joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450a50
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2e8
xor r9d, r9d
lea rax, [rsp + 0x54]
mov rbp, r8
mov rsi, rcx
xor r8d, r8d
mov rbx, rdx
mov qword [rsp + 0x58], 0xffffffffffffffff
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 8
mov edx, 0x48000022
mov qword [rsp + 0x20], rax
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x450aca
mov rbp, qword [rsp + 0x58]
lea rax, [rbp - 1]
cmp rax, 0xfffffffffffffffd
ja 0x450c05
lea rax, [rsi + 0x10]
mov qword [rbx + 8], rsi
mov dword [rbx + 0x10], 8
mov dword [rbx + 0x58], 0x20
lea rdi, [rsp + 0x60]
mov rcx, rbp
mov qword [rbx + 0x20], rax
mov rdx, qword [rsi + 0x18]
lea rax, [rbx + 0x20]
mov r9, rdi
mov r8d, 0x2005
mov qword [rbx + 0x28], rdx
mov qword [rdx], rax
mov edx, 0xffff
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x50]
mov qword [rbx + 0x68], rbp
mov dword [rbx + 0x30], 0xffffffff
mov byte [rbx + 0x19c], 0
mov dword [rsp + 0x50], 0x274
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
mov ebp, eax
jne 0x450bf4
lea rdx, [0x004b1b20]
xor eax, eax
mov r9d, 0xffffffff
mov rcx, qword [rdi + 0x14]
mov r8, qword [rdi + 0x1c]
xor rcx, qword [rdx]
xor r8, qword [rdx + 8]
or r8, rcx
cmove r9d, eax
add eax, 1
add rdx, 0x10
cmp eax, 3
jne 0x450b50
cmp r9d, 0xffffffff
je 0x450c44
movsxd r9, r9d
lea r13, [rsi + r9*8]
mov r12, qword [r13 + 0x90]
test r12, r12
je 0x450c50
cmp r12, 0xffffffffffffffff
je 0x450c44
mov qword [rbx + 0x70], r12
xor eax, eax
mov dword [rbx + 0xc0], 0xc
mov qword [rbx + 0xf8], 0
mov qword [rbx + 0xb8], rbx
mov word [rbx + 0x198], ax
mov dword [rbx + 0x130], 0xc
mov qword [rbx + 0x168], 0
mov qword [rbx + 0x128], rbx
mov eax, ebp
add rsp, 0x2e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00441a00
mov ebp, eax
jmp 0x450be2
lea rdx, str.src_win_poll.c
lea rcx, str.base_socket___0__base_socket___INVALID_SOCKET
mov r8d, 0x21e
call fcn.00480c40
mov rbp, qword [rsp + 0x58]
jmp 0x450aca
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [r13 + 0x90], 0xffffffffffffffff
or dword [rbx + 0x58], 0x2000000
jmp 0x450ba1
mov rsi, qword [rsi + 0x38]
mov r9, rdi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov r8d, dword [rsp + 0xbc]
mov edx, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xac]
call qword [sym.imp.WS2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x450cd0
xor r8d, r8d
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x450c30
xor r9d, r9d
mov r8, r12
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x450c30
mov qword [r13 + 0x90], r12
jmp 0x450b9d
mov qword [r13 + 0x90], rax
jmp 0x450c44
Function at 0x451450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa8]
cmp rdx, 2
mov r15, rcx
mov rbx, rdx
mov r14, r8
mov rbp, r9
jbe 0x451584
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x451624
cmp ax, 0x2f
je 0x4515c0
cmp ax, 0x5c
je 0x4515c0
cmp rbx, 1
jbe 0x4514b9
cmp word [r15 + 2], 0x3a
je 0x451660
lea rcx, [rbp + r12 + 4]
add rcx, r13
add rcx, rbx
add rcx, rcx
call fcn.0043ebc0
mov rdx, qword [rsp + 0xa0]
mov r8, r13
mov rcx, rax
mov rsi, rax
lea rdi, [rsi + r13*2]
call sub.msvcrt.dll_wcsncpy
test r13, r13
jne 0x4515f7
mov rcx, rdi
mov r8, rbx
mov rdx, r15
call sub.msvcrt.dll_wcsncpy
test rbx, rbx
lea rdi, [rdi + rbx*2]
jne 0x451595
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
test r12, r12
lea rbx, [rdi + rbp*2]
je 0x451551
test rbp, rbp
je 0x45153a
cmp word [rbx - 2], 0x2e
je 0x45153a
mov edx, 0x2e
add rbx, 2
mov word [rbx - 2], dx
mov rdx, qword [rsp + 0x90]
mov rcx, rbx
lea rbx, [rbx + r12*2]
mov r8, r12
call sub.msvcrt.dll_wcsncpy
xor eax, eax
mov rcx, rsi
mov word [rbx], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4516b0
test al, 0x10
jne 0x4516b0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x4514b9
movzx eax, word [rcx]
jmp 0x451493
movzx edx, word [rdi - 2]
lea rcx, [0x004b1b7e]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x45150a
mov ecx, 0x5c
add rdi, 2
mov word [rdi - 2], cx
jmp 0x45150a
mov edi, 4
mov r13d, 2
lea rcx, [rbp + r12 + 4]
add rcx, rbx
add rcx, r13
add rcx, rcx
call fcn.0043ebc0
mov rdx, qword [rsp + 0xa0]
mov rsi, rax
mov r8, r13
mov rcx, rax
add rdi, rsi
call sub.msvcrt.dll_wcsncpy
movzx edx, word [rdi - 2]
lea rcx, [0x004b1b7e]
call sub.msvcrt.dll_wcsrchr
test rax, rax
jne 0x4514ef
mov r8d, 0x5c
add rdi, 2
mov word [rdi - 2], r8w
jmp 0x4514ef
cmp word [rcx + 2], 0x5c
jne 0x4515c0
lea rcx, [rbp + r12 + 4]
add rcx, rbx
add rcx, rcx
call fcn.0043ebc0
mov rdx, qword [rsp + 0xa0]
mov rdi, rax
xor r8d, r8d
mov rcx, rax
mov rsi, rdi
call sub.msvcrt.dll_wcsncpy
jmp 0x4514ef
cmp rbx, 2
je 0x451677
movzx eax, word [r15 + 4]
cmp ax, 0x2f
je 0x45162b
cmp ax, 0x5c
je 0x45162b
cmp r13, 1
jbe 0x45162b
mov r8d, 2
mov rdx, r15
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x45162b
add r15, 4
sub rbx, 2
lea rdi, [r13 + r13]
jmp 0x4515cb
mov rcx, rsi
xor esi, esi
call fcn.0043ebd0
jmp 0x451570
Function at 0x451900
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp edx, 2
mov rsi, rcx
mov ebx, edx
je 0x451960
jg 0x451940
test edx, edx
jne 0x45194a
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x451991
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
cmp edx, 9
je 0x451960
cmp edx, 0xf
je 0x451960
mov eax, 0xfffff02a
add rsp, 0x38
pop rbx
pop rsi
ret
mov edx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, eax
xor eax, eax
test edx, edx
jne 0x451935
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ebx, eax
je 0x4519a5
mov ecx, ebx
call fcn.00441a00
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00441a00
add rsp, 0x38
pop rbx
pop rsi
ret
lea rdx, [rsp + 0x2c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x451983
cmp dword [rsp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x451935
jmp 0x451983
Function at 0x4544e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x454550
test eax, 0x10000
je 0x454560
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x454540
cmp r9d, 0xe
je 0x454530
cmp r9d, 7
mov eax, 0xfffff008
je 0x45452b
lea rdx, str.src_win_stream.c
lea rcx, [0x004b22b1]
mov r8d, 0xc8
call fcn.00480c40
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.0045dbe0
add rsp, 0x28
jmp 0x456400
mov eax, 0xfffff00d
jmp 0x45452b
mov eax, 0xfffff031
jmp 0x45452b
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x456470
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
mov edx, dword [rsp + 0x4c]
je 0x456450
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00441a00
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x456443
Function at 0x454d70
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x58], edx
mov dword [rsp + 0x60], r8d
mov rsi, rcx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x58]
mov r8d, 8
mov edx, 0xffff
call rbx
cmp eax, 0xffffffff
je 0x454de2
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x454dc0
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x60]
mov r8d, 3
mov edx, 6
mov rcx, rsi
call rbx
cmp eax, 0xffffffff
jne 0x454db0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x454df0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
cmp qword [r8], 0xffffffffffffffff
mov eax, 0xfffff00e
mov rbp, rcx
mov rdi, rdx
mov rsi, r8
mov rbx, r9
mov dword [rsp + 0x48], 1
jne 0x454ef7
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rcx, r9
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x454f10
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x454f00
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x454f80
mov edx, dword [rdi]
cmp dword [rsp + 0xa0], 0x17
je 0x454f70
mov rax, qword [0x004ba910]
mov ecx, dword [rax]
mov rax, qword [0x004ba8a0]
mov rax, qword [rax]
test rax, rax
je 0x454ea3
mov r8d, edx
and r8d, 0x100000
or r8d, ecx
je 0x454f20
test edx, 0x2000000
jne 0x454fa0
test edx, 0x4000000
jne 0x454f41
cmp dword [rsp + 0xa0], 0x17
mov qword [rsi], rbx
je 0x454f60
xor eax, eax
and edx, 0x1000000
je 0x454ef7
lea rdx, str.src_win_tcp.c
lea rcx, [0x004b23e8]
mov r8d, 0x96
mov dword [rsp + 0x3c], eax
call fcn.00480c40
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 3
mov rcx, rbx
call rax
test eax, eax
je 0x454fe5
mov edx, dword [rdi]
or edx, 0x40000
mov dword [rdi], edx
jmp 0x454ea3
mov r8d, 0x3c
mov edx, 1
mov rcx, rbx
call fcn.00454d70
test eax, eax
jne 0x454ef7
mov edx, dword [rdi]
jmp 0x454ebb
or edx, 0x1000000
xor eax, eax
mov dword [rdi], edx
jmp 0x454ef7
mov rax, qword [0x004ba920]
mov ecx, dword [rax]
jmp 0x454e85
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x454f00
mov edx, dword [rdi]
or edx, 0x100000
mov dword [rdi], edx
jmp 0x454e6e
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x4c]
mov r8d, 1
mov edx, 6
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x454fd5
mov edx, dword [rdi]
jmp 0x454eaf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x454ef7
jmp 0x454fce
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbp
cmp eax, 1
jne 0x455000
mov edx, dword [rdi]
jmp 0x454ea3
call rbp
jmp 0x454ef7
Function at 0x455010
Capabilities:
Set socket configuration

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx eax, word [rdx]
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov rsi, rdx
mov r12d, r8d
mov ebp, r9d
cmp rcx, 0xffffffffffffffff
je 0x455070
cmp ax, 0x17
je 0x4550e0
mov r8d, r12d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x455120
or dword [rbx + 0x58], 0x200
xor edi, edi
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r9b, 1
je 0x455081
cmp ax, 0x17
mov edi, 0x57
jne 0x455060
xor r8d, r8d
movzx ecx, ax
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x455111
movzx eax, word [rsi]
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x58]
lea r8, [rbx + 0x110]
mov dword [rsp + 0x28], 0
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.00454df0
test eax, eax
mov edi, eax
jne 0x455142
movzx eax, word [rsi]
mov rcx, qword [rbx + 0x110]
cmp ax, 0x17
jne 0x455042
nop dword [rax + rax]
and ebp, 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov dword [rsp + 0x3c], ebp
mov r8d, 0x1b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x110]
jmp 0x455042
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
jmp 0x455060
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
mov edi, eax
jne 0x455060
mov dword [rbx + 0x118], 0x2740
jmp 0x455057
mov rcx, r13
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x455060

Function at 0x455ef0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x110]
cmp rax, 0xffffffffffffffff
je 0x455f31
mov ecx, dword [rcx + 0x118]
test ecx, ecx
jne 0x455f28
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x455f20
add rsp, 0x28
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
add rsp, 0x28
jmp fcn.00441a00
mov eax, 0xfffff019
jmp 0x455f18
Function at 0x456400
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x58]
test al, 1
jne 0x454550
test eax, 0x10000
je 0x454560
mov r9d, dword [rcx + 0x10]
cmp r9d, 0xc
je 0x454540
cmp r9d, 0xe
je 0x454530
cmp r9d, 7
mov eax, 0xfffff008
je 0x45452b
lea rdx, str.src_win_stream.c
lea rcx, [0x004b22b1]
mov r8d, 0xc8
call fcn.00480c40
mov eax, 0xfffff02a
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.0045dbe0
add rsp, 0x28
jmp 0x456400
mov eax, 0xfffff00d
jmp 0x45452b
mov eax, 0xfffff031
jmp 0x45452b
sub rsp, 0x58
mov eax, dword [rcx + 0x100]
test eax, eax
jne 0x456470
mov rcx, qword [rcx + 0x110]
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
mov edx, dword [rsp + 0x4c]
je 0x456450
mov eax, edx
add rsp, 0x58
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00441a00
mov edx, eax
mov eax, edx
add rsp, 0x58
ret
mov edx, 0xfffff008
jmp 0x456443
Function at 0x456b90
Capabilities:
Set socket configuration

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x456bbf
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
mov r8d, 0x45d
call fcn.00480c40
mov rcx, qword [rsi + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x456c40
mov eax, dword [rsi + 0x40]
test eax, eax
js 0x456bfc
mov dword [rsp + 0x20], 8
lea r9, [rbx + 0x110]
mov r8d, 0x700b
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x456cf4
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
test byte [rbx + 0x59], 8
mov qword [rsi + 0x70], 0xffffffffffffffff
jne 0x456d25
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x456cb0
sub eax, 1
mov edx, dword [rbx + 0x58]
test eax, eax
mov dword [rbx + 0x78], eax
jne 0x456c35
test dl, 1
jne 0x456cd1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x58]
test ah, 8
je 0x456c14
mov edx, eax
and dh, 0xf7
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x456d35
test al, 1
jne 0x456c80
test al, 0x40
je 0x456c80
mov edx, eax
and edx, 0xfffff7bf
test al, 0x20
mov dword [rbx + 0x58], edx
je 0x456c80
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
nop dword [rax]
cmp qword [rbx + 0x100], 0
je 0x456c14
mov rcx, qword [rsi + 0x40]
call fcn.004622b0
mov ecx, eax
mov rsi, qword [rbx + 0x100]
call fcn.00441a00
mov rcx, rbx
mov edx, eax
call rsi
jmp 0x456c14
lea rdx, str.src_win_tcp.c
lea rcx, [0x004b24af]
mov r8d, 0x485
call fcn.00480c40
mov eax, dword [rbx + 0x78]
jmp 0x456c1f
test dl, 8
jne 0x456c35
mov rax, qword [rdi + 0x50]
or edx, 8
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0x130]
mov qword [rsi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rsi
test rax, rax
je 0x456c14
xor edx, edx
mov rcx, rbx
call rax
jmp 0x456c14
mov rdx, rsi
mov rcx, rbx
call fcn.00454710
jmp 0x456c14
jns 0x456c80
lea rdx, str.src_win_tcp.c
lea rcx, [0x004b25e9]
mov r8d, 0x466
call fcn.00480c40
jmp 0x456c80
Function at 0x456d60
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp dword [rdx + 0x10], 0xc
mov rdi, rcx
mov rbx, rdx
mov rsi, r8
je 0x456d90
lea rdx, str.src_win_tcp.c
lea rcx, str.handle__type__UV_TCP
mov r8d, 0x48d
call fcn.00480c40
sub dword [rbx + 0x7c], 1
jne 0x456ea0
mov eax, dword [rbx + 0x58]
test al, 1
je 0x456ef0
lea rax, [rdi + 0x20]
cmp qword [rdi + 0x20], rax
je 0x456ecd
mov rax, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov qword [rax], rdx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov qword [rax + 8], rdx
mov rcx, qword [rsi + 0x40]
test ecx, ecx
js 0x456f20
xor r9d, r9d
mov rcx, qword [rbx + 0x110]
mov dword [rsp + 0x20], 0
mov r8d, 0x7010
mov edx, 0xffff
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x456f15
mov edx, dword [rbx + 0x58]
mov dword [rbx + 0x100], 0
mov dword [rbx + 0x88], 0xe
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0xf0], 0
mov qword [rbx + 0xf8], 0xffffffffffffffff
or edx, 0x19000
mov qword [rbx + 0x80], rbx
mov qword [rbx + 0x108], 0
mov dword [rbx + 0x58], edx
add dword [rdi + 0xa8], 1
mov ecx, eax
mov rbp, qword [rsi + 0x70]
call fcn.00441a00
mov rcx, rsi
mov edx, eax
call rbp
mov eax, dword [rbx + 0x78]
test eax, eax
je 0x456f30
sub eax, 1
mov edx, dword [rbx + 0x58]
test eax, eax
mov dword [rbx + 0x78], eax
jne 0x456e8e
test dl, 1
jne 0x456f51
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
jns 0x456da5
lea rdx, str.src_win_tcp.c
lea rcx, [0x004b2478]
mov r8d, 0x48f
call fcn.00480c40
lea rax, [rdi + 0x20]
cmp qword [rdi + 0x20], rax
jne 0x456db3
lea rdx, str.src_win_tcp.c
lea rcx, [0x004b2493]
mov r8d, 0x48f
call fcn.00480c40
jmp 0x456db3
test al, 0x40
je 0x456da5
mov edx, eax
and edx, 0xffffffbf
test al, 0x20
mov dword [rbx + 0x58], edx
je 0x456da5
mov rax, qword [rbx + 8]
sub dword [rax + 8], 1
jmp 0x456da5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x456e5b
call fcn.004622b0
jmp 0x456e5b
lea rdx, str.src_win_tcp.c
lea rcx, [0x004b24af]
mov r8d, 0x4a3
call fcn.00480c40
mov eax, dword [rbx + 0x78]
jmp 0x456e78
test dl, 8
jne 0x456e8e
mov rax, qword [rdi + 0x50]
or edx, 8
mov dword [rbx + 0x58], edx
mov qword [rbx + 0x50], rax
mov qword [rdi + 0x50], rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x4570b0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
mov rcx, qword [rcx + 0x110]
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x4570f1
test esi, esi
mov eax, dword [rbx + 0x58]
jne 0x4570e0
and eax, 0xfdffffff
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
or eax, 0x2000000
mov dword [rbx + 0x58], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x3c]
mov r8d, 1
mov edx, 6
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x4570c8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x4570d9
jmp 0x4570c8
Function at 0x457c20
Capabilities:
Create thread
Resume thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rcx
mov ecx, 0x18
mov rdi, rdx
mov rsi, r8
call fcn.0043ebc0
test rax, rax
mov rbx, rax
je 0x457d04
mov qword [rax], rdi
mov qword [rax + 8], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rax
lea r8, [0x004586f0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
jne 0x457cb0
call qword [sym.imp.msvcrt.dll__errno]
mov esi, dword [rax]
mov rcx, rbx
call fcn.0043ebd0
cmp esi, 0xb
je 0x457ce0
jle 0x457cf0
cmp esi, 0xd
je 0x457cd0
cmp esi, 0x16
jne 0x457cf4
mov esi, 0xfffff019
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor esi, esi
mov qword [rbp], rax
mov rcx, rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xfffff004
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xfffff008
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
test esi, esi
je 0x457cc3
mov esi, 0xfffff01a
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov esi, 0xfffff027
jmp 0x457cc3

Function at 0x4586d0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4586e5
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
call fcn.0043ebd0
cmp byte [0x004cb830], 0
jne 0x458723
lea rdx, [0x00457be0]
lea rcx, [0x004cb830]
call fcn.00457a40
lea rcx, [0x004cb840]
mov rdx, rdi
call fcn.004586d0
mov rcx, rsi
call rbx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x459f40
Capabilities:
Manipulate console buffer

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rdi, qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx r12d, byte [rsp + 0xc0]
mov rsi, rcx
mov r14d, edx
mov r13d, r9d
movzx ebp, r8b
lea rbx, [rsp + 0x30]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x459fb1
mov r9d, r13d
mov r8d, ebp
mov edx, r14d
mov rcx, rbx
mov dword [rsp + 0x20], r12d
call fcn.00459d10
mov rcx, qword [rsi + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x459fd3
call r15
cmp eax, 0x57
jne 0x459ff0
mov rcx, qword [rsi + 0x110]
mov rdx, rbx
call rdi
test eax, eax
jne 0x459f80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
mov dword [rdx], eax
jmp 0x459f80
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call r15
mov rdi, qword [rsp + 0xc8]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x459fd5