joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d5260
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
test byte [ebx + 0x2c], 1
jne 0x6d5290
cmp dword [ebx + 8], 0x10
mov esi, dword [ebx + 4]
mov dword [ebx + 0xc], eax
ja case.0x6d5286.0
mov eax, dword [ebx + 8]
jmp dword [eax*4 + 0x869c8c]
mov dword [esp + 8], 0x47
mov dword [esp + 4], str.src_win_handle.c
mov dword [esp], 0x869c61
call dbg._assert
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_signal_close
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_async_close
mov dword [esp], ebx
call dbg.uv_check_stop
mov eax, dword [ebx + 0x2c]
test al, 1
jne 0x6d54a0
mov edx, eax
and edx, 0x60
cmp edx, 0x60
je 0x6d5304
mov edx, dword [ebx + 4]
add dword [edx + 4], 1
mov edx, eax
and edx, 0xffffffbf
test al, 8
jne 0x6d5492
mov eax, dword [esi + 0x2c]
or edx, 9
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], eax
mov dword [esi + 0x2c], ebx
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_fs_event_close
mov dword [esp], ebx
call dbg.uv__fs_poll_close
mov eax, dword [ebx + 0x2c]
test al, 1
je 0x6d52f3
mov dword [esp + 8], 0x8d
mov dword [esp + 4], str.src_win_handle.c
mov dword [esp], 0x869c64
call dbg._assert
mov eax, dword [ebx + 0x2c]
jmp 0x6d52f3
mov dword [esp], ebx
call dbg.uv_idle_stop
mov eax, dword [ebx + 0x2c]
test al, 1
je 0x6d52f3
mov dword [esp + 8], 0x77
mov dword [esp + 4], str.src_win_handle.c
mov dword [esp], 0x869c64
call dbg._assert
mov eax, dword [ebx + 0x2c]
jmp 0x6d52f3
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_pipe_close
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_poll_close
mov dword [esp], ebx
call dbg.uv_prepare_stop
mov eax, dword [ebx + 0x2c]
test al, 1
je 0x6d52f3
mov dword [esp + 8], 0x6b
mov dword [esp + 4], str.src_win_handle.c
mov dword [esp], 0x869c64
call dbg._assert
mov eax, dword [ebx + 0x2c]
jmp 0x6d52f3
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_process_close
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_tcp_close
mov dword [esp], ebx
call sym._uv_timer_stop
mov eax, dword [ebx + 0x2c]
test al, 1
je 0x6d52f3
mov dword [esp + 8], 0x65
mov dword [esp + 4], str.src_win_handle.c
mov dword [esp], 0x869c64
call dbg._assert
mov eax, dword [ebx + 0x2c]
jmp 0x6d52f3
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_tty_close
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp dbg.uv_udp_close
or edx, 1
mov dword [ebx + 0x2c], edx
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp + 8], 0x71
mov dword [esp + 4], str.src_win_handle.c
mov dword [esp], 0x869c64
call dbg._assert
mov eax, dword [ebx + 0x2c]
jmp 0x6d52f3
call sym._abort
lea esi, [esi]
Function at 0x6d5e00
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov esi, edx
mov ebx, ecx
sub esp, 0x2c
test byte [edx + 0x2d], 8
je 0x6d5f90
mov eax, dword [esp + 0x40]
mov edx, dword [ebx + 0x3c]
test eax, eax
jne 0x6d5ebe
cmp edx, 0xffffffff
je 0x6d5e47
mov dword [esp + 8], 0x323
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__pipeHandle__INVALID_HANDLE_VALUE
call dbg._assert
mov eax, dword [esi + 0x98]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x10], 0x10000
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
sub esp, 0x20
cmp eax, 0xffffffff
mov dword [ebx + 0x3c], eax
je 0x6d5f4b
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
mov edx, esi
mov eax, edi
call dbg.uv_set_pipe_handle
test eax, eax
jne 0x6d5f35
mov edx, dword [ebx + 0x3c]
cmp edx, 0xffffffff
je 0x6d5fd4
lea eax, [ebx + 0x20]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
sub esp, 8
test eax, eax
je 0x6d5f10
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x6d5f01
call ebp
cmp eax, 0x217
jne 0x6d5fb1
mov dword [ebx + 0x20], 0
jmp 0x6d5f64
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x3c], 0xffffffff
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
jle 0x6d5fd0
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x38], 0
test eax, eax
je 0x6d6000
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x38], edx
mov dword [eax + 0x38], ebx
mov dword [edi + 0x28], ebx
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x320
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], 0x869df8
call dbg._assert
jmp 0x6d5e17
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x3c], 0xffffffff
sub esp, 4
call ebp
test eax, eax
jg 0x6d5f57
lea esi, [esi]
call ebp
jmp 0x6d5f61
mov dword [esp + 8], 0x33b
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__pipeHandle___INVALID_HANDLE_VALUE
call dbg._assert
mov edx, dword [ebx + 0x3c]
jmp 0x6d5ec7
mov dword [ebx + 0x38], ebx
mov dword [edi + 0x28], ebx
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6d63d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0x2c
mov eax, dword [edx + 0x2c]
test ah, 1
je 0x6d65c0
test eax, 0x20000
jne 0x6d6570
cmp dword [ebx + 0x94], 0xffffffff
je 0x6d6599
mov edx, dword [ebx + 0x2c]
lea edi, [ebx + 0x44]
test edx, 0x1000000
je 0x6d6450
mov dword [esp + 8], 0x10
mov dword [esp + 4], edi
mov dword [esp], dbg.uv_pipe_zero_readfile_thread_proc
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
sub esp, 0xc
test eax, eax
je 0x6d6522
mov eax, ebx
call dbg.eof_timer_start
or dword [ebx + 0x2c], 0x20000
add dword [ebx + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x64]
and edx, 0x100000
mov dword [ebx + 0x64], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
je 0x6d648a
mov edx, dword [ebx + 0x80]
or edx, 1
mov dword [ebx + 0x74], edx
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x94]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x9479cc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x6d65e4
test byte [ebx + 0x2e], 0x10
je 0x6d6431
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x6d6620
cmp dword [ebx + 0x84], 0xffffffff
jne 0x6d6431
mov eax, dword [ebx + 0x74]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], edi
mov dword [esp + 8], sym._post_completion_read_wait_8
mov dword [esp + 4], eax
lea eax, [ebx + 0x84]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
sub esp, 0x18
test eax, eax
jne 0x6d6431
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
jle 0x6d6600
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [ebx + 0x64], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x7c], 0
test eax, eax
je 0x6d6610
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x7c], edx
mov dword [eax + 0x38], edi
mov dword [esi + 0x28], edi
or dword [ebx + 0x2c], 0x20000
add dword [ebx + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x43f
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], 0x869f0c
call dbg._assert
cmp dword [ebx + 0x94], 0xffffffff
jne 0x6d63ff
mov dword [esp + 8], 0x441
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.handle__handle___INVALID_HANDLE_VALUE
call dbg._assert
jmp 0x6d63ff
mov dword [esp + 8], 0x43e
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], 0x869ee8
call dbg._assert
mov eax, dword [ebx + 0x2c]
jmp 0x6d63e7
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x6d64c0
jmp 0x6d6528
call ebp
jmp 0x6d653c
mov dword [ebx + 0x7c], edi
mov dword [esi + 0x28], edi
jmp 0x6d655d
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
test eax, eax
mov dword [ebx + 0x80], eax
jne 0x6d64d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], 0x869f5f
mov dword [esp], eax
call dbg.uv_fatal_error
lea esi, [esi]
Function at 0x6d6670
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
cmp dword [ebx + 4], 3
mov esi, dword [ebx + 0x44]
mov edi, dword [esi + 4]
je 0x6d66a2
mov dword [esp + 8], 0x401
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__type__UV_WRITE
call dbg._assert
cmp dword [esi + 8], 7
je 0x6d66c4
mov dword [esp + 8], 0x402
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.handle__type__UV_NAMED_PIPE
call dbg._assert
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x6d6750
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0x4c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [esi + 0x94]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x6d6735
add ebx, 0x20
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub esp, 0x10
test eax, eax
je 0x6d6778
add esp, 0x30
xor eax, eax
pop ebx
pop esi
pop edi
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x6d6774
call esi
movzx eax, ax
or eax, 0x80070000
mov dword [ebx + 0x20], eax
jmp 0x6d6700
mov dword [esp + 8], 0x403
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__write_buffer.base
call dbg._assert
mov eax, dword [ebx + 0x50]
jmp 0x6d66cf
call esi
jmp 0x6d674b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], 0x869ecd
mov dword [esp], eax
call dbg.uv_fatal_error
nop
Function at 0x6d7cd0
Capabilities:
Create pipe

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
or edi, 0x40080000
jmp 0x6d7d09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x6d7d06
cmp eax, 5
jne 0x6d7e00
add ebx, 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._pipeuv_p__lu
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym._snprintf.constprop.12
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x10], 0x10000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
sub esp, 0x20
cmp eax, 0xffffffff
je 0x6d7cf0
mov ecx, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
mov ecx, dword [esp + 0x28]
je 0x6d7dd0
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
call sym._uv_pipe_connection_init
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov dword [eax + 0x94], ecx
add esp, 0x3c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov edx, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
add esp, 0x3c
mov edx, eax
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret

Function at 0x6d9160
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
cmp dword [esp + 0x1c], 1
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
je 0x6d9185
mov eax, 0x32
pop ebx
pop esi
ret
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
pop ebx
pop esi
jmp sym._uv_pipe_write_impl.part.9
Function at 0x6dbb20
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
cmp edx, 2
je 0x6dbb85
jg 0x6dbb70
test edx, edx
jne 0x6dbb7a
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x6dbbc0
cmp dword [esp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, edx
add esp, 0x34
pop ebx
pop esi
ret
cmp edx, 9
je 0x6dbb85
cmp edx, 0xf
je 0x6dbb85
add esp, 0x34
mov eax, 0xfffff02a
pop ebx
pop esi
ret
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
jne 0x6dbb62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov esi, eax
je 0x6dbbd4
mov dword [esp], esi
call dbg.uv_translate_sys_error
add esp, 0x34
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call dbg.uv_translate_sys_error
add esp, 0x34
pop ebx
pop esi
ret
lea eax, [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
sub esp, 8
test eax, eax
je 0x6dbbae
cmp dword [esp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x6dbb62
jmp 0x6dbbae

Function at 0x6de6a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x2c]
test al, 1
jne 0x6de710
test eax, 0x10000
je 0x6de720
mov edx, dword [edx + 8]
cmp edx, 0xc
je 0x6de700
cmp edx, 0xe
je 0x6de6f1
cmp edx, 7
mov eax, 0xfffff008
je 0x6de6ed
mov dword [esp + 8], 0xc8
mov dword [esp + 4], str.src_win_stream.c
mov dword [esp], 0x86ae5d
call dbg._assert
mov eax, 0xfffff02a
add esp, 0x1c
ret
add esp, 0x1c
jmp dbg.uv__tty_try_write
add esp, 0x1c
jmp dbg.uv__tcp_try_write
mov eax, 0xfffff00d
jmp 0x6de6ed
mov eax, 0xfffff031
jmp 0x6de6ed
Function at 0x6def10
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x34
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 4
mov dword [esp + 8], 8
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], esi
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x6def8f
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x6def62
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov dword [esp + 4], 6
mov dword [esp], esi
mov dword [esp + 0xc], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x6def5a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x6defa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
cmp dword [ecx], 0xffffffff
mov esi, dword [esp + 0x60]
mov dword [esp + 0x38], 1
jne 0x6df190
mov ebp, eax
lea eax, [esp + 0x38]
mov edi, ecx
mov ebx, edx
mov dword [esp + 4], 0x8004667e
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x6df0c0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
sub esp, 0xc
test eax, eax
je 0x6df0b1
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov eax, dword [ebp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
je 0x6df130
mov eax, dword [ebx]
mov ecx, dword [0x94926c]
cmp dword [esp + 0x64], 0x17
mov edx, dword [0x9492ac]
cmovne edx, dword [0x94928c]
test ecx, ecx
je 0x6df05c
mov ebp, eax
and ebp, 0x100000
or ebp, edx
je 0x6df0d0
test eax, 0x2000000
jne 0x6df150
test eax, 0x4000000
jne 0x6df100
cmp dword [esp + 0x64], 0x17
mov dword [edi], esi
je 0x6df120
mov edx, dword [ebx]
xor eax, eax
and edx, 0x1000000
je 0x6df0b7
mov dword [esp + 8], 0x96
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x86af80
mov dword [esp + 0x2c], eax
call dbg._assert
mov eax, dword [esp + 0x2c]
jmp 0x6df0b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 3
mov dword [esp], esi
call ecx
sub esp, 8
test eax, eax
je 0x6df1b0
mov eax, dword [ebx]
or eax, 0x40000
mov dword [ebx], eax
jmp 0x6df05c
mov ecx, 0x3c
mov edx, 1
mov eax, esi
call sym._uv__tcp_keepalive.isra.1
test eax, eax
je 0x6df072
jmp 0x6df0b7
or dword [ebx], 0x1000000
xor eax, eax
jmp 0x6df0b7
mov eax, dword [esp + 0x68]
test eax, eax
je 0x6df0b1
mov eax, dword [ebx]
or eax, 0x100000
mov dword [ebx], eax
jmp 0x6df034
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 1
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x6df1a0
mov eax, dword [ebx]
jmp 0x6df067
mov eax, 0xfffff00e
jmp 0x6df0b7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x6df0b7
jmp 0x6df189
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 1
jne 0x6df1c4
mov eax, dword [ebx]
jmp 0x6df05c
call ebp
jmp 0x6df0b7
Function at 0x6df1d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
mov eax, dword [eax + 0x90]
movzx edx, word [edx]
cmp eax, 0xffffffff
je 0x6df225
cmp dx, 0x17
je 0x6df2a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x6df2f0
or dword [ebx + 0x2c], 0x200
xor ecx, ecx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esp + 0x60], 1
je 0x6df237
cmp dx, 0x17
mov ecx, 0x57
jne 0x6df21b
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
cmp eax, 0xffffffff
mov ebp, eax
je 0x6df2e2
movzx eax, word [esi]
lea ecx, [ebx + 0x90]
lea edx, [ebx + 0x2c]
mov dword [esp + 8], 0
mov dword [esp], ebp
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
call sym._uv_tcp_set_socket.isra.2
test eax, eax
jne 0x6df312
movzx edx, word [esi]
mov eax, dword [ebx + 0x90]
cmp dx, 0x17
jne 0x6df1f5
lea esi, [esi]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 0x29
mov dword [esp], eax
and edx, 1
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebx + 0x90]
sub esp, 0x14
jmp 0x6df1f5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
jmp 0x6df21b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
mov ecx, eax
jne 0x6df21b
mov dword [ebx + 0x94], 0x2740
jmp 0x6df212
mov dword [esp + 0x2c], eax
mov dword [esp], ebp
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov ecx, dword [esp + 0x2c]
jmp 0x6df21b

Function at 0x6e0120
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov edx, dword [eax + 0x90]
cmp edx, 0xffffffff
je 0x6e0175
mov eax, dword [eax + 0x94]
test eax, eax
jne 0x6e0168
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
test eax, eax
jne 0x6e0162
add esp, 0x18
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp dbg.uv_translate_sys_error
mov eax, 0xfffff019
jmp 0x6e015d
Function at 0x6e0dd0
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
cmp dword [ebx + 8], 0xc
je 0x6e0dff
mov dword [esp + 8], 0x45d
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], str.handle__type__UV_TCP
call dbg._assert
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x6e0e90
mov edx, dword [esi + 0x20]
test edx, edx
js 0x6e0e4b
lea edx, [ebx + 0x90]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x700b
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov dword [esp + 0xc], edx
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
test eax, eax
je 0x6e0f50
mov eax, dword [esi + 0x3c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
test byte [ebx + 0x2d], 8
mov dword [esi + 0x3c], 0xffffffff
jne 0x6e0f82
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x6e0f01
sub eax, 1
mov edx, dword [ebx + 0x2c]
test eax, eax
mov dword [ebx + 0x3c], eax
jne 0x6e0e89
test dl, 1
jne 0x6e0f25
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x2c]
test ah, 8
je 0x6e0e68
mov edx, eax
and dh, 0xf7
sub dword [ebx + 0x40], 1
mov dword [ebx + 0x2c], edx
jne 0x6e0f90
test al, 1
jne 0x6e0ed0
test al, 0x40
je 0x6e0ed0
mov edx, eax
and edx, 0xfffff7bf
test al, 0x20
mov dword [ebx + 0x2c], edx
je 0x6e0ed0
mov eax, dword [ebx + 4]
sub dword [eax + 4], 1
nop
lea esi, [esi]
mov ecx, dword [ebx + 0x88]
test ecx, ecx
je 0x6e0e68
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dbg.uv_ntstatus_to_winsock_error
mov esi, dword [ebx + 0x88]
mov dword [esp], eax
call dbg.uv_translate_sys_error
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
jmp 0x6e0e68
mov dword [esp + 8], 0x485
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x86b043
call dbg._assert
mov eax, dword [ebx + 0x3c]
jmp 0x6e0e73
test dl, 8
jne 0x6e0e89
mov eax, dword [esp + 0x30]
or edx, 8
mov dword [ebx + 0x2c], edx
mov eax, dword [eax + 0x2c]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [eax + 0x2c], ebx
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [ebx + 0xa0]
mov dword [esi + 0x168], eax
mov eax, dword [ebx + 0x88]
mov dword [ebx + 0xa0], esi
test eax, eax
je 0x6e0e68
mov dword [esp + 4], 0
mov dword [esp], ebx
call eax
jmp 0x6e0e68
mov edx, esi
mov eax, ebx
call dbg.uv_tcp_queue_accept
jmp 0x6e0e68
jns 0x6e0ed0
mov dword [esp + 8], 0x466
mov dword [esp + 4], str.src_win_tcp.c
mov dword [esp], 0x86b179
call dbg._assert
jmp 0x6e0ed0