joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6dc7d0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
mov edx, ecx
and dh, 0xef
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x6dc820
test cl, 1
je 0x6dc841
test edx, 0x10000
je 0x6dc80c
test edx, 0x2000000
jne 0x6dc860
and edx, 0x200000
je 0x6dc8c0
xor esi, esi
mov eax, esi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
jns 0x6dc7f0
lea rdx, str.src_win_tty.c
mov r8d, 0x402
lea rcx, [0x00af47d7]
call qword [sym.imp.msvcrt.dll__assert]
mov edx, dword [rbx + 0x58]
jmp 0x6dc7f0
test cl, 4
je 0x6dc7f0
mov edx, ecx
and edx, 0xffffeffb
and ecx, 8
mov dword [rbx + 0x58], edx
je 0x6dc7f0
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x6dc7f0
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov r10d, 0x10
mov qword [rsp + 0x52], 0
mov qword [rsp + 0x5a], 0
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rdx + 0x12], r9w
lea r9, [rsp + 0x4c]
mov word [rsp + 0x50], r10w
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
test eax, eax
jne 0x6dc80c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
jmp 0x6dc80e
lea rcx, [0x00de2258]
call fcn.006d7eb0
mov eax, 2
xchg dword [0x00de227c], eax
cmp eax, 1
je 0x6dc8f4
lea rcx, [0x00de2258]
call fcn.006d7e80
or dword [rbx + 0x58], 0x200000
jmp 0x6dc80c
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
lea rcx, str.conout_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x6dc9c0
lea rdx, [0x00de2260]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x6dca53
mov ecx, 1
xor edx, edx
movabs rax, 0xd000100000001
mov word [rsp + 0x50], cx
mov ecx, 0xd
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 0xd
mov dword [rsp + 0x60], 0
lea rdx, [rsp + 0x50]
mov word [rsp + 0x5e], r8w
lea r9, [rsp + 0x4c]
mov rcx, qword [rbx + 0x110]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
test eax, eax
je 0x6dca40
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6dc8e8
mov eax, 1
xor edx, edx
mov ecx, 0xd
mov word [rsp + 0x50], ax
movabs rax, 0xd000100000001
mov qword [rsp + 0x54], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, 0xd
lea r9, [rsp + 0x4c]
mov dword [rsp + 0x60], 0
mov word [rsp + 0x5e], dx
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x50]
mov r8d, 1
mov word [rsp + 0x5c], ax
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
test eax, eax
jne 0x6dc8e8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test esi, esi
jne 0x6dc80e
jmp 0x6dc8e8
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6dca2a
lock or dword [0x00de2278], 1
jmp 0x6dc94d
Function at 0x6dd220
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov ebp, r9d
mov dword [rsp + 0x48], 1
jne 0x6dd3c0
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x6dd302
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetHandleInformation]
test eax, eax
je 0x6dd2f0
xor r9d, r9d
mov rdx, qword [rdi + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
test rax, rax
je 0x6dd2f0
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov dword [rsp + 0x4c], 0x274
mov qword [rsp + 0x20], rax
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6dd2f0
cmp dword [rsp + 0x78], 1
je 0x6dd360
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x70], rbx
cmp ebp, 0x17
je 0x6dd340
xor eax, eax
and edx, 0x400000
jne 0x6dd314
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x79
lea rdx, str.src_win_udp.c
lea rcx, str.__handle__flags__UV_HANDLE_IPV6_
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
jmp 0x6dd2e4
or edx, 0x400000
xor eax, eax
mov dword [rsi + 0x58], edx
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetFileCompletionNotificationModes]
test eax, eax
je 0x6dd3a0
mov rax, qword [0x00afb310]
mov edx, dword [rsi + 0x58]
mov qword [rsi + 0x198], rax
mov rax, qword [0x00afb320]
or edx, 0x20000
mov dword [rsi + 0x58], edx
mov qword [rsi + 0x1a0], rax
jmp 0x6dd2d1
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rdi
cmp eax, 1
je 0x6dd2ce
call rdi
jmp 0x6dd2e4
mov eax, 0xfffff00e
jmp 0x6dd2e4
Function at 0x6dd3d0
Capabilities:
Set socket configuration

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor esi, esi
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
mov edi, r9d
mov dword [rsp + 0x38], 0
test byte [rcx + 0x59], 0x20
jne 0x6dd446
mov r13d, r9d
and r13d, 1
je 0x6dd40e
cmp word [rdx], 0x17
mov esi, 0x57
jne 0x6dd446
mov rcx, qword [rbx + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x6dd4d0
and edi, 4
jne 0x6dd460
cmp word [rbp], 0x17
je 0x6dd49a
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x6dd510
or dword [rbx + 0x58], 0x2000
xor esi, esi
mov eax, esi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], 1
mov edx, 0xffff
mov r8d, 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6dd510
cmp word [rbp], 0x17
mov rcx, qword [rbx + 0x70]
jne 0x6dd428
or dword [rbx + 0x58], 0x400000
test r13d, r13d
jne 0x6dd428
lea r9, [rsp + 0x38]
mov r8d, 0x1b
mov edx, 0x29
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x6dd428
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6dd510
mov rcx, qword [rbx + 8]
movzx r9d, word [rbp]
mov r8, rax
mov rdx, rbx
call fcn.006dd220
mov esi, eax
test eax, eax
jne 0x6dd520
mov rcx, qword [rbx + 0x70]
jmp 0x6dd41c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x6dd446
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x6dd446
Function at 0x6de130
Capabilities:
Set socket configuration

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov eax, dword [rcx + 0x58]
and eax, 0x402000
mov rsi, rcx
mov r12, rdx
mov rbp, r8
mov edi, r9d
cmp eax, 0x2000
je 0x6de200
mov rdx, qword [0x00afb2e0]
mov r9d, 4
mov r8d, 0x1c
call fcn.006dd3d0
mov ebx, eax
test eax, eax
jne 0x6de220
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
test rbp, rbp
je 0x6de1b5
xor edx, edx
lea r8, [rsp + 0x50]
mov rcx, rbp
call fcn.006bd1d0
test eax, eax
jne 0x6de200
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x40], eax
movdqu xmm0, xmmword [r12 + 8]
movaps xmmword [rsp + 0x30], xmm0
test edi, edi
je 0x6de212
mov r8d, 0xc
cmp edi, 1
jne 0x6de200
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x6de240
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ebx, 0xfffff019
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0xd
jmp 0x6de1d0
mov ecx, eax
call fcn.006bf1f0
mov ebx, eax
mov eax, ebx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006bf1f0
mov ebx, eax
jmp 0x6de1f1
Function at 0x6de910
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov edi, dword [rsp + 0xd8]
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13d, r9d
test byte [rdx + 0x59], 0x20
jne 0x6de964
cmp edi, 0x10
je 0x6deb70
cmp edi, 0x1c
jne 0x6deb90
mov rdx, qword [0x00afb2e0]
xor r9d, r9d
mov r8d, edi
mov rcx, rbx
call fcn.006dd3d0
test eax, eax
jne 0x6deade
mov rbp, qword [rbx + 8]
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x6c]
mov r8d, r13d
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x40], 0
mov rdx, r12
mov qword [rsi + 0x48], 0
mov qword [rsi + 0x78], rax
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x50], 0
mov qword [rsi + 0x58], 0
mov rcx, qword [rbx + 0x70]
mov dword [rsi + 8], 5
mov qword [rsi + 0x70], rbx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x6dea40
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x6dead0
mov edx, r13d
mov rcx, r12
call fcn.006bd780
mov qword [rsi + 0x60], rax
add qword [rbx + 0x60], rax
mov eax, dword [rbx + 0x7c]
add dword [rbx + 0x78], 1
lea edx, [rax + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], edx
test eax, eax
jne 0x6deaf2
mov eax, dword [rbx + 0x58]
test al, 4
je 0x6deb20
add dword [rbp + 0x20], 1
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edx, dword [rbx + 0x58]
test edx, 0x20000
je 0x6de9f4
mov ecx, dword [rbx + 0x7c]
mov qword [rsi + 0x60], 0
add dword [rbx + 0x78], 1
lea r8d, [rcx + 1]
add qword [rbx + 0x68], 1
mov dword [rbx + 0x7c], r8d
test ecx, ecx
je 0x6deb40
test r8d, r8d
jg 0x6dea96
mov dword [rsp + 0x5c], eax
mov r8d, 0x1ba
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x5c]
mov rdx, qword [rbp + 0x48]
add dword [rbp + 0x20], 1
mov qword [rsi + 0x68], 0
test rdx, rdx
je 0x6deb80
mov rcx, qword [rdx + 0x68]
mov qword [rsi + 0x68], rcx
mov qword [rdx + 0x68], rsi
mov qword [rbp + 0x48], rsi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x6dea32
mov ecx, eax
call fcn.006bf1f0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test edx, edx
jg 0x6dea2c
mov r8d, 0x1c2
lea rdx, str.src_win_udp.c
lea rcx, str.__handle____activecnt___0
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6dea2c
mov edx, eax
or edx, 4
mov dword [rbx + 0x58], edx
test al, 8
je 0x6dea2c
mov rax, qword [rbx + 8]
add dword [rax + 8], 1
jmp 0x6dea2c
test dl, 4
jne 0x6dea96
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rbx + 0x58], ecx
je 0x6dea96
mov rdx, qword [rbx + 8]
add dword [rdx + 8], 1
jmp 0x6dea96
mov rdx, qword [0x00afb2d0]
jmp 0x6de94e
mov qword [rsi + 0x68], rsi
mov qword [rbp + 0x48], rsi
jmp 0x6dea32
mov eax, 0xfffff019
jmp 0x6dea32
Function at 0x6deba0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov esi, dword [rsp + 0x130]
mov rbx, rcx
mov rbp, rdx
mov edi, r8d
test r8d, r8d
je 0x6dec90
test r9, r9
je 0x6debde
lea rdx, [rsp + 0x60]
mov rcx, r9
call fcn.006e24c0
test eax, eax
jne 0x6dec61
cmp qword [rbx + 0x68], 0
jne 0x6decd3
test byte [rbx + 0x59], 0x20
jne 0x6dec1a
cmp esi, 0x10
je 0x6decc0
cmp esi, 0x1c
jne 0x6deccc
mov rdx, qword [0x00afb2e0]
xor r9d, r9d
mov r8d, esi
mov rcx, rbx
call fcn.006dd3d0
test eax, eax
jne 0x6dec76
lea rax, [rsp + 0x60]
mov rdx, rbp
mov rcx, qword [rbx + 0x70]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
mov r8d, edi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov edx, eax
mov eax, dword [rsp + 0x5c]
test edx, edx
jne 0x6dec70
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.006bf1f0
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsp + 0x128], r9
mov r8d, 0x3e5
lea rdx, str.src_win_udp.c
lea rcx, str.nbufs___0
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x128]
jmp 0x6debc4
mov rdx, qword [0x00afb2d0]
jmp 0x6dec08
mov eax, 0xfffff019
jmp 0x6dec61
mov eax, 0xfffff008
jmp 0x6dec61

Function at 0x6df020
Capabilities:
Get common file path

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rdi, rcx
mov rsi, rdx
test rcx, rcx
je 0x6df160
test rdx, rdx
je 0x6df160
lea rbx, [rsp + 0x40]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
je 0x6df124
cmp eax, 0x104
ja 0x6df167
mov edx, eax
xor ecx, ecx
mov word [rsp + rdx*2 + 0x40], cx
lea edx, [rax - 1]
cmp word [rsp + rdx*2 + 0x40], 0x5c
je 0x6df140
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
je 0x6df124
mov rdx, qword [rsi]
mov ecx, edx
cmp edx, eax
jl 0x6df16e
cmp rdx, 0x7fffffff
mov eax, 0x7fffffff
mov r8, rbx
mov qword [rsp + 0x38], 0
cmova ecx, eax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
call rbp
test eax, eax
je 0x6df124
sub eax, 1
cdqe
mov qword [rsi], rax
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.006bf1f0
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 3
je 0x6df151
xor eax, eax
mov word [rsp + rdx*2 + 0x40], ax
jmp 0x6df081
cmp word [rsp + 0x42], 0x3a
jne 0x6df145
jmp 0x6df081
mov eax, 0xfffff019
jmp 0x6df118
mov eax, 0xfffff01a
jmp 0x6df118
cdqe
mov qword [rsi], rax
mov eax, 0xfffff024
jmp 0x6df118
Function at 0x6df390
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
lea rsi, [rsp + 0x20]
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.DLL_Process32First
test eax, eax
jne 0x6df3df
jmp 0x6df400
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x6df400
cmp dword [rsp + 0x28], edi
jne 0x6df3d0
mov esi, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
mov esi, 0xffffffff
jmp 0x6df3e9

Function at 0x6e0870
Capabilities:
Get common file path
Get session user name

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov rbx, rcx
test rcx, rcx
je 0x6e09da
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6e0973
lea rsi, [rsp + 0x34]
lea rdi, [rsp + 0x250]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
test eax, eax
jne 0x6e0901
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp ebx, 0x7a
je 0x6e09d0
mov ecx, ebx
call fcn.006bf1f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x6e0990
mov qword [rbx + 0x18], 0
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, rdi
call fcn.006e01f0
test eax, eax
jne 0x6e08f5
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.006e01f0
test eax, eax
jne 0x6e09b0
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0
jmp 0x6e08f5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, eax
call fcn.006bf1f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
je 0x6e09d0
mov ecx, eax
call fcn.006bf1f0
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.006ba750
mov eax, dword [rsp + 0x2c]
jmp 0x6e08f5
mov eax, 0xfffff027
jmp 0x6e08f5
mov eax, 0xfffff019
jmp 0x6e08f5
Function at 0x6e0bb0
Capabilities:
Query environment variable

Disassembly:
push r12
mov eax, 0x10050
push rbp
push rdi
push rsi
push rbx
call fcn.00700bd0
sub rsp, rax
test rdx, rdx
mov rbp, rdx
mov rbx, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x6e0d30
test rcx, rcx
je 0x6e0d30
cmp qword [r8], 0
je 0x6e0d30
lea r8, [rsp + 0x48]
mov edx, 0xffffffff
call fcn.006e07a0
mov esi, eax
test eax, eax
je 0x6e0c15
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea r12, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8d, 0x7fff
mov rdx, r12
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x48]
mov edi, eax
call fcn.006ba750
cmp rdi, 0x7ffe
ja 0x6e0c72
test rdi, rdi
jne 0x6e0c8c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xcb
je 0x6e0d3a
mov ecx, eax
call fcn.006bf1f0
mov esi, eax
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0x5ce
lea rdx, str.src_win_util.c
lea rcx, str.len___MAX_ENV_VAR_LENGTH
call qword [sym.imp.msvcrt.dll__assert]
xor edx, edx
mov r9d, 0xffffffff
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov rdi, qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x6e0d20
mov rdx, qword [rbx]
mov eax, eax
cmp rax, rdx
ja 0x6e0d44
mov dword [rsp + 0x28], edx
mov r9d, 0xffffffff
xor edx, edx
mov r8, r12
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbp
call rdi
test eax, eax
je 0x6e0d20
sub eax, 1
mov qword [rbx], rax
mov eax, esi
add rsp, 0x10050
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x6e0c59
mov esi, 0xfffff019
jmp 0x6e0c05
mov esi, 0xfffff026
jmp 0x6e0c05
mov qword [rbx], rax
mov esi, 0xfffff024
jmp 0x6e0c05
Function at 0x6e1610
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, str.ntdll.dll
mov rdi, qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call rdi
mov rsi, rax
test rax, rax
je 0x6e17b4
lea rdx, str.RtlGetVersion
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.DLL_GetProcAddress]
call rbx
lea rdx, str.RtlNtStatusToDosError
mov rcx, rsi
mov qword [0x00de3890], rax
call rbx
mov qword [0x00de38b8], rax
test rax, rax
je 0x6e17a0
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
mov qword [0x00de3888], rax
test rax, rax
je 0x6e17a0
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
mov qword [0x00de38a8], rax
test rax, rax
je 0x6e17a0
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
mov qword [0x00de3878], rax
test rax, rax
je 0x6e17a0
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
mov qword [0x00de3870], rax
test rax, rax
je 0x6e17a0
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x00de3870], 0
mov qword [0x00de38b0], rax
je 0x6e17a0
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
mov qword [0x00de38a0], rax
test rax, rax
je 0x6e17a0
lea rdx, str.NtQueryInformationProcess
mov rcx, rsi
call rbx
mov qword [0x00de3898], rax
test rax, rax
je 0x6e17a0
lea rcx, str.kernel32.dll
call rdi
test rax, rax
je 0x6e17b4
mov rcx, rax
lea rdx, str.GetQueuedCompletionStatusEx
call rbx
lea rcx, str.powrprof.dll
mov rsi, qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov qword [0x00de38c0], rax
call rsi
test rax, rax
je 0x6e1777
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x00de38c8], rax
lea rcx, str.user32.dll
call rsi
test rax, rax
je 0x6e1798
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x00de3880], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.006bf130
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.006bf130
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6e18a0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
xor edx, edx
lea r8, [0x00de38e0]
lea rcx, str.0.0.0.0
call fcn.006bd180
test eax, eax
jne 0x806180
xor edx, edx
lea r8, [0x00de38f0]
lea rcx, [0x00af5188]
call fcn.006bd1d0
test eax, eax
jne 0x806180
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x6e1a04
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x6e1a92
xor r8d, r8d
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x6e1a10
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6e1ab4
test byte [rsp + 0x1e2], 2
jne 0x6e197d
mov dword [0x00de38d4], 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x6e1ac8
xor r8d, r8d
mov edx, 1
mov ecx, 0x17
call rsi
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x6e1a50
lea rax, [rsp + 0x3c]
mov r8d, 0x2005
mov edx, 0xffff
mov dword [rsp + 0x3c], 0x274
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x6e1aa0
test byte [rsp + 0x1e2], 2
jne 0x6e19f6
mov dword [0x00de38d0], 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x6e1a7e
add rsp, 0x468
pop rbx
pop rsi
ret
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x6e198f
sub eax, 0x273e
cmp eax, 1
jbe 0x6e198f
call rbx
lea rdx, str.socket
mov ecx, eax
call fcn.006bf130
nop word cs:[rax + rax]
mov rbx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rbx
lea edx, [rax - 0x273b]
cmp edx, 1
jbe 0x6e1a04
sub eax, 0x273e
cmp eax, 1
jbe 0x6e1a04
call rbx
lea rdx, str.socket
mov ecx, eax
call fcn.006bf130
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.006bf130
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.006bf130
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.006bf130
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.getsockopt
mov ecx, eax
call fcn.006bf130
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.closesocket
mov ecx, eax
call fcn.006bf130
nop dword [rax]