joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cb20
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x480
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x460], rax
cmp dword [0x14008ecdc], 0
mov ebx, ecx
jne 0x14002cbdf
cmp qword [0x14008ed68], 0
mov qword [r11 - 0x10], rdi
lea rdi, [r11 + 0x18]
je 0x14002cbbe
lea rcx, [rsp + 0x60]
mov r8, rdi
call fcn.140045a9c
xor ecx, ecx
mov edx, 1
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], dx
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x14008ed68]
lea r9d, [rdx + 0x63]
xor r8d, r8d
movzx edx, bx
mov qword [rsp + 0x50], r11
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
jmp 0x14002cbd7
call fcn.140044c6c
mov rdx, qword [rsp + 0x498]
mov r8, rdi
lea rcx, [rax + 0x60]
call fcn.1400459c0
mov rdi, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140043980
add rsp, 0x480
pop rbx
ret

Function at 0x14002cc00
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea r8, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogApplicationBonjour_Service
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
jne 0x14002cd13
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
mov word [rsp + 0x40], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
lea r9d, [rbx + 2]
repne scasw ax, word [rdi]
lea rdx, str.EventMessageFile
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14002cd13
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9d, [rbx + 4]
lea rdx, str.TypesSupported
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x1f
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test eax, eax
jne 0x14002cd13
lea rdx, [0x140059ce0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [0x14008ed68], rax
test rax, rax
je 0x14002ccfa
mov edi, ebx
jmp 0x14002cd13
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002cd0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14002cd13
mov edi, 0xffffe5cf
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002cd23
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140043980
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x14002d590
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [0x14008ed78], 0
mov rdi, rcx
mov qword [rsp + 0x38], 0
jne 0x14002d5d0
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140043980
add rsp, 0x60
pop rdi
ret
cmp qword [0x14008ed80], 0
je 0x14002d5bb
lea r8, [rsp + 0x38]
lea rdx, str.SOFTWAREApple_Inc.BonjourPower_Management
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x78], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14002d603
xor bl, bl
jmp 0x14002d6f8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, [0x1400595f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002d642
xor bl, bl
jmp 0x14002d6f8
cmp dword [rsp + 0x30], 0
jne 0x14002d650
xor bl, bl
jmp 0x14002d6f8
lea rcx, [rsp + 0x48]
call sub.KERNEL32.dll_GetSystemPowerStatus
test al, al
jne 0x14002d665
xor bl, bl
jmp 0x14002d6f8
cmp byte [rsp + 0x48], 1
je 0x14002d673
xor bl, bl
jmp 0x14002d6f8
lea rcx, [0x14008ff40]
call fcn.140029070
test al, al
jne 0x14002d687
xor bl, bl
jmp 0x14002d6f8
lea rcx, [0x14008ff40]
call fcn.140011b90
test al, al
jne 0x14002d69b
xor bl, bl
jmp 0x14002d6f8
xor ecx, ecx
call fcn.1400445d0
mov rdx, qword [0x14008ff40]
mov ecx, 4
mov r8, qword [rdx + 0x20]
lea r9, [rax + 0x1c20]
lea rdx, [0x14005a110]
pxor xmm0, xmm0
cmp r8, r9
cmovl r9, r8
sub r9, rax
cvtsi2sd xmm0, r9
mulsd xmm0, qword [0x14005a108]
cvttsd2si ebx, xmm0
mov r8d, ebx
call fcn.14002cb20
neg ebx
movsxd rax, ebx
mov bl, 1
imul rax, rax, 0x989680
mov qword [rdi], rax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002d708
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140043980
add rsp, 0x60
pop rdi
ret
Function at 0x14002d950
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push rbx
push rbp
push r12
sub rsp, 0x2c0
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rax, r9
mov rbp, r8
mov rbx, rdx
mov r12, rcx
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
mov rcx, rax
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x14002d9b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db27
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002db0b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x2b0], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14002d9f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002db03
lea rax, str.Tcpip
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2a8], r13
xor r13d, r13d
mov r9d, 0xf01ff
mov r8, rbx
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x14002da80
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dae3
call fcn.14002c4d0
test rbp, rbp
je 0x14002da98
mov r8, rbp
mov rdx, r12
mov rcx, rdi
call fcn.14002c970
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14002dac4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002db3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dad5
lea rdx, str.installed_service_n
xor ecx, ecx
call fcn.14002cb20
mov ebx, r13d
test rsi, rsi
je 0x14002dae3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b8]
test rdi, rdi
je 0x14002db01
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140043980
add rsp, 0x2c0
pop r12
pop rbp
pop rbx
ret
mov eax, 0xffffe5d0
jmp 0x14002db0b
mov eax, 0xffffe59d
jmp 0x14002db03
mov ebx, 0xffffe5b6
jmp 0x14002dae3
mov ebx, 0xffffe5bf
jmp 0x14002dad5
Function at 0x14002db50
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14002dba0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002dc91
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002dc79
mov r8d, 0x10024
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002dbdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002dc98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dc64
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14002dc09
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002dc9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dc56
cmp dword [rsp + 0x24], 1
je 0x14002dc23
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14002dc46
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002dca6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002dc56
lea rdx, str.Removed_service_n
xor ecx, ecx
call fcn.14002cb20
xor ebx, ebx
test rdi, rdi
je 0x14002dc64
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x68]
test rsi, rsi
je 0x14002dc77
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140043980
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret
mov eax, 0xffffe59d
jmp 0x14002dc79
mov ebx, 0xffffe5b9
jmp 0x14002dc64
mov ebx, 0xffffe59e
jmp 0x14002dc56
mov ebx, 0xffffe5ba
jmp 0x14002dc56
Function at 0x14002e610
Capabilities:
Get mac address on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
lea rcx, str.169.254.0.0
mov r14, rdx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rdx, rbp
mov ecx, eax
call sub.IPHLPAPI.DLL_GetBestInterface
xor r15d, r15d
test eax, eax
je 0x14002e642
mov dword [rbp], r15d
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x28], r12
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x14002e66c
mov eax, 0xffffe5d4
mov r12, qword [rsp + 0x28]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x20], r13
call fcn.140044708
mov r13, rax
test rax, rax
jne 0x14002e68c
mov eax, 0xffffe5b8
jmp 0x14002e811
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov r12d, eax
test eax, eax
jne 0x14002e806
mov qword [rsp + 0x68], rdi
mov r12d, 0xffffe5d4
mov rdi, r13
cmp dword [rdi + 0x1a4], 6
jne 0x14002e6fa
cmp dword [rdi + 0x194], 6
jne 0x14002e6fa
cmp byte [rdi + 0x198], 0x44
jne 0x14002e6fa
cmp byte [rdi + 0x199], 0x45
jne 0x14002e6fa
cmp byte [rdi + 0x19a], 0x53
jne 0x14002e6fa
cmp byte [rdi + 0x19b], 0x54
jne 0x14002e6fa
cmp byte [rdi + 0x19c], 0x42
jne 0x14002e6fa
cmp byte [rdi + 0x19d], r15b
je 0x14002e760
lea rcx, [rdi + 0x110]
lea rdx, str.Juniper
mov r8d, 0x84
call fcn.14002d810
test rax, rax
jne 0x14002e760
cmp dword [rdi + 0x1a4], 6
jne 0x14002e775
cmp dword [rdi + 0x194], 6
jne 0x14002e775
cmp byte [rdi + 0x198], r15b
jne 0x14002e775
cmp byte [rdi + 0x199], 5
jne 0x14002e775
cmp byte [rdi + 0x19a], 0x9a
jne 0x14002e775
cmp byte [rdi + 0x19b], 0x3c
jne 0x14002e775
cmp byte [rdi + 0x19c], 0x7a
jne 0x14002e775
cmp byte [rdi + 0x19d], r15b
jne 0x14002e775
lea rcx, [rdi + 0x1c0]
call qword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jne 0x14002e801
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002e6b2
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
nop dword [rax + rax]
mov rbx, r13
cmp dword [rbx + 0x1a4], 6
jne 0x14002e7c7
lea rsi, [rbx + 0x1c0]
test rsi, rsi
je 0x14002e7c7
lea rdi, str.0.0.0.0
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
je 0x14002e7c7
mov eax, dword [rbp]
test eax, eax
je 0x14002e7db
cmp dword [rbx + 0x1a0], eax
je 0x14002e7db
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14002e793
cmp dword [rbp], r15d
je 0x14002e7f7
mov dword [rbp], r15d
jmp 0x14002e790
lea rcx, [rbx + 0x1c0]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r12d, r15d
mov dword [r14], eax
mov eax, dword [rbx + 0x1a0]
mov dword [rbp], eax
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rcx, r13
call fcn.1400447c0
mov eax, r12d
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x14002e830
Capabilities:
Get routing table

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0xa8
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rax, qword [rcx]
xor r13d, r13d
cmp dword [rax + 0x6198], 6
jae 0x14002ea2d
cmp dword [reloc.WS2_32.dll_accept], r13d
je 0x14002ea2d
cmp dword [0x14008a630], r13d
jne 0x14002ea2d
xor eax, eax
lea rdx, [rbp - 0x25]
lea rcx, [rbp - 0x35]
mov qword [rsp + 0xd0], rdi
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
call fcn.14002e610
mov edi, eax
test eax, eax
jne 0x14002ea0a
mov qword [rsp + 0xc0], rbx
lea rcx, str.169.254.0.0
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xa0], r12
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rcx, str.255.255.0.0
mov dword [rbp - 0x31], eax
mov eax, dword [rbp - 0x35]
mov dword [rbp - 0x21], eax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [rbp - 0x35]
mov dword [rbp - 0x2d], eax
mov dword [rbp - 0x1d], 3
mov qword [rbp - 0x19], 3
mov dword [rbp - 0x29], r13d
call fcn.14002d730
lea rcx, str.169.254.0.0
add eax, 0x14
mov qword [rbp - 9], 0xffffffffffffffff
mov qword [rbp - 1], 0xffffffffffffffff
mov dword [rbp - 0xd], eax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rdx, [rbp - 0x39]
xor r8d, r8d
xor ecx, ecx
mov dword [rbp - 0x39], r13d
mov esi, eax
mov r12d, r13d
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x14002e9e3
mov ecx, dword [rbp - 0x39]
call fcn.140044708
mov rbx, rax
test rax, rax
je 0x14002e9e3
lea rdx, [rbp - 0x39]
xor r8d, r8d
mov rcx, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x14002e9b2
mov edx, dword [rbx]
mov eax, r13d
test edx, edx
je 0x14002e9b2
lea rcx, [rbx + 4]
cmp dword [rcx], esi
je 0x14002e994
inc eax
add rcx, 0x38
cmp eax, edx
jb 0x14002e984
jmp 0x14002e9b2
imul rax, rax, 0x38
lea rcx, [rbp + 7]
mov r8d, 0x38
lea rdx, [rax + rbx + 4]
call fcn.140043cb0
mov r12d, 1
mov rcx, rbx
call fcn.1400447c0
test r12d, r12d
je 0x14002e9e3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x31]
mov r8d, 0x38
mov dword [rbp + 0x23], r13d
call fcn.140044640
test eax, eax
je 0x14002ea29
lea rcx, [rbp + 7]
call sub.IPHLPAPI.DLL_DeleteIpForwardEntry
cmp dword [rbp - 0x25], r13d
je 0x14002ea29
lea rcx, [rbp - 0x31]
call sub.IPHLPAPI.DLL_CreateIpForwardEntry
mov rbx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140043980
add rsp, 0xa8
pop r13
pop rbp
ret
mov eax, edi
jmp 0x14002e9f2
mov eax, r13d
jmp 0x14002ea12
Function at 0x14003fd50
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x40]
mov rbx, rcx
lea rdx, [rsp + 0x48]
mov ecx, 0xfffefffc
mov qword [rsp + 0x48], rax
call fcn.140009e60
mov edx, dword [rsp + 0x40]
lea rcx, [rbx + 0x60]
mov dword [rsp + 0x50], edx
mov rdx, qword [rbx + 0x68]
lea r8, [rsp + 0x70]
mov r9d, 0x100
call fcn.140009f90
test eax, eax
js 0x14003fe8b
cmp dword [0x14006badc], 0
je 0x14003fddb
mov r8, qword [rbx + 0x10]
lea r9, [rsp + 0x70]
lea rdx, str._3d:_DNSServiceGetProperty__s_
mov ecx, 1
call fcn.140025bd0
lea rsi, [rsp + 0x70]
lea rdi, str.DaemonVersion
mov ecx, recv
repe cmpsb byte [rsi], byte [rdi]
jne 0x14003fe8b
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov ecx, 4
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x58], 0
call fcn.140009e60
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
mov ecx, 0x32d3b8
mov dword [rsp + 0x5c], edx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.140009e60
mov edx, dword [rsp + 0x40]
mov rsi, qword [rbx + 0x10]
xor r9d, r9d
mov dword [rsp + 0x60], edx
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 0xc]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp eax, 0xc
jge 0x14003fee6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rdi, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], listen
jmp 0x14003fed2
mov rsi, qword [rbx + 0x10]
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp eax, 4
jge 0x14003fee6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rdi, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 4
lea rdx, str.ERROR:_send_all__d__wrote__d_of__d_errno__d___s_
mov r9d, ebx
mov r8, rsi
xor ecx, ecx
call fcn.140025bd0
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140043980
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400410c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
cmp dword [rcx + 0x70], 0
mov rsi, qword [rcx + 0x80]
mov rbp, rcx
je 0x1400410ea
mov eax, 2
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsi + 0x10]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
call fcn.14000a050
mov eax, dword [rsi + 0xc]
mov r8d, dword [rsi + 8]
mov rcx, qword [rbp + 0x10]
lea rdx, [rax + rsi + 0x10]
sub r8d, eax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [rsi + 0x10]
mov edi, eax
call fcn.14000a050
xor ebx, ebx
test edi, edi
jns 0x140041190
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x14004118e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14004118e
mov edi, dword [rsi + 8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
sub r8d, dword [rsi + 0xc]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x10]
lea rdx, str.send_msg_ERROR:_failed_to_write__d_of__d_bytes_to_fd__d_errno__d___s_
mov r9d, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140025bd0
mov eax, 3
jmp 0x14004119f
mov edi, ebx
add dword [rsi + 0xc], edi
mov ecx, dword [rsi + 0xc]
cmp ecx, dword [rsi + 8]
sete bl
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret

Function at 0x140042e20
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
lea r8, [rsp + 0x48]
mov edx, 0x8004667e
mov rbx, rcx
mov dword [rsp + 0x48], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140042e80
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.ERROR:_could_not_set_listen_socket_to_non_blocking_mode
lea rdx, str._s:__d___s_
mov r9d, eax
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140025bd0
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov edx, 5
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x140042eb1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.ERROR:_could_not_listen_on_listen_socket
jmp 0x140042e62
lea rdx, [0x140042cd0]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.14002d430
test eax, eax
je 0x140042eec
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140009dd0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.ERROR:_could_not_add_listen_socket_to_event_loop
jmp 0x140042e62
cmp dword [0x14006badc], 0
je 0x140042f09
lea rdx, str._3d:_Listening_for_incoming_Unix_Domain_Socket_client_requests
mov r8, rbx
mov ecx, 1
call fcn.140025bd0
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140045dab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14006a110]
jne 0x14004399a
rol rcx, 0x10
test cx, 0xffff
jne 0x140043996
repz ret
ror rcx, 0x10
jmp 0x140045d04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14008eeb0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14008efa8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140045d89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14008eeb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140045dab
mov rax, qword [rsp + 0x88]
mov qword [0x14008efa8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14008ef48], rax
mov rax, qword [0x14008efa8]
mov qword [0x14008ee20], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14008ef30], rax
mov dword [0x14008ee10], 0xc0000409
mov dword [0x14008ee14], 1
mov rax, qword [0x14006a110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14006a118]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14008eea8], eax
mov ecx, 1
call fcn.14004b554
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140062438]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14008eea8], 0
jne 0x140045e32
mov ecx, 1
call fcn.14004b554
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400474ec
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14004735c