currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one:
mov qword ptr ss:[rsp+60],rsi
This should be the something with count because it's between ~60 - ~3000 (pausing application ~60, !pausing application ~3000) Not after the functioned was called so this couldn't be the "bytes send" parameter.
mov rsi,qword ptr ss:[rsp+80] mov qword ptr ss:[rsp+28],rsi
These 2 lines are one parameter ? I guess because rsi gets a value which is than used one instruction later.
Maybe someone can give me a hint on how to find the correct parameters.
Before I have found this function I thought parameters are only passed to a function via push but after some research, I have found out that this is compiler dependend and I find it difficult to find the parameters.
int WSASend( __in SOCKET s, __in LPWSABUF lpBuffers, __in DWORD dwBufferCount, __out LPDWORD lpNumberOfBytesSent, __in DWORD dwFlags, __in LPWSAOVERLAPPED lpOverlapped, __in LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine );