joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005cdc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005cea4
mov qword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x38], 0
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x58]
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x14005ce43
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400e1f00]
call fcn.140002d00
mov eax, 0xffffffff
jmp 0x14005cea6
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x14005ce65
lea rcx, [0x1400e1f50]
call fcn.140002d00
mov eax, 0xffffffff
jmp 0x14005cea6
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14005cea4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x50]
lea rcx, str.Failed_to_create_directory:_ls_error:_d
call fcn.140002d00
mov eax, 0xffffffff
jmp 0x14005cea6
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14005ede0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x28], 0xef
mov byte [rsp + 0x29], 0xbb
mov byte [rsp + 0x2a], 0xbf
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0
je 0x14005ee4e
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x78]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x14005ee60
call fcn.1400826c8
mov dword [rax], 0x81
xor eax, eax
jmp 0x14005f066
cmp qword [rsp + 0x70], 0
jne 0x14005ee8d
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1400826c8
mov edx, dword [rax]
lea rcx, str.fopen___ERROR:_d
call fcn.140002e50
xor eax, eax
jmp 0x14005f066
mov r8d, 0xa
lea rdx, [0x1400e2790]
mov rcx, qword [rsp + 0x70]
call fcn.140078170
test eax, eax
jne 0x14005eec3
mov dword [rsp + 0x38], 1
lea rcx, [0x1400e2384]
call fcn.14005f500
mov qword [rsp + 0x30], rax
jmp 0x14005eed2
mov rcx, qword [rsp + 0x70]
call fcn.14005e740
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x78]
call fcn.14005f500
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x30], 0
je 0x14005eef1
cmp qword [rsp + 0x40], 0
jne 0x14005eef6
jmp 0x14005f03d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140086dbc
test eax, eax
jne 0x14005ef16
cmp qword [rsp + 0x20], 0
jne 0x14005ef34
call fcn.1400826c8
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x30]
lea rcx, str.Failed_to_open_file:_S_error:_d
call fcn.140002e50
jmp 0x14005f03d
cmp qword [0x1400e7a10], 0
je 0x14005ef9d
cmp dword [rsp + 0x38], 0
jne 0x14005ef9d
mov rcx, qword [rsp + 0x20]
call fcn.140086e14
mov ecx, eax
call fcn.140087cc8
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14006b5c0
test eax, eax
jne 0x14005ef9d
mov rdx, qword [rsp + 0x70]
lea rcx, [0x1400e27c0]
call fcn.140002e50
mov rcx, qword [rsp + 0x20]
call fcn.140078274
mov qword [rsp + 0x20], 0
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x14005f03d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
movsx eax, byte [rcx + rax]
cmp eax, 0x77
jne 0x14005efca
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.1400873b0
cmp eax, 9
je 0x14005efca
jmp 0x14005f03d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
movsx eax, byte [rcx + rax]
cmp eax, 0x72
jne 0x14005f03d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.1400873b0
cmp eax, 9
je 0x14005f03d
mov r9, qword [rsp + 0x20]
mov r8d, 1
mov edx, 3
lea rcx, [rsp + 0x48]
call fcn.1400870d0
cmp rax, 1
jne 0x14005f02e
mov r8d, 3
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.1400766c0
test eax, eax
je 0x14005f03d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.1400873b0
cmp qword [rsp + 0x30], 0
je 0x14005f04f
mov rcx, qword [rsp + 0x30]
call fcn.140078000
cmp qword [rsp + 0x40], 0
je 0x14005f061
mov rcx, qword [rsp + 0x40]
call fcn.140078000
mov rax, qword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x140060f20
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x34], 0x20101
cmp dword [0x1400e7d0c], 0
je 0x140060f5d
mov rax, qword [0x1400e7d10]
jmp 0x140061095
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x1400e3920]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006105f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400e3948]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14006105f
movsxd rax, dword [rsp + 0x30]
mov rcx, rax
call fcn.140078014
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140060feb
lea rdx, str.get_custom_lsa_package
lea rcx, str._s:_out_of_memory
call fcn.14000c3a0
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LSAAuthenticationPackage
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14006105f
mov rcx, qword [rsp + 0x38]
call fcn.14005f430
mov qword [0x1400e7d10], rax
cmp qword [0x1400e7d10], 0
jne 0x14006105f
mov rdx, qword [rsp + 0x38]
lea rcx, str.utf16_to_utf8_failed_to_convert_lsa_auth_pkg_w:_ls
call fcn.14000c3a0
cmp qword [rsp + 0x38], 0
je 0x140061071
mov rcx, qword [rsp + 0x38]
call fcn.140078000
cmp qword [rsp + 0x40], 0
je 0x140061084
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [0x1400e7d0c], 1
mov rax, qword [0x1400e7d10]
add rsp, 0x50
pop rdi
ret
Function at 0x140061540
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0
call fcn.14005bc80
test eax, eax
jne 0x140061577
lea rcx, str.Not_running_as_SYSTEM:_skipping_loading_user_profile
call fcn.140002df0
xor eax, eax
jmp 0x1400616dd
mov rcx, qword [rsp + 0x98]
call fcn.14005f500
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400615a7
lea rcx, [0x1400e32d0]
call fcn.14000c3a0
mov eax, 0xffffffff
jmp 0x1400616dd
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0
mov dx, 0x5c
mov rcx, qword [rsp + 0x28]
call fcn.1400764d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400615f7
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, qword [rsp + 0x30]
mov word [rcx], ax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x34
rep stosb byte [rdi], al
mov dword [rsp + 0x40], gethostname
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov edx, 1
lea rcx, [0x1400e32e0]
call fcn.14005fd50
mov edx, 1
lea rcx, [0x1400e32f8]
call fcn.14005fd50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x1400616ad
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.load_user_profile
lea rcx, str._s:_LoadUserProfileW___failed_for_user__S_with_error__d.
call fcn.140002e50
xor edx, edx
lea rcx, str.SeBackupPrivilege
call fcn.14005fd50
xor edx, edx
lea rcx, str.SeRestorePrivilege
call fcn.14005fd50
cmp qword [rsp + 0x20], 0
je 0x1400616db
mov rcx, qword [rsp + 0x20]
call fcn.140078000
xor eax, eax
add rsp, 0x80
pop rdi
ret
Function at 0x140066e80
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
cmp dword [rsp + 0x40], eax
jne 0x140066ea3
mov ecx, dword [rsp + 0x48]
call fcn.140066740
jmp 0x140066f0d
mov dword [rsp + 0x24], 0xffffffff
mov dword [rsp + 0x20], 0
jmp 0x140066ebf
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [0x1400ee180]
cmp dword [rsp + 0x20], eax
jge 0x140066eec
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1400ed980]
mov edx, dword [rsp + 0x40]
cmp dword [rcx + rax*4], edx
jne 0x140066eea
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
jmp 0x140066eec
jmp 0x140066eb5
cmp dword [rsp + 0x24], 0xffffffff
je 0x140066f0b
movsxd rax, dword [rsp + 0x24]
lea rcx, [0x1400ec980]
xor edx, edx
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor eax, eax
add rsp, 0x38
ret
Function at 0x140067560
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0
cmp qword [rsp + 0x78], 0
je 0x140067596
mov rax, qword [rsp + 0x78]
mov dword [rax], 0
mov dword [rsp + 0x50], 0x11800
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x40], 0
jne 0x14006760b
mov eax, dword [rsp + 0x50]
mov ecx, eax
call fcn.140078014
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400675ef
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
call fcn.1400826c8
mov r8, qword [rsp + 0x70]
mov edx, dword [rax]
lea rcx, str.WSARecv___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067713
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x48], ecx
jmp 0x140067619
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x58], rax
cmp dword [rsp + 0x80], 0
je 0x14006764d
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x80], eax
jae 0x14006763d
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x40], eax
jmp 0x140067645
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x70]
lea rcx, [0x140067360]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400676b9
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x54], 1
cmp qword [rsp + 0x78], 0
je 0x1400676b7
mov rax, qword [rsp + 0x78]
mov dword [rax], 1
jmp 0x140067711
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1400676d4
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x54], 1
jmp 0x140067711
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067470
mov dword [rsp + 0x4c], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x4c]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x70]
lea rcx, str.WSARecv___WSARecv___ERROR:_io:_p__d
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067713
xor eax, eax
add rsp, 0x68
ret
Function at 0x140067ab0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [0x1400e6480]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x48], 0x80
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x140067b65
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067470
mov dword [rsp + 0x4c], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x4c]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, qword [rsp + 0x120]
mov edx, eax
lea rcx, str.acceptEx___getsockname___ERROR:_d__io:_p
call fcn.140002df0
mov eax, 0xffffffff
jmp 0x140067ce5
movzx eax, word [rsp + 0x80]
mov r8d, 6
mov edx, 1
mov ecx, eax
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x400], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x400], 0xffffffffffffffff
jne 0x140067bdd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067470
mov dword [rsp + 0x50], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, qword [rsp + 0x120]
mov edx, eax
lea rcx, str.acceptEx___socket___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067ce5
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x40]
add rcx, 0x418
mov qword [rsp + 0x68], rcx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rdx
mov r8, qword [rsp + 0x40]
mov r8, qword [r8 + 0x408]
mov qword [rsp + 0x58], r8
mov rcx, qword [rsp + 0x58]
call qword [fcn.14000b810]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x90
mov dword [rsp + 0x20], 0x90
xor r9d, r9d
mov rax, qword [rsp + 0x70]
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x400]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x90]
call qword [rsp + 0x58]
cmp eax, 1
jne 0x140067c88
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x140067cd4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x140067cd4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067470
mov dword [rsp + 0x54], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x54]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, qword [rsp + 0x120]
mov edx, eax
lea rcx, str.acceptEx___AcceptEx___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067ce5
mov rax, qword [rsp + 0x120]
mov dword [rax + 0x54], 1
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400758f0
add rsp, 0x118
ret
Function at 0x140068410
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x78], 0
je 0x140068450
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x78]
mov dword [rsp + 0x30], eax
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x30]
lea rcx, str.finish_connect___ERROR:_async_io_completed_with_error:__d__io:_p
call fcn.140002e50
jmp 0x14006849b
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x7010
mov edx, 0xffff
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x14006849b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x30]
lea rcx, str.finish_connect___ERROR:_setsockopt_failed:_d__io:_p
call fcn.140002e50
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x38]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x38], 0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x74], 0
cmp dword [rsp + 0x30], 0
je 0x1400684fc
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x58], ecx
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x78], ecx
mov ecx, dword [rsp + 0x30]
call fcn.140067470
mov dword [rsp + 0x38], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
jmp 0x140068511
mov rax, qword [rsp + 0x50]
add rax, 0x60
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xb0], 3
cmp dword [rsp + 0x30], 0
je 0x140068531
mov dword [rsp + 0x34], 0xffffffff
jmp 0x140068539
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
add rsp, 0x40
pop rdi
ret

Function at 0x1400685e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_getsockname]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x140068652
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067470
mov dword [rsp + 0x24], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x24]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socketio_getsockname
lea rcx, [0x1400e4888]
call fcn.140002e50
mov eax, dword [rsp + 0x20]
jmp 0x14006865e
add rsp, 0x38
ret

Function at 0x140068710
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1400e6480]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor eax, eax
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 0x196
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400758f0
add rsp, 0x1d0
pop rdi
ret
Function at 0x1400695d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [rsp + 0x60], 8
je 0x140069603
cmp dword [rsp + 0x60], 4
je 0x140069603
cmp dword [rsp + 0x60], 1
je 0x140069603
cmp dword [rsp + 0x60], 0x1b
jne 0x14006967c
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
jne 0x14006966e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067470
mov dword [rsp + 0x34], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x34]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socketio_setsockopt
lea rcx, [0x1400e4808]
call fcn.140002e50
mov eax, dword [rsp + 0x30]
jmp 0x1400696a1
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x60]
lea rcx, str.setsockop___ERROR:_unsupported_optname:_d_io:_p
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x81
mov eax, 0xffffffff
add rsp, 0x48
ret
Function at 0x140069b70
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
call fcn.140067200
test eax, eax
je 0x140069ba3
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostname]
jmp 0x140069bb2
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_gethostname]
add rsp, 0x38
ret
Function at 0x14006a150
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x268
mov rax, qword [0x1400e6480]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14006a1be
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str.GetWindowsDirectoryW_failed_with__d
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x14006a232
mov rcx, qword [rsp + 0x270]
call fcn.140077df8
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.14005f430
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x20], 0
je 0x14006a1ef
cmp qword [rsp + 0x28], 0
jne 0x14006a1fc
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x14006a232
mov rax, qword [rsp + 0x20]
mov qword [0x1400e8790], rax
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [0x1400e87b0], rax
mov qword [rsp + 0x28], 0
lea rax, [0x1400e8790]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x20], 0
je 0x14006a244
mov rcx, qword [rsp + 0x20]
call fcn.140078000
cmp qword [rsp + 0x28], 0
je 0x14006a256
mov rcx, qword [rsp + 0x28]
call fcn.140078000
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400758f0
add rsp, 0x268
ret
Function at 0x14006a6d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x42f0
call fcn.140075930
sub rsp, rax
mov rax, qword [0x1400e6480]
xor rax, rsp
mov qword [rsp + 0x42e0], rax
xor eax, eax
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 1
mov edx, 1
mov rcx, qword [rsp + 0x4328]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
xor eax, eax
mov word [rsp + 0x2e0], ax
lea rax, [rsp + 0x2e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ffc
rep stosb byte [rdi], al
lea rax, str._lsconhost.exe___headless___width__d___height__d___signal_0x_x_____ls
mov qword [rsp + 0x50], rax
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14006a789
lea rcx, str.unable_to_retrieve_system32_path
call fcn.14000c3a0
movzx eax, word [rsp + 0x4310]
movzx ecx, word [rsp + 0x4308]
mov rdx, qword [rsp + 0x4300]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x4328]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8d, 0x1fff
mov edx, 0x1fff
lea rcx, [rsp + 0x2e0]
call fcn.14006a910
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0x60], WSAGetLastError
mov rax, qword [rsp + 0x4318]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x4320]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x4320]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x9c], 0x10a
lea rdx, [rsp + 0x2e0]
lea rcx, str.pty_commandline:__ls
call fcn.140002e50
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
mov rax, qword [rsp + 0x4330]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x2e0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x14006a8e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x2e0]
lea rdx, str.CreateConPty
lea rcx, str._s___failed_to_execute__ls__error:_d
call fcn.140002df0
call fcn.1400826c8
mov dword [rax], 0x83
mov eax, 0xffffffff
jmp 0x14006a8ef
mov edx, 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_console_l1_1_0.dll_SetConsoleCtrlHandler]
xor eax, eax
mov rcx, qword [rsp + 0x42e0]
xor rcx, rsp
call fcn.1400758f0
add rsp, 0x42f0
pop rdi
ret