joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b490
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push rdi
sub rsp, 0x880
mov rax, qword [0x1400e6470]
xor rax, rsp
mov qword [rsp + 0x870], rax
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8, qword [0x1400e4588]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400855d4
lea r8, [0x1400e1c20]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140084be4
lea rdx, str.O:BAD:PAI_A_OICI_FA___SY__A_OICI_FA___BA__A_OICI_0x1200a9___AU_
lea rcx, [rsp + 0x30]
call fcn.14005cdb0
test eax, eax
jge 0x14005b51f
lea rdx, [rsp + 0x30]
lea rcx, [0x1400e1cb0]
call fcn.14004a1f0
mov ecx, 0xff
call fcn.1400829a0
xor eax, eax
mov word [rsp + 0x450], ax
lea rax, [rsp + 0x452]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x450]
call fcn.140084be4
lea r8, str.logs
mov edx, 0x104
lea rcx, [rsp + 0x450]
call fcn.140084be4
lea rdx, str.O:BAD:PAI_A_OICI_FA___SY__A_OICI_FA___BA_
lea rcx, [rsp + 0x450]
call fcn.14005cdb0
test eax, eax
jge 0x14005b5a3
lea rdx, [rsp + 0x450]
lea rcx, str.failed_to_create__s
call fcn.14004a1f0
mov ecx, 0xff
call fcn.1400829a0
xor eax, eax
mov word [rsp + 0x240], ax
lea rax, [rsp + 0x242]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.140084be4
lea r8, str._sshd_config
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.140084be4
lea rcx, [rsp + 0x240]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005b6a1
xor eax, eax
mov word [rsp + 0x660], ax
lea rax, [rsp + 0x662]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rax, str.sshd_config_default
mov qword [rsp + 0x20], rax
mov r9, qword [0x1400e4530]
lea r8, str._S_s
mov edx, 0x104
lea rcx, [rsp + 0x660]
call fcn.140054bc0
mov r8d, 1
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x660]
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
test eax, eax
jne 0x14005b6a1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x660]
lea rcx, str.Failed_to_copy__s_to__s__error:_d
call fcn.14004a1f0
mov ecx, 0xff
call fcn.1400829a0
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140075860
add rsp, 0x880
pop rdi
ret
Function at 0x14005b6c0
Capabilities:
Add user account
Create process on windows
Create process suspended
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
sub rsp, 0x558
mov rax, qword [0x1400e6470]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov dword [rsp + 0x54], 0
xor eax, eax
mov word [rsp + 0x120], ax
lea rax, [rsp + 0x122]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
call fcn.14005bc70
test eax, eax
je 0x14005b90a
mov qword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [0x1400e1bb0]
xor ecx, ecx
call sub.samcli.dll_NetUserGetInfo
test eax, eax
je 0x14005b83a
mov rcx, qword [rsp + 0x58]
call sub.netutils.dll_NetApiBufferFree
lea rax, [0x1400e1bc0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x8c], 1
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 0x10001
mov qword [rsp + 0xa8], 0
mov r9d, 2
mov r8d, 0x200
lea rdx, [rsp + 0x120]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
je 0x14005b7cb
lea rcx, str.failed_to_generate_sshd_user_temporary_password
call fcn.14004a1f0
mov ecx, 0xff
call fcn.1400829a0
mov dword [rsp + 0x50], 0
jmp 0x14005b7df
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x100
jge 0x14005b812
movsxd rax, dword [rsp + 0x50]
movzx eax, word [rsp + rax*2 + 0x120]
cdq
mov ecx, 0x5e
idiv ecx
mov eax, edx
add eax, 0x21
movsxd rcx, dword [rsp + 0x50]
mov word [rsp + rcx*2 + 0x120], ax
jmp 0x14005b7d5
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x78]
mov edx, 1
xor ecx, ecx
call sub.samcli.dll_NetUserAdd
mov edx, 0x202
lea rcx, [rsp + 0x120]
call fcn.1400358e0
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rsp + 0xb0], WSAGetLastError
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov eax, 2
imul rax, rax, 0xd
add rax, 2
lea rcx, [rsp + 0x330]
lea rdx, str.ssh_keygen__A
mov rdi, rcx
mov rsi, rdx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], setsockopt
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x330]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
je 0x14005b90a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.140075860
add rsp, 0x558
pop rdi
pop rsi
ret
Function at 0x14005cdb0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005ce94
mov qword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x38], 0
xor r9d, r9d
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x58]
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x14005ce33
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400e1f00]
call fcn.140002d00
mov eax, 0xffffffff
jmp 0x14005ce96
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_IsValidSecurityDescriptor]
test eax, eax
jne 0x14005ce55
lea rcx, [0x1400e1f50]
call fcn.140002d00
mov eax, 0xffffffff
jmp 0x14005ce96
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x14005ce94
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x50]
lea rcx, str.Failed_to_create_directory:_ls_error:_d
call fcn.140002d00
mov eax, 0xffffffff
jmp 0x14005ce96
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14005ed40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x28], 0xef
mov byte [rsp + 0x29], 0xbb
mov byte [rsp + 0x2a], 0xbf
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x38], 0
cmp qword [rsp + 0x78], 0
je 0x14005edae
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x78]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x14005edc0
call fcn.1400825b0
mov dword [rax], 0x81
xor eax, eax
jmp 0x14005efc6
cmp qword [rsp + 0x70], 0
jne 0x14005eded
call fcn.1400825b0
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1400825b0
mov edx, dword [rax]
lea rcx, str.fopen___ERROR:_d
call fcn.140002e50
xor eax, eax
jmp 0x14005efc6
mov r8d, 0xa
lea rdx, [0x1400e2780]
mov rcx, qword [rsp + 0x70]
call fcn.1400780e0
test eax, eax
jne 0x14005ee23
mov dword [rsp + 0x38], 1
lea rcx, [0x1400e244c]
call fcn.14005f460
mov qword [rsp + 0x30], rax
jmp 0x14005ee32
mov rcx, qword [rsp + 0x70]
call fcn.14005e6a0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x78]
call fcn.14005f460
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x30], 0
je 0x14005ee51
cmp qword [rsp + 0x40], 0
jne 0x14005ee56
jmp 0x14005ef9d
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140086c9c
test eax, eax
jne 0x14005ee76
cmp qword [rsp + 0x20], 0
jne 0x14005ee94
call fcn.1400825b0
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x30]
lea rcx, str.Failed_to_open_file:_S_error:_d
call fcn.140002e50
jmp 0x14005ef9d
cmp qword [0x1400e7a10], 0
je 0x14005eefd
cmp dword [rsp + 0x38], 0
jne 0x14005eefd
mov rcx, qword [rsp + 0x20]
call fcn.140086cf4
mov ecx, eax
call fcn.140087ba8
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14006b3f0
test eax, eax
jne 0x14005eefd
mov rdx, qword [rsp + 0x70]
lea rcx, [0x1400e27c8]
call fcn.140002e50
mov rcx, qword [rsp + 0x20]
call fcn.1400781e4
mov qword [rsp + 0x20], 0
call fcn.1400825b0
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x14005ef9d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
movsx eax, byte [rcx + rax]
cmp eax, 0x77
jne 0x14005ef2a
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.140087290
cmp eax, 9
je 0x14005ef2a
jmp 0x14005ef9d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
movsx eax, byte [rcx + rax]
cmp eax, 0x72
jne 0x14005ef9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.140087290
cmp eax, 9
je 0x14005ef9d
mov r9, qword [rsp + 0x20]
mov r8d, 1
mov edx, 3
lea rcx, [rsp + 0x48]
call fcn.140086fb0
cmp rax, 1
jne 0x14005ef8e
mov r8d, 3
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.140076630
test eax, eax
je 0x14005ef9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call fcn.140087290
cmp qword [rsp + 0x30], 0
je 0x14005efaf
mov rcx, qword [rsp + 0x30]
call fcn.140077f70
cmp qword [rsp + 0x40], 0
je 0x14005efc1
mov rcx, qword [rsp + 0x40]
call fcn.140077f70
mov rax, qword [rsp + 0x20]
add rsp, 0x68
ret
Function at 0x140060e80
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x34], 0x20101
cmp dword [0x1400e7d0c], 0
je 0x140060ebd
mov rax, qword [0x1400e7d10]
jmp 0x140060ff5
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x1400e3910]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140060fbf
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400e3938]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140060fbf
movsxd rax, dword [rsp + 0x30]
mov rcx, rax
call fcn.140077f84
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140060f4b
lea rdx, str.get_custom_lsa_package
lea rcx, str._s:_out_of_memory
call fcn.14000c3a0
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LSAAuthenticationPackage
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140060fbf
mov rcx, qword [rsp + 0x38]
call fcn.14005f390
mov qword [0x1400e7d10], rax
cmp qword [0x1400e7d10], 0
jne 0x140060fbf
mov rdx, qword [rsp + 0x38]
lea rcx, str.utf16_to_utf8_failed_to_convert_lsa_auth_pkg_w:_ls
call fcn.14000c3a0
cmp qword [rsp + 0x38], 0
je 0x140060fd1
mov rcx, qword [rsp + 0x38]
call fcn.140077f70
cmp qword [rsp + 0x40], 0
je 0x140060fe4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [0x1400e7d0c], 1
mov rax, qword [0x1400e7d10]
add rsp, 0x50
pop rdi
ret
Function at 0x1400614a0
Capabilities:
Impersonate user

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0
call fcn.14005bc70
test eax, eax
jne 0x1400614d7
lea rcx, str.Not_running_as_SYSTEM:_skipping_loading_user_profile
call fcn.140002df0
xor eax, eax
jmp 0x14006163d
mov rcx, qword [rsp + 0x98]
call fcn.14005f460
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140061507
lea rcx, [0x1400e32c0]
call fcn.14000c3a0
mov eax, 0xffffffff
jmp 0x14006163d
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0
mov dx, 0x5c
mov rcx, qword [rsp + 0x28]
call fcn.140076440
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140061557
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, qword [rsp + 0x30]
mov word [rcx], ax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x34
rep stosb byte [rdi], al
mov dword [rsp + 0x40], gethostname
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov edx, 1
lea rcx, [0x1400e32d0]
call fcn.14005fcb0
mov edx, 1
lea rcx, [0x1400e32e8]
call fcn.14005fcb0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x14006160d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, str.load_user_profile
lea rcx, str._s:_LoadUserProfileW___failed_for_user__S_with_error__d.
call fcn.140002e50
xor edx, edx
lea rcx, str.SeBackupPrivilege
call fcn.14005fcb0
xor edx, edx
lea rcx, str.SeRestorePrivilege
call fcn.14005fcb0
cmp qword [rsp + 0x20], 0
je 0x14006163b
mov rcx, qword [rsp + 0x20]
call fcn.140077f70
xor eax, eax
add rsp, 0x80
pop rdi
ret
Function at 0x140066c90
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
cmp dword [rsp + 0x40], eax
jne 0x140066cb3
mov ecx, dword [rsp + 0x48]
call fcn.140066550
jmp 0x140066d1d
mov dword [rsp + 0x24], 0xffffffff
mov dword [rsp + 0x20], 0
jmp 0x140066ccf
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [0x1400ee180]
cmp dword [rsp + 0x20], eax
jge 0x140066cfc
movsxd rax, dword [rsp + 0x20]
lea rcx, [0x1400ed980]
mov edx, dword [rsp + 0x40]
cmp dword [rcx + rax*4], edx
jne 0x140066cfa
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
jmp 0x140066cfc
jmp 0x140066cc5
cmp dword [rsp + 0x24], 0xffffffff
je 0x140066d1b
movsxd rax, dword [rsp + 0x24]
lea rcx, [0x1400ec980]
xor edx, edx
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor eax, eax
add rsp, 0x38
ret
Function at 0x140067370
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], 0
cmp qword [rsp + 0x78], 0
je 0x1400673a6
mov rax, qword [rsp + 0x78]
mov dword [rax], 0
mov dword [rsp + 0x50], 0x11800
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x40], 0
jne 0x14006741b
mov eax, dword [rsp + 0x50]
mov ecx, eax
call fcn.140077f84
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400673ff
call fcn.1400825b0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
call fcn.1400825b0
mov r8, qword [rsp + 0x70]
mov edx, dword [rax]
lea rcx, str.WSARecv___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067523
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x40], rcx
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x48], ecx
jmp 0x140067429
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x58], rax
cmp dword [rsp + 0x80], 0
je 0x14006745d
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x80], eax
jae 0x14006744d
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x40], eax
jmp 0x140067455
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x70]
lea rcx, [0x140067170]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400674c9
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x54], 1
cmp qword [rsp + 0x78], 0
je 0x1400674c7
mov rax, qword [rsp + 0x78]
mov dword [rax], 1
jmp 0x140067521
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x1400674e4
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x54], 1
jmp 0x140067521
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067280
mov dword [rsp + 0x4c], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x4c]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
mov rdx, qword [rsp + 0x70]
lea rcx, str.WSARecv___WSARecv___ERROR:_io:_p__d
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067523
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400678c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rax, qword [0x1400e6470]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov dword [rsp + 0x48], 0x80
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x140067975
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067280
mov dword [rsp + 0x4c], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x4c]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, qword [rsp + 0x120]
mov edx, eax
lea rcx, str.acceptEx___getsockname___ERROR:_d__io:_p
call fcn.140002df0
mov eax, 0xffffffff
jmp 0x140067af5
movzx eax, word [rsp + 0x80]
mov r8d, 6
mov edx, 1
mov ecx, eax
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x400], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x400], 0xffffffffffffffff
jne 0x1400679ed
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067280
mov dword [rsp + 0x50], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, qword [rsp + 0x120]
mov edx, eax
lea rcx, str.acceptEx___socket___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067af5
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x40]
add rcx, 0x418
mov qword [rsp + 0x68], rcx
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rdx
mov r8, qword [rsp + 0x40]
mov r8, qword [r8 + 0x408]
mov qword [rsp + 0x58], r8
mov rcx, qword [rsp + 0x58]
call qword [fcn.14000b810]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x90
mov dword [rsp + 0x20], 0x90
xor r9d, r9d
mov rax, qword [rsp + 0x70]
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x400]
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x90]
call qword [rsp + 0x58]
cmp eax, 1
jne 0x140067a98
mov rax, qword [rsp + 0x120]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
jmp 0x140067ae4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x140067ae4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067280
mov dword [rsp + 0x54], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x54]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8, qword [rsp + 0x120]
mov edx, eax
lea rcx, str.acceptEx___AcceptEx___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x140067af5
mov rax, qword [rsp + 0x120]
mov dword [rax + 0x54], 1
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140075860
add rsp, 0x118
ret
Function at 0x140068220
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x78], 0
je 0x140068260
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x78]
mov dword [rsp + 0x30], eax
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x30]
lea rcx, str.finish_connect___ERROR:_async_io_completed_with_error:__d__io:_p
call fcn.140002e50
jmp 0x1400682ab
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x7010
mov edx, 0xffff
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1400682ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x30], eax
mov r8, qword [rsp + 0x50]
mov edx, dword [rsp + 0x30]
lea rcx, str.finish_connect___ERROR:_setsockopt_failed:_d__io:_p
call fcn.140002e50
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x38]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x38], 0
mov rax, qword [rsp + 0x50]
mov dword [rax + 0x74], 0
cmp dword [rsp + 0x30], 0
je 0x14006830c
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x58], ecx
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x78], ecx
mov ecx, dword [rsp + 0x30]
call fcn.140067280
mov dword [rsp + 0x38], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
jmp 0x140068321
mov rax, qword [rsp + 0x50]
add rax, 0x60
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x50]
mov dword [rax + 0xb0], 3
cmp dword [rsp + 0x30], 0
je 0x140068341
mov dword [rsp + 0x34], 0xffffffff
jmp 0x140068349
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x34]
add rsp, 0x40
pop rdi
ret

Function at 0x1400683f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.WS2_32.dll_getsockname]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x140068462
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140067280
mov dword [rsp + 0x24], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x24]
mov dword [rax], ecx
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.socketio_getsockname
lea rcx, [0x1400e4878]
call fcn.140002e50
mov eax, dword [rsp + 0x20]
jmp 0x14006846e
add rsp, 0x38
ret

Function at 0x140068520
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1400e6470]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor eax, eax
mov word [rsp + 0x20], ax
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 0x196
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140075860
add rsp, 0x1d0
pop rdi
ret