffff
jmp 0x140d6271f
add rcx, 0x3e7
mov r8, rcx
mov rax, r15
mul rcx
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 0x1d
imul rax, r8, 0x3b9aca00
sub rcx, rax
mov rax, r12
mul rcx
mov eax, r8d
sub rcx, rdx
shr rcx, 1
add rdx, rcx
shr rdx, 9
mov edx, edx
shl rdx, 0x20
or rdx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
jmp 0x140d6276c
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x250]
mov ecx, ebp
lea rdx, [rsp + 0x460]
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140d627a6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x140d626e0
mov r15, qword [rsp + 0x680]
mov r12, qword [rsp + 0x688]
mov rbp, qword [rsp + 0x6b8]
test rsi, rsi
je 0x140d627cb
mov rcx, rsi
call fcn.140b00440
not edi
shr edi, 0x1f
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140cd9320
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret

Function at 0x140d8c4a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov ecx, r8d
call fcn.140cfb524
mov r8, rax
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140d8c4d0
Function at 0x140d8c4d0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x310
mov rax, qword [0x14100f500]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rdi, r8
mov dword [rsp + 0x50], 1
mov rbx, rdx
lea r8, [rsp + 0x50]
mov rbp, rcx
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x140d8c528
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140d8e1b0
jmp 0x140d8c74c
lea rax, [rsp + 0x58]
mov qword [rsp + 0x300], r14
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], r14
mov edx, 0x48000022
mov qword [rsp + 0x30], rax
mov rcx, rdi
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAIoctl]
lea r8, [rbx + 0x20]
mov dword [rbx + 0x58], 8
lea rdx, [rbp + 0x10]
mov qword [rbx + 8], rbp
mov qword [r8], rdx
lea r9, [rsp + 0x70]
test eax, eax
mov dword [rbx + 0x10], 8
mov rax, qword [rdx + 8]
cmove rdi, qword [rsp + 0x60]
mov qword [r8 + 8], rax
mov rcx, rdi
mov qword [rax], r8
lea rax, [rsp + 0x54]
mov qword [rdx + 8], r8
mov edx, 0xffff
mov r8d, 0x2005
mov qword [rsp + 0x20], rax
mov dword [rbx + 0x30], 0xffffffff
mov qword [rbx + 0x68], rdi
mov byte [rbx + 0x19c], r14b
mov dword [rsp + 0x54], 0x274
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x140d8c5f4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140d8e1b0
jmp 0x140d8c744
mov r9, qword [rsp + 0x8c]
lea r11, [0x140ebf5d0]
mov r10, qword [rsp + 0x84]
mov r8d, 0xffffffff
mov edx, r14d
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
mov rax, r10
shl rcx, 4
sub rax, qword [rcx + r11]
jne 0x140d8c638
mov rax, r9
sub rax, qword [rcx + r11 + 8]
test rax, rax
cmove r8d, edx
inc edx
cmp edx, 4
jb 0x140d8c620
test r8d, r8d
js 0x140d8c703
mov qword [rsp + 0x308], rsi
movsxd rax, r8d
lea rsi, [rax*8]
add rsi, rbp
mov rdi, qword [rsi + 0x90]
test rdi, rdi
jne 0x140d8c6ef
mov r8d, dword [rsp + 0xcc]
lea r9, [rsp + 0x70]
mov edx, dword [rsp + 0xc8]
mov ecx, dword [rsp + 0xbc]
mov rbp, qword [rbp + 0x38]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140d8c6e1
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140d8c6d8
xor r9d, r9d
mov r8, rdi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x140d8c6e8
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdi, 0xffffffffffffffff
mov qword [rsi + 0x90], rdi
mov rsi, qword [rsp + 0x308]
cmp rdi, 0xffffffffffffffff
je 0x140d8c703
mov qword [rbx + 0x70], rdi
jmp 0x140d8c70a
or dword [rbx + 0x58], 0x1000000
mov word [rbx + 0x198], r14w
xor eax, eax
mov dword [rbx + 0xc0], reloc.WS2_32.dll_listen
mov qword [rbx + 0xf8], r14
mov qword [rbx + 0xb8], rbx
mov dword [rbx + 0x130], reloc.WS2_32.dll_listen
mov qword [rbx + 0x168], r14
mov qword [rbx + 0x128], rbx
mov r14, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140cd9320
add rsp, 0x310
pop rdi
pop rbp
pop rbx
ret
Function at 0x140d8dfc0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp byte [0x1410a9dc0], 0
jne 0x140d8e040
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
test rax, rax
je 0x140d8e0d3
xor eax, eax
lock cmpxchg qword [0x1410a9dc8], rbx
mov rdi, rax
jne 0x140d8e029
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1410a9db8], eax
cmp eax, 0xffffffff
je 0x140d8e0cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [0x1410a9dc0], 1
jmp 0x140d8e040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x1410a9db8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140d8e0bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140d8e0cd
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x50]
mov rcx, rax
mov r8, rdi
xor eax, eax
mov rdx, rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140d8e0e8
mov rdx, qword [rsp + 0x50]
mov ecx, dword [0x1410a9db8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140d8e0cd
mov rbx, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.140d0384c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.140d8e100
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x140ebf640]
call fcn.140d8e100
int3
Function at 0x140d8e9e0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov rsi, r8
mov rcx, qword [r8 + 0x70]
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
jne 0x140d8ea70
lea rdi, [rdx + 0x58]
mov edx, dword [rdx + 0x58]
test dl, 0x40
je 0x140d8eaef
and edx, 0xffffffbf
mov rcx, rdi
sub dword [rbx + 0x7c], 1
mov dword [rdi], edx
jne 0x140d8ea42
mov eax, edx
and al, 5
cmp al, 4
jne 0x140d8ea42
and edx, 0xfffffffb
mov dword [rdi], edx
test dl, 8
je 0x140d8ea3e
mov rax, qword [rbx + 8]
dec dword [rax + 8]
lea rcx, [rbx + 0x58]
cmp qword [rbx + 0x100], 0
mov rdi, rcx
je 0x140d8eaef
mov ecx, dword [r8 + 0x40]
call fcn.140d94620
mov ecx, eax
call fcn.140d8e1b0
mov edx, eax
mov rcx, rbx
call qword [rbx + 0x100]
jmp 0x140d8eaef
cmp dword [r8 + 0x40], 0
jl 0x140d8eac9
lea r9, [rdx + 0x110]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x140d8eac9
mov rax, qword [rbx + 0x130]
mov qword [rsi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rsi
test rax, rax
je 0x140d8eac3
xor edx, edx
mov rcx, rbx
call rax
lea rdi, [rbx + 0x58]
jmp 0x140d8eaef
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
lea rdi, [rbx + 0x58]
mov qword [rsi + 0x70], 0xffffffffffffffff
test byte [rdi], 0x40
je 0x140d8eaef
mov rdx, rsi
mov rcx, rbx
call fcn.140d8f5c0
mov ecx, dword [rbx + 0x78]
mov eax, dword [rdi]
dec ecx
mov dword [rbx + 0x78], ecx
test al, 1
je 0x140d8eb16
test ecx, ecx
jne 0x140d8eb16
test al, 0x20
jne 0x140d8eb16
or eax, 0x20
mov dword [rdi], eax
mov rax, qword [rbp + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rbp + 0x50], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140d8eb30
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
sub dword [rdx + 0x7c], 1
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
jne 0x140d8eb6f
mov eax, dword [rdx + 0x58]
test al, 1
jne 0x140d8eb6f
test al, 4
je 0x140d8eb6f
and eax, 0xfffffffb
mov dword [rdx + 0x58], eax
test al, 8
je 0x140d8eb6f
mov rax, qword [rdx + 8]
dec dword [rax + 8]
dec dword [rcx + 0x20]
xor edx, edx
mov eax, dword [rbx + 0x118]
mov edi, edx
test eax, eax
je 0x140d8eb88
mov dword [rbx + 0x118], edx
jmp 0x140d8ebd6
mov ecx, dword [r8 + 0x40]
test ecx, ecx
js 0x140d8ebd1
test byte [rbx + 0x58], 1
je 0x140d8eb9d
mov edi, 0x3e3
jmp 0x140d8ebd8
mov rcx, qword [rbx + 0x110]
xor r9d, r9d
mov dword [rsp + 0x20], edx
mov r8d, 0x7010
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x140d8ebc9
or dword [rbx + 0x58], 0xc080
jmp 0x140d8ebd8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x140d8ebd6
call fcn.140d94620
mov edi, eax
mov ecx, edi
call fcn.140d8e1b0
mov edx, eax
mov rcx, rbp
call qword [rbp + reloc.WS2_32.dll_WSASetLastError]
mov ecx, dword [rbx + 0x78]
mov eax, dword [rbx + 0x58]
dec ecx
mov dword [rbx + 0x78], ecx
test al, 1
je 0x140d8ec10
test ecx, ecx
jne 0x140d8ec10
test al, 0x20
jne 0x140d8ec10
or eax, 0x20
mov dword [rbx + 0x58], eax
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140d8f890
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xorps xmm0, xmm0
lea rbx, [rdx + 0x80]
movups xmmword [rbx + 0x40], xmm0
lea r14, [rbx + 0x40]
xor ebp, ebp
movups xmmword [r14 + 0x10], xmm0
or dword [rdx + 0x58], 0x40000
lea rax, [0x1410a9ec0]
movups xmmword [r14], xmm0
mov rsi, rdx
mov rdi, rcx
movups xmmword [r14 + 0x10], xmm0
test dword [rdx + 0x58], 0x80000
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ebp
je 0x140d8f8f6
mov rax, qword [rbx + 0x70]
or rax, 1
mov qword [rbx + 0x58], rax
mov rcx, qword [rsi + 0x110]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], ebp
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ecx, dword [rsi + 0x58]
inc dword [rsi + 0x78]
bts ecx, 0x10
mov dword [rsi + 0x58], ecx
test eax, eax
jne 0x140d8f976
bt ecx, 0x11
jae 0x140d8f9af
mov eax, dword [rsp + 0x80]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x140d8fa1f
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rdi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x140d8fa23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140d8f9af
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x140d8f99a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cdqe
mov qword [r14], rax
jmp 0x140d8f950
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [r14], rax
jmp 0x140d8f950
test dword [rsi + 0x58], 0x80000
je 0x140d8fa27
cmp qword [rbx + 0x78], 0xffffffffffffffff
lea rcx, [rbx + 0x78]
jne 0x140d8fa27
mov rdx, qword [rbx + 0x70]
lea r8, [0x140d8e970]
mov dword [rsp + 0x28], 4
mov r9, rbx
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x140d8fa27
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140d8fa06
call qword [sym.imp.KERNEL32.dll_GetLastError]
cdqe
mov qword [rbx + 0x40], rax
jmp 0x140d8f950
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
jmp 0x140d8f950
mov qword [rbx + 0x68], rbx
mov qword [rdi + 0x48], rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140d90140
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
test r9d, r9d
mov edx, 0x40040003
mov eax, 0x400c0003
cmovne edx, eax
mov rdi, r8
xor eax, eax
mov rsi, rcx
mov rcx, qword [rbx + 0x120]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rdi + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x140d901b5
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rdx, qword [rsi + 0x38]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x140d901ed
mov rax, qword [rdi + 0x70]
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x118], rax
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [0x140ebf6a0]
call fcn.140d8e100
int3
Function at 0x140d90680
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x140d90723
call fcn.140d90140
test eax, eax
jne 0x140d90723
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140d906bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140d906ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140d90708
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
movups xmmword [rbx + 0x40], xmm0
lea rdx, [rbx + 0x40]
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x140d907ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140d907ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x140d90767
xor eax, eax
jmp 0x140d9079b
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140d9078b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140d90799
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140d907c2
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x140d907c6
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
mov r14, qword [rsp + 0x30]
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret