joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6062ee
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006397de
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606411
push ecx
lea ecx, [esi + 0x18]
call fcn.00625b0e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606428
push ecx
lea ecx, [esi + 0x24]
call fcn.00625a1e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x63041e
Capabilities:
Check for software breakpoints

Disassembly:
and bh, bl
push edx
sub dword [esi - 0x44e67ed4], edi
sbb eax, 0xda19bb85
ret
jbe 0x630422
or dword [ebx + 0x2b6fd268], eax
dec dword [edi]
invalid
dec ebp
nop
xor dl, byte gs:[esi]
push ss
sub al, 0x1a
push ecx
xor ecx, dword [eax]
xor dword [esi + 0x1e], edi
mov al, 0x20
push ds
sahf
jno 0x6303be
lea ecx, [ebx - 0x13]
fistp word [ebx + 0x1e8ea71f]
add al, 0xfe
lodsb al, byte [esi]
and ah, byte [edx + 0x2e9e2026]
jp 0x630454
mov eax, 0xfd733fbe
xchg ecx, eax
xchg ebx, eax
push ebp
jmp 0x6303d8
das
cli
inc edx
pop esp
invalid
Function at 0x64d5ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x655338
cmp edx, dword [eax]
je 0x64d60f
add eax, 8
inc ecx
cmp eax, 0x6553c8
jl 0x64d600
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x655338]
jne 0x64d73d
mov eax, dword [0xa58c90]
cmp eax, 1
je 0x64d717
test eax, eax
jne 0x64d640
cmp dword [0x655264], 1
je 0x64d717
cmp edx, 0xfc
je 0x64d73d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d677
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064dfd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e460
inc eax
pop ecx
cmp eax, 0x3c
jbe fcn.0064d6ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6528ac
push edi
call fcn.00650330
add esp, 0x10
lea eax, [ebp + 8]
lea esi, [esi + 0x65533c]
push 0
push eax
push dword [esi]
call fcn.0064e460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x4e9740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x95000]
push edi
jmp 0x4e975a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e9761
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9750
mov eax, 1
add ebx, ebx
jne 0x4e9773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e9784
jne 0x4e97a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e97a3
dec eax
add ebx, ebx
jne 0x4e9790
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e9768
add ebx, ebx
jne 0x4e979f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e97f5
xor ecx, ecx
sub eax, 3
jb 0x4e97bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e982a
sar eax, 1
mov ebp, eax
jmp 0x4e97c6
add ebx, ebx
jne 0x4e97c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9794
inc ecx
add ebx, ebx
jne 0x4e97d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e9794
add ebx, ebx
jne 0x4e97e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e97d6
jne 0x4e97f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e97d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e9814
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e9806
jmp 0x4e9756
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e9814
add edi, ecx
jmp 0x4e9756
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e9832
cmp byte [edi], 0x11
jne 0x4e9832
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e9837
lea edi, [esi + 0xe2000]
mov eax, dword [edi]
or eax, eax
je 0x4e98af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfc8f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfca6c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e9864
mov ecx, edi
jns 0x4e9893
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfca70]
or eax, eax
je 0x4e98a9
mov dword [ebx], eax
add ebx, 4
jmp 0x4e9881
call dword [esi + 0xfca80]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e98e0
cmp al, 0xef
ja 0x4e98d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e98b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e98c2
mov ebp, dword [esi + 0xfca74]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e9914
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x62acb9b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], 0x62af5c24
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.62ad169c
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort

Function at 0x62acc32c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x62acc34b
mov eax, 0
jmp 0x62acc38f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x62acc36e
mov eax, 0
jmp 0x62acc38f
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x62acc38a
mov eax, 0
jmp 0x62acc38f
mov eax, 1
leave
ret

Function at 0x62acc391
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x62acc3f0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x62acc3e8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x62acc3e8
mov eax, dword [ebp - 4]
jmp 0x62acc404
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x62acc3c5
mov eax, 0
leave
ret
Function at 0x62ad294f
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
je 0x62ad2a68
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.hi.dll_pthread_spin_destroy
cmp eax, 1
jne 0x62ad2a5e
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea eax, [ebp - 0x4f]
mov ecx, 0x43
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x62ad2a14
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x62ad2a2b
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x62ad2a10
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x62ad2a49
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x62ad2a69
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x62ad385e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call eax
mov dword [0x62af2070], eax
mov eax, dword [0x62af2070]
cmp eax, 0xffffffff
jne 0x62ad387f
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
leave
ret

Function at 0x62ad39ef
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], sym.hi.dll_pthread_tls_init
mov dword [esp], 0x62b0e0f8
call fcn.62ad2fc4
mov eax, dword [0x62af2070]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x62ad3a36
mov eax, dword [ebp - 0x20]
jmp 0x62ad3b81
call fcn.62ad2858
mov dword [ebp - 0x20], eax
mov eax, dword [sym.hi.dll___xl_f]
test eax, eax
je 0x62ad3a4d
cmp dword [ebp - 0x20], 0
jne 0x62ad3a57
mov eax, 0
jmp 0x62ad3b81
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.62ad294f
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x62ad3b29
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x62af2070]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x62ad3b7e
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x62ad3c45
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.62ad39ef
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call sym.hi.dll__pthread_cleanup_dest
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x62ad3ca0
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_longjmp]
call eax
mov eax, dword [0x62af2070]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x62ad3dca
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x62ad3d32
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x62ad3cef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.62ad2766
mov dword [ebp - 0x10], 0
mov eax, dword [0x62af2070]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x62ad3dca
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x62ad3d62
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x62ad3dca
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.62ad2766
mov dword [ebp - 0x10], 0
mov eax, dword [0x62af2070]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x62ad5904
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x62af2080
call sym.hi.dll_pthread_spin_lock
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x62ad5930
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x62ad5972
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str..._.._.._mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.62ad1a6c
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x62af2080
call sym.hi.dll_pthread_spin_unlock
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x62add020
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
call dword [esp + 0x20]
jmp 0x62af09ac

Function at 0x62add300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
jmp 0x62add366
mov eax, 4
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
add edx, ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x62add360
mov eax, 0
jmp 0x62add3e7
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jle 0x62add31a
mov eax, dword [ebp - 0x18]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.resize_unsigned_int_
sub esp, 4
mov dword [ebp - 0xc], 0
jmp 0x62add3da
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov edx, dword [ebp - 0xc]
add eax, edx
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x62add3d4
mov eax, 0
jmp 0x62add3e7
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jl 0x62add38a
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x62add3f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2d]
mov dword [ebp - 0x18], eax
nop
nop
mov eax, dword [ebp - 0x34]
lea ecx, [eax + 4]
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x2d]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_unsigned_int__std::allocator_unsigned_char__const_
sub esp, 8
nop
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov ebx, eax
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
add eax, 4
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov byte [ebp - 0xd], 1
mov dword [ebp - 0xc], 0
nop
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
lock cmpxchg dword [edx], ecx
nop
test eax, eax
setne al
test al, al
jne 0x62add47e
jmp 0x62add50a
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov edx, dword [ebp - 0xc]
sub eax, edx
mov ebx, eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
mov dword [esp], edx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.operator___unsigned_int_
sub esp, 4
mov edx, dword [ebp - 0x4c]
mov edx, dword [edx + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x62add504
mov byte [ebp - 0xd], 0
jmp 0x62add520
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov edx, dword [ebp - 0xc]
cmp edx, eax
setb al
test al, al
jne 0x62add4ae
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xchg dword [eax], edx
mov ebx, 1
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov eax, ebx
jmp 0x62add561
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4