joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6acd00
Capabilities:
Connect pipe
Create pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
test byte [rdx + 0x58], 0x40
je 0x6ace00
mov rcx, qword [rbx + 0x70]
test r9d, r9d
jne 0x6acdba
cmp rcx, 0xffffffffffffffff
je 0x6acd48
mov r8d, 0x33f
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle__INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
xor r8d, r8d
mov rcx, qword [rsi + 0x120]
mov qword [rsp + 0x38], 0
mov r9d, 0xff
mov dword [rsp + 0x30], 0
mov edx, 0x40040003
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r8, rax
mov qword [rbx + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x6ace6e
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov r9d, 0xffffffff
mov rdx, rsi
call fcn.006acab0
mov rcx, qword [rbx + 0x70]
test eax, eax
jne 0x6ace60
cmp rcx, 0xffffffffffffffff
je 0x6acec0
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x6ace30
add dword [rsi + 0x78], 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x88], r9d
mov r8d, 0x33c
lea rdx, str.src_win_pipe.c
lea rcx, [0x0090db78]
call qword [sym.imp.msvcrt.dll__assert]
mov r9d, dword [rsp + 0x88]
jmp 0x6acd1b
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x6acdf2
call rbp
cmp eax, 0x217
jne 0x6acee3
mov qword [rbx + 0x40], 0
jmp 0x6ace8f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
test eax, eax
jle 0x6acefb
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0x68], 0
test rax, rax
je 0x6acf01
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0x68], rdx
mov qword [rax + 0x68], rbx
mov qword [rdi + 0x48], rbx
add dword [rsi + 0x78], 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.req__pipeHandle___INVALID_HANDLE_VALUE
mov r8d, 0x357
lea rdx, str.src_win_pipe.c
call qword [sym.imp.msvcrt.dll__assert]
mov rcx, qword [rbx + 0x70]
jmp 0x6acdc4
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call rbp
test eax, eax
jg 0x6ace7f
call rbp
cdqe
jmp 0x6ace8b
mov qword [rbx + 0x68], rbx
mov qword [rdi + 0x48], rbx
jmp 0x6acdf2
Function at 0x6ad1a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rdx + 0x58]
mov rdi, rcx
mov rbx, rdx
test ah, 0x10
je 0x6ad340
test eax, 0x10000
jne 0x6ad2f2
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x6ad31a
mov eax, dword [rbx + 0x58]
lea rsi, [rbx + 0x80]
test eax, 0x1000000
jne 0x6ad2b1
lea rdx, [rbx + 0xc0]
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xc8], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
test eax, 0x80000
je 0x6ad22e
mov rax, qword [rbx + 0xf0]
or rax, 1
mov qword [rbx + 0xd8], rax
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbx + 0x118]
lea rdx, [0x00c2c580]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x6ad362
test byte [rbx + 0x5a], 8
je 0x6ad2d6
cmp qword [rbx + 0xf0], 0
je 0x6ad3e0
cmp qword [rbx + 0xf8], 0xffffffffffffffff
jne 0x6ad2d6
mov rdx, qword [rbx + 0xd8]
lea rcx, [rbx + 0xf8]
mov r9, rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x006ad640]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x6ad2d6
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6ad376
mov r8d, 0x10
mov rdx, rsi
mov qword [rbx + 0x238], 0
lea rcx, [0x006acf10]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x6ad2a5
mov rcx, rbx
call fcn.006ad140
or dword [rbx + 0x58], 0x10000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x45c
lea rdx, str.src_win_pipe.c
lea rcx, [0x0090dc90]
call qword [sym.imp.msvcrt.dll__assert]
cmp qword [rbx + 0x118], 0xffffffffffffffff
jne 0x6ad1d3
mov r8d, 0x45e
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6ad1d3
mov r8d, 0x45b
lea rdx, str.src_win_pipe.c
lea rcx, [0x0090dc68]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x58]
jmp 0x6ad1ba
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 0x3e5
je 0x6ad255
call rbp
test eax, eax
jle 0x6ad3d0
call rbp
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0xc0], rax
mov rax, qword [rdi + 0x48]
mov qword [rbx + 0xe8], 0
test rax, rax
je 0x6ad414
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0xe8], rdx
mov qword [rax + 0x68], rsi
mov qword [rdi + 0x48], rsi
or dword [rbx + 0x58], 0x10000
add dword [rbx + 0x78], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call rbp
cdqe
jmp 0x6ad388
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0xf0], rax
test rax, rax
jne 0x6ad269
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0090dce7]
mov ecx, eax
call fcn.0069fe10
mov qword [rbx + 0xe8], rsi
mov qword [rdi + 0x48], rsi
jmp 0x6ad3b6
Function at 0x6b2220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa8]
mov r15, rcx
mov rbx, rdx
mov r14, r8
mov rbp, r9
cmp rdx, 2
jbe 0x6b2350
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x6b2464
cmp ax, 0x2f
je 0x6b2400
cmp word [rcx + 2], 0x3a
je 0x6b24a0
nop dword [rax + rax]
lea rcx, [rbp + r12 + 4]
add rcx, r13
add rcx, rbx
add rcx, rcx
call fcn.0069b410
mov rdx, qword [rsp + 0xa0]
mov r8, r13
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
lea rdi, [rsi + r13*2]
test r13, r13
jne 0x6b2437
mov rcx, rdi
mov r8, rbx
lea rdi, [rdi + rbx*2]
mov rdx, r15
call sub.msvcrt.dll_wcsncpy
test rbx, rbx
jne 0x6b23d0
mov r8, rbp
mov rdx, r14
lea rbx, [rdi + rbp*2]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
test r12, r12
je 0x6b2318
test rbp, rbp
je 0x6b2301
cmp word [rbx - 2], 0x2e
je 0x6b2301
mov edx, 0x2e
add rbx, 2
mov word [rbx - 2], dx
mov rdx, qword [rsp + 0x90]
mov rcx, rbx
mov r8, r12
lea rbx, [rbx + r12*2]
call sub.msvcrt.dll_wcsncpy
xor eax, eax
mov rcx, rsi
mov word [rbx], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6b23c0
test al, 0x10
jne 0x6b23c0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x6b2280
movzx eax, word [rcx]
cmp ax, 0x2f
je 0x6b2400
cmp ax, 0x5c
je 0x6b2400
cmp rdx, 2
jne 0x6b2280
cmp word [rcx + 2], 0x3a
jne 0x6b2280
cmp r13, 1
jbe 0x6b246b
mov r8d, 2
mov rdx, r15
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x6b246b
add r15, 4
sub rbx, 2
lea rdi, [r13 + r13]
jmp 0x6b240b
mov rcx, rsi
xor esi, esi
call fcn.0069b430
jmp 0x6b2337
movzx edx, word [rdi - 2]
lea rcx, [0x0090e3be]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x6b22d1
mov ecx, 0x5c
add rdi, 2
mov word [rdi - 2], cx
jmp 0x6b22d1
mov edi, 4
mov r13d, 2
lea rcx, [rbp + r12 + 4]
add rcx, rbx
add rcx, r13
add rcx, rcx
call fcn.0069b410
mov rdx, qword [rsp + 0xa0]
mov r8, r13
mov rsi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
add rdi, rsi
movzx edx, word [rdi - 2]
lea rcx, [0x0090e3be]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x6b22b6
mov r8d, 0x5c
add rdi, 2
mov word [rdi - 2], r8w
jmp 0x6b22b6
cmp word [rcx + 2], 0x5c
jne 0x6b2400
lea rcx, [rbp + r12 + 4]
add rcx, rbx
add rcx, rcx
call fcn.0069b410
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov rdi, rax
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, rdi
jmp 0x6b22b6
movzx eax, word [r15 + 4]
cmp ax, 0x2f
je 0x6b246b
cmp ax, 0x5c
jne 0x6b2385
jmp 0x6b246b
Function at 0x6b5250
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x6b52c0
test ah, 0x80
je 0x6b52d0
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x6b52a0
cmp r9d, 0xe
je 0x6b52b0
mov eax, 0xfffff008
cmp r9d, 7
je 0x6b529a
mov r8d, 0xc0
lea rdx, str.src_win_stream.c
lea rcx, [0x0090eac1]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x6b6fe0
add rsp, 0x28
jmp fcn.006bd9e0
mov eax, 0xfffff00d
jmp 0x6b529a
mov eax, 0xfffff031
jmp 0x6b529a
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x6b7050
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov edx, dword [rsp + 0x4c]
cmp eax, 0xffffffff
je 0x6b7030
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0069fed0
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x6b7023
Function at 0x6b5ad0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x58], edx
mov rsi, rcx
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov dword [rsp + 0x60], r8d
mov r8d, 8
mov dword [rsp + 0x20], 4
call rbx
cmp eax, 0xffffffff
je 0x6b5b42
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x6b5b20
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov edx, 6
mov rcx, rsi
mov r8d, 3
call rbx
cmp eax, 0xffffffff
jne 0x6b5b10
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x6b5b50
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp qword [r8], 0xffffffffffffffff
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov rbx, r9
mov dword [rsp + 0x48], 1
jne 0x6b5d73
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, r9
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6b5c40
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x6b5c30
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x6b5c50
mov edx, dword [rdi]
mov eax, edx
and eax, 0x80000
cmp dword [rsp + 0xa0], 0x17
je 0x6b5c78
mov rcx, qword [0x0091ea50]
mov ecx, dword [rcx]
or ecx, eax
je 0x6b5d33
test edx, 0x1000000
jne 0x6b5cc0
test edx, 0x2000000
jne 0x6b5cfc
cmp dword [rsp + 0xa0], 0x17
mov qword [rsi], rbx
je 0x6b5d20
xor eax, eax
and edx, 0x400000
jne 0x6b5c90
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x6b5c30
mov edx, dword [rdi]
mov eax, 0x80000
or edx, 0x80000
cmp dword [rsp + 0xa0], 0x17
mov dword [rdi], edx
jne 0x6b5bde
mov rcx, qword [0x0091ea60]
mov ecx, dword [rcx]
jmp 0x6b5be7
mov dword [rsp + 0x3c], eax
mov r8d, 0x93
lea rdx, str.src_win_tcp.c
lea rcx, [0x0090ebc8]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6b5c22
mov dword [rsp + 0x4c], 1
lea r9, [rsp + 0x4c]
mov r8d, 1
mov rcx, rbx
mov dword [rsp + 0x20], 4
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6b5d60
mov edx, dword [rdi]
test edx, 0x2000000
je 0x6b5c07
mov r8d, 0x3c
mov edx, 1
mov rcx, rbx
call fcn.006b5ad0
test eax, eax
jne 0x6b5c22
mov edx, dword [rdi]
jmp 0x6b5c07
or edx, 0x400000
xor eax, eax
mov dword [rdi], edx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
je 0x6b5c30
mov edx, dword [rdi]
or edx, 0x20000
mov dword [rdi], edx
jmp 0x6b5bef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x6b5c22
jmp 0x6b5cee
mov eax, 0xfffff00e
jmp 0x6b5c22
Function at 0x6b6fe0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x6b52c0
test ah, 0x80
je 0x6b52d0
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x6b52a0
cmp r9d, 0xe
je 0x6b52b0
mov eax, 0xfffff008
cmp r9d, 7
je 0x6b529a
mov r8d, 0xc0
lea rdx, str.src_win_stream.c
lea rcx, [0x0090eac1]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x6b6fe0
add rsp, 0x28
jmp fcn.006bd9e0
mov eax, 0xfffff00d
jmp 0x6b529a
mov eax, 0xfffff031
jmp 0x6b529a
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x6b7050
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
mov edx, dword [rsp + 0x4c]
cmp eax, 0xffffffff
je 0x6b7030
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.0069fed0
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x6b7023
Function at 0x6b7760
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x6b7790
mov r8d, 0x44a
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
mov rcx, qword [rsi + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x6b7860
mov eax, dword [rsi + 0x40]
test eax, eax
js 0x6b7824
mov dword [rsp + 0x20], 8
mov r8d, 0x700b
mov edx, 0xffff
lea r9, [rbx + 0x110]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x6b7820
mov rax, qword [rbx + 0x130]
mov qword [rsi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rsi
test rax, rax
je 0x6b783c
xor edx, edx
mov rcx, rbx
call rax
mov eax, dword [rbx + 0x78]
test eax, eax
jne 0x6b7843
nop dword [rax + rax]
mov r8d, 0x471
lea rdx, str.src_win_tcp.c
lea rcx, [0x0090ec8f]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x6b7843
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rsi + 0x70], 0xffffffffffffffff
test byte [rbx + 0x58], 0x40
jne 0x6b78e0
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x6b7800
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x6b7853
test dl, 1
jne 0x6b78c0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x58]
test al, 0x40
je 0x6b783c
mov edx, eax
and edx, 0xffffffbf
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6b78f0
test al, 1
jne 0x6b7891
test al, 4
je 0x6b7891
mov edx, eax
and edx, 0xffffffbb
mov dword [rbx + 0x58], edx
test al, 8
je 0x6b7891
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
cmp qword [rbx + 0x100], 0
je 0x6b783c
mov rcx, qword [rsi + 0x40]
call fcn.006c27c0
mov rsi, qword [rbx + 0x100]
mov ecx, eax
call fcn.0069fed0
mov rcx, rbx
mov edx, eax
call rsi
jmp 0x6b783c
test dl, 0x20
jne 0x6b7853
mov rax, qword [rdi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
call fcn.006b5400
jmp 0x6b783c
jns 0x6b7891
mov r8d, 0x452
lea rdx, str.src_win_tcp.c
lea rcx, [0x0090ed65]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6b7891
Function at 0x6b7910
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x6b7941
mov r8d, 0x479
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
call qword [sym.imp.msvcrt.dll__assert]
sub dword [rbx + 0x7c], 1
jne 0x6b79b0
mov eax, dword [rbx + 0x58]
test al, 1
je 0x6b7a30
mov eax, dword [rdi + 0x20]
test eax, eax
je 0x6b79d3
mov rcx, qword [rsi + 0x40]
sub eax, 1
mov dword [rdi + 0x20], eax
test ecx, ecx
js 0x6b7a02
mov ecx, 0x3e3
test byte [rbx + 0x58], 1
je 0x6b7a55
mov rbp, qword [rsi + 0x70]
call fcn.0069fed0
mov rcx, rsi
mov edx, eax
call rbp
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x6b7a91
sub eax, 1
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x78], eax
jne 0x6b79a5
test dl, 1
jne 0x6b7a10
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
jns 0x6b7952
mov r8d, 0x47b
lea rdx, str.src_win_tcp.c
lea rcx, [0x0090ec58]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rdi + 0x20]
test eax, eax
jne 0x6b7959
lea rcx, [0x0090ec73]
mov r8d, 0x47b
lea rdx, str.src_win_tcp.c
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rdi + 0x20]
mov rcx, qword [rsi + 0x40]
sub eax, 1
mov dword [rdi + 0x20], eax
test ecx, ecx
jns 0x6b796b
call fcn.006c27c0
mov ecx, eax
jmp 0x6b797a
test dl, 0x20
jne 0x6b79a5
mov rax, qword [rdi + 0x50]
or edx, 0x20
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test al, 4
je 0x6b7952
mov edx, eax
and edx, 0xfffffffb
mov dword [rbx + 0x58], edx
test al, 8
je 0x6b7952
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6b7952
mov rcx, qword [rbx + 0x110]
xor r9d, r9d
mov edx, 0xffff
mov dword [rsp + 0x20], 0
mov r8d, 0x7010
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, eax
test eax, eax
jne 0x6b7ab3
or dword [rbx + 0x58], 0xc080
add dword [rdi + 0xa8], 1
jmp 0x6b797a
mov r8d, 0x492
lea rdx, str.src_win_tcp.c
lea rcx, [0x0090ec8f]
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rbx + 0x78]
jmp 0x6b7995
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x6b797a

Function at 0x6b7c80
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x6b7cc1
mov eax, dword [rbx + 0x58]
test esi, esi
jne 0x6b7cb0
and eax, 0xfeffffff
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
or eax, 0x1000000
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov dword [rsp + 0x3c], edx
lea r9, [rsp + 0x3c]
mov edx, 6
mov r8d, 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x6b7c98
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x6b7ca9
jmp 0x6b7c98
Function at 0x6b8570
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
mov rbp, rdx
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, rax
test rax, rax
je 0x6b854e
xor eax, eax
lock cmpxchg qword [rdi + 8], rsi
mov rbx, rax
test rax, rax
jne 0x6b8510
call rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x6b84f0
mov byte [rdi], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x36
lea rdx, str.src_win_thread.c
lea rcx, str.result
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6b84dc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x6b84df
mov r8d, 0x3e
lea rdx, str.src_win_thread.c
lea rcx, str.result__WAIT_OBJECT_0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.msvcrt.dll__assert]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateEvent
mov ecx, eax
call fcn.0069fe10
nop
nop dword [rax]
nop word cs:[rax + rax]
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00c2c680], eax
cmp eax, 0xffffffff
je 0x86eb80
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop

Function at 0x6b85b0
Capabilities:
Create thread
Get system information on windows
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov r12, rcx
mov rbp, r8
mov rdi, r9
test byte [rdx], 1
je 0x6b86a0
mov rsi, qword [rdx + 8]
test rsi, rsi
jne 0x6b8670
mov ecx, 0x18
call fcn.0069b410
mov rbx, rax
test rax, rax
je 0x6b86a7
mov qword [rax], rbp
xor ecx, ecx
mov r9, rax
lea r8, [0x006b8ef0]
mov qword [rax + 8], rdi
mov edx, esi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
jne 0x6b8650
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, rbx
mov esi, dword [rax]
call fcn.0069b430
mov eax, 0xfffff01a
cmp esi, 0x16
ja 0x6b8663
lea rax, [0x0090eee0]
mov eax, dword [rax + rsi*4]
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [r12], rax
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x34]
lea rsi, [rsi + rdx - 1]
neg rdx
and rsi, rdx
mov eax, esi
cmp rax, rsi
je 0x6b85d9
mov eax, 0xfffff019
jmp 0x6b8663
xor esi, esi
jmp 0x6b85d9
mov eax, 0xfffff027
jmp 0x6b8663
Function at 0x6b8ed0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x86ebbc
add rsp, 0x28
ret

Function at 0x6b9c00
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rdi, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r12d, byte [rsp + 0xc0]
mov rsi, rcx
mov r14d, edx
mov r13d, r9d
movzx ebp, r8b
lea rbx, [rsp + 0x30]
jmp 0x6b9c71
mov dword [rsp + 0x20], r12d
mov edx, r14d
mov rcx, rbx
mov r9d, r13d
mov r8d, ebp
call fcn.006b99f0
mov rcx, qword [rsi + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x6b9c93
call r15
cmp eax, 0x57
jne 0x6b9cb0
mov rcx, qword [rsi + 0x110]
mov rdx, rbx
call rdi
test eax, eax
jne 0x6b9c40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x6b9c40
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x6b9c95