joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401bfd
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x284
mov eax, 0x40438b
call fcn.00403354
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x288], eax
xor bl, bl
mov dword [ebp - 4], 1
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x401e24
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov eax, dword [ebp + 0x18]
mov edx, 0x40559c
cmovae ecx, dword [ebp + 8]
mov edi, 0x405596
cmp byte [ecx + eax - 1], 0x5c
lea eax, [ebp + 8]
cmovne edi, edx
cmp dword [ebp + 0x1c], 0x10
push edi
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x114]
push str._s_s.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401e24
lea ecx, [ebp - 0x258]
cmp byte [ecx], 0x2e
jne 0x401cc8
movzx eax, byte [ecx + 1]
test al, al
je 0x401da2
lea edx, [ebp - 0x258]
xor ecx, ecx
movzx eax, byte [edx + ecx]
mov edx, 0x4055a8
cmp al, byte [edx + ecx]
lea edx, [ebp - 0x258]
jne 0x401cef
inc ecx
cmp ecx, 3
jne 0x401cd0
jmp 0x401da2
test byte [ebp - 0x284], 0x10
je 0x401d8f
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004018ed
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 2
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.004018c0
add esp, 0x18
push 0
push 1
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 4
call fcn.0040211b
push dword [ebp - 0x288]
lea eax, [ebp + 0x20]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x28c], esp
push eax
call fcn.004019a2
sub esp, 0x18
mov byte [ebp - 4], 5
lea eax, [ebp - 0x12c]
mov ecx, esp
push eax
call fcn.004019a2
mov byte [ebp - 4], 4
call fcn.00401bfd
add esp, 0x34
lea ecx, [ebp - 0x12c]
push 0
push 1
test al, al
jne 0x401dba
mov byte [ebp - 4], 1
call fcn.0040211b
jmp 0x401da2
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp + 0x20]
call fcn.00402417
test eax, eax
je 0x401dc3
lea eax, [ebp - 0x284]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401cb1
jmp 0x401e1b
mov bl, al
call fcn.0040211b
jmp 0x401e1b
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.004018ed
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 6
push ecx
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004018c0
mov ecx, dword [ebp - 0x288]
add esp, 0x18
push eax
call fcn.00401a57
push 0
push 1
lea ecx, [ebp - 0x144]
call fcn.0040211b
push 0
push 1
lea ecx, [ebp - 0x12c]
call fcn.0040211b
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x401e26
xor bl, bl
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040211b
push 0
push 1
lea ecx, [ebp + 0x20]
call fcn.0040211b
mov al, bl
call fcn.0040330f
ret
Function at 0x40272e
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
je 0x402794
push 4
lea eax, [ebp + 0xc]
push eax
push 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
jne 0x402757
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402794
push str.SeDebugPrivilege
push esi
call fcn.0040279a
push str.SeTcbPrivilege
push esi
call fcn.0040279a
push str.SeChangeNotifyPrivilege
push esi
call fcn.0040279a
push str.SeIncreaseQuotaPrivilege
push esi
call fcn.0040279a
push str.SeAssignPrimaryTokenPrivilege
push esi
call fcn.0040279a
xor edi, edi
add esp, 0x28
inc edi
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x402854
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x407784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
test ebx, ebx
je 0x40290c
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, esi
je 0x40290b
push 0x124
lea eax, [ebp - 0x128]
mov dword [ebp - 0x12c], 0x128
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x4028f8
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4028eb
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], esi
push eax
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4028fe
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4028ba
jmp 0x402904
mov esi, dword [ebp - 0x130]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032e9
mov esp, ebp
pop ebp
ret
Function at 0x40291e
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x407784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
test ebx, ebx
je 0x4029e1
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, esi
je 0x4029e0
push 0x124
lea eax, [ebp - 0x128]
mov dword [ebp - 0x12c], 0x128
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x4029cd
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4029c0
and dword [ebp - 0x130], eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x4029c0
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x130]
je 0x4029d3
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402984
jmp 0x4029d9
mov esi, dword [ebp - 0x124]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004032e9
mov esp, ebp
pop ebp
ret
Function at 0x402a8b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push str.explorer.exe
call fcn.00402854
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
or edi, 0xffffffff
jmp 0x402abf
push 0x32
call ebx
push str.explorer.exe
call fcn.00402854
mov esi, eax
pop ecx
cmp esi, edi
je 0x402ab1
jmp 0x402acc
push 0x32
call ebx
push esi
push str.winlogon.exe
call fcn.0040291e
pop ecx
pop ecx
cmp eax, edi
je 0x402ac8
push eax
call fcn.004029f3
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
pop ecx
test edi, edi
je 0x402afd
push esi
push edi
call fcn.0040272e
pop ecx
pop ecx
test eax, eax
jne 0x402b2a
mov esi, dword [ebp - 8]
cmp dword [ebp - 4], 0
je 0x402b12
push dword [ebp - 4]
call sub.USERENV.dll_DestroyEnvironmentBlock
and dword [ebp - 4], 0
test edi, edi
je 0x402b19
push edi
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push str.explorer.exe
call fcn.0040291e
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x402b22
push eax
call fcn.004029f3
mov dword [ebp - 0xc], eax
pop ecx
test eax, eax
je 0x402afd
push 0x30
pop esi
push 1
push eax
lea eax, [ebp - 4]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
push dword [ebp - 0xc]
test eax, eax
mov ecx, 0x430
cmovne esi, ecx
call ebx
push 0x40
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x44
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x1c], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x58], str.winsta0default
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
xor eax, eax
push eax
push dword [ebp - 4]
push esi
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x402afd
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x1c]
call ebx
xor esi, esi
inc esi
jmp 0x402b00
Function at 0x402d3d
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push 0x144
mov eax, 0x40448a
call fcn.00403354
and dword [ebp - 0x148], 0
lea eax, [ebp - 0x148]
push str.GlobalWinSrc.exe_EED1FD34_CE10_4DD9_UIGH_819369D38275
push eax
call fcn.00401b12
pop ecx
pop ecx
test al, al
je 0x402ea8
lea eax, [ebp - 0x144]
push eax
call fcn.00401b4c
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x402d83
mov eax, dword [eax]
push eax
push 0x405598
mov ebx, 0x407840
push ebx
call fcn.00401961
add esp, 0xc
lea ecx, [ebp - 0x144]
push 0
push 1
call fcn.0040211b
push 5
pop ecx
push 0xf0
lea eax, [ebp - 0x100]
mov esi, str.RestartModifyDTBSrc
lea edi, [ebp - 0x114]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x114]
push eax
call fcn.00402703
add esp, 0x10
lea ecx, [ebp - 0x12c]
push 0x405596
call fcn.004019f1
and dword [ebp - 4], 0
lea eax, [ebp - 0x12c]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14c], esp
push 0x405744
call fcn.004019f1
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push ebx
call fcn.004019f1
xor ebx, ebx
mov byte [ebp - 4], bl
call fcn.00401bfd
add esp, 0x34
test al, al
je 0x402e9a
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x402e9a
cmp dword [ebp - 0x118], 0x10
lea ecx, [ebp - 0x12c]
push ebx
cmovae ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x114]
push ebx
push ebx
push ebx
push ebx
push ecx
push ebx
push 2
push 0x10
push 0xf01ff
push 0x405750
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x402e9a
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x402e9a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x12c]
call fcn.0040211b
xor eax, eax
call fcn.0040330f
ret
Function at 0x10005ec0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10005f78
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [0x10228880]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x1022c6ac]
cmp ecx, dword [edx + 4]
jle 0x10005f26
push 0x1022c6ac
call fcn.1016792e
add esp, 4
cmp dword [0x1022c6ac], esi
jne 0x10005f26
call fcn.10005060
push 0x1022c6ac
call fcn.101678ef
add esp, 4
mov ecx, dword [0x1022c6d8]
mov eax, dword [0x1022c6dc]
mov dword [ebp - 0xc], edi
cmp ecx, 0x25c5e09b
jne 0x10005f43
cmp eax, 0x8fafd21e
je 0x10005f52
cmp ecx, 0x257edf0d
jne 0x10005f59
cmp eax, 0xb2ab117a
jne 0x10005f59
test edi, edi
setne al
jmp 0x10005f69
mov eax, dword [0x1022c6d0]
mov ecx, 0x1022c6d0
push edi
mov eax, dword [eax + 0x18]
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x1022c6d0
pop edi
test al, al
jne 0x10005f7f
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x101f5480
lea ecx, [ebp - 0xc]
call fcn.10005d10
int3

Function at 0x10005f90
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x1021bfec]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x1022c6a4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x10005fd2
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x1022c6a8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.101677cc
mov esp, ebp
pop ebp
ret

Function at 0x10006320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
push 0
push 0xff
call fcn.10006180
mov byte [esi + edi], al
add esp, 8
inc esi
cmp esi, 8
jb 0x10006331
xor esi, esi
nop dword [eax + eax]
xor byte [esi + ebx], 0x40
mov eax, esi
and eax, 7
mov ecx, esi
and ecx, 0x1ff
mov dl, byte [eax + edi]
xor dl, byte [esi + ebx]
mov byte [esi + ebx], dl
mov al, byte [eax + edi]
add al, dl
xor al, byte [ecx + 0x101f5058]
sub al, byte [ecx + 0x101f4c58]
add al, byte [ecx + 0x101f4458]
xor al, byte [ecx + 0x101f4a58]
add al, byte [ecx + 0x101f4858]
xor al, byte [ecx + 0x101f4250]
sub al, byte [ecx + 0x101f4658]
sub al, byte [ecx + 0x101f4e58]
mov byte [esi + ebx], al
inc esi
cmp esi, 0x40
jl 0x10006350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100063b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
jle 0x1000643f
mov eax, 0x81020409
imul ebx
add edx, ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x1ff
mov dl, byte [eax + 0x101f4e58]
add dl, byte [eax + 0x101f4658]
add dl, byte [esi + edi]
xor dl, byte [eax + 0x101f4250]
sub dl, byte [eax + 0x101f4858]
xor dl, byte [eax + 0x101f4a58]
sub dl, byte [eax + 0x101f4458]
add dl, byte [eax + 0x101f4c58]
xor dl, byte [eax + 0x101f5058]
mov eax, esi
and eax, 7
mov byte [esi + edi], dl
add ecx, eax
mov al, byte [ebp - 4]
add al, al
add al, bl
sub dl, byte [ecx]
mov byte [esi + edi], dl
xor al, dl
xor al, byte [ecx]
mov byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x100063e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
mov dword [0x1022c760], edi
mov dword [0x1022c764], ecx
nop dword [eax]
push 0x5851f42d
mov edx, ecx
xor eax, eax
push 0x4c957f2d
shr edx, 0x1e
xor eax, ecx
xor edx, edi
push eax
push edx
call fcn.101687e0
mov edi, eax
mov ecx, edx
mov eax, esi
cdq
add edi, eax
mov dword [esi*8 + 0x1022c760], edi
adc ecx, edx
mov dword [esi*8 + 0x1022c764], ecx
inc esi
cmp esi, 0x138
jl 0x10006d90
pop edi
mov dword [0x1022c758], 0x138
pop esi
pop ebp
ret 0x10
Function at 0x10008530
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
mov eax, 0x40
push edi
mov edi, ecx
mov edx, dword [esi]
and edx, 0x3f
mov byte [edx + esi + 0x18], 0x80
inc edx
sub eax, edx
cmp eax, 8
jae 0x10008571
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.1016d200
push 0x40
lea edx, [esi + 0x18]
mov ecx, esi
call fcn.10007ab0
add esp, 0x10
mov eax, 0x40
xor edx, edx
add eax, 0xfffffff8
push eax
lea eax, [esi + 0x18]
add eax, edx
push 0
push eax
call fcn.1016d200
shl dword [esi], 3
lea edx, [esi + 0x18]
movzx eax, byte [esi]
mov ecx, esi
mov byte [esi + 0x50], al
mov eax, dword [esi]
shr eax, 8
mov byte [esi + 0x51], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x52], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x53], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
shr eax, 8
mov byte [esi + 0x55], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x56], al
movzx eax, byte [esi + 7]
push 0x40
mov byte [esi + 0x57], al
call fcn.10007ab0
movzx eax, byte [esi + 8]
mov byte [edi], al
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 1], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xb]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 4], al
mov eax, dword [esi + 0xc]
shr eax, 8
mov byte [edi + 5], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 8], al
mov eax, dword [esi + 0x10]
shr eax, 8
mov byte [edi + 9], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x14]
shr eax, 8
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x16]
push 0x98
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x17]
push 0
push esi
mov byte [edi + 0xf], al
call fcn.1016d200
add esp, 0x1c
pop edi
pop esi
ret

Function at 0x10009520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1003d4ca
Function at 0x1000ddb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a6db8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1021bfec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000dede
cmp byte [ebx + 0x3d], 0
je 0x1000dede
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x1000de09
xor al, al
jmp 0x1000dee0
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100067d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1000de6f
sub eax, 1
je 0x1000de73
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x1000dec6
xor bl, bl
jmp 0x1000dec8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x1000dea8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.101746b3
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x1000de6b
cmp byte [ebx + 0x3d], 0
je 0x1000dec6
test esi, esi
jne 0x1000de31
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10006f80
jmp 0x1000de2e
mov bl, 1
cmp ecx, 0x10
jb 0x1000deda
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10006de0
mov al, bl
jmp 0x1000dee0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101677cc
mov esp, ebp
pop ebp
ret

Function at 0x1000ea30
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x1022c728
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
push dword [esi + 4]
test eax, eax
je 0x1000ea7f
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
push method.CWinThread.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ee60
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a6f99
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1021bfec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
lea ebx, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [ebx], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.1000fba0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.1000e640
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1000efef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [0x10228880]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x1022c6ac]
cmp ecx, dword [edx + 4]
jle 0x1000ef91
push 0x1022c6ac
call fcn.1016792e
add esp, 4
cmp dword [0x1022c6ac], 0xffffffff
jne 0x1000ef91
call fcn.10005060
push 0x1022c6ac
call fcn.101678ef
add esp, 4
mov ecx, dword [0x1022c6d8]
mov eax, dword [0x1022c6dc]
mov dword [ebp - 0x1c], edi
cmp ecx, 0x25c5e09b
jne 0x1000efae
cmp eax, 0x8fafd21e
je 0x1000efbd
cmp ecx, 0x257edf0d
jne 0x1000efc4
cmp eax, 0xb2ab117a
jne 0x1000efc4
test edi, edi
setne al
jmp 0x1000efd4
mov eax, dword [0x1022c6d0]
mov ecx, 0x1022c6d0
push edi
mov eax, dword [eax + 0x18]
call eax
mov byte [ebp - 0x18], al
mov dword [ebp - 0x14], 0x1022c6d0
test al, al
je 0x1000efef
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.10005d10
cmp byte [ebp + 0x10], 0
je 0x1000f03e
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0xc
call fcn.1003176a
add esp, 4
mov dword [ebp + 0x10], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x1000f01e
push ecx
push esi
mov ecx, eax
call fcn.10010010
mov ebx, eax
jmp 0x1000f020
xor ebx, ebx
mov edi, dword [esi + 0x60]
test edi, edi
je 0x1000f03b
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push edi
call fcn.10167d85
add esp, 8
mov dword [esi + 0x60], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc