joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5287c0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x59b138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov ecx, dword [ecx + 0x1c]
lea edx, [esp + 4]
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [eax]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 8]
push eax
call fcn.00525c30
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
lea ecx, [esp + 4]
sete bl
call fcn.00579c1e
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.00579c1e
test bl, bl
pop ebx
je 0x528850
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esp + 0xc]
imul eax, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x24
ret

Function at 0x52cbb5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x52cbd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004187d9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x52cbf8
test byte [esp + 8], 2
je 0x52cbf8
call fcn.0041884c
mov dword [eax], 0xd
call fcn.00418855
mov dword [eax], 5
jmp 0x52cbd1
xor eax, eax
ret
Function at 0x530fa0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00413cb0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x530fe9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x530fe9
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x5d92b0
call fcn.00575884
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.0052cabb
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x5310fb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x5310fb
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x5310fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x5310fb
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x5310fb
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00413cb0
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x5310fb
mov ecx, dword [ebp - 4]
push 0x5a5a98
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.0052b988
add esp, 8
test eax, eax
je 0x5310fb
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x534590
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x534676
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x534603
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x53465a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x534616
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x534646
mov ebx, 0x3d
jmp 0x534654
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x5345aa
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x534a50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.00413cb0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x534a7b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x534a8d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x534bf9
push esi
call fcn.0053c520
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x534ac3
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.00531120
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x534b02
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.00533ad0
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.00533c40
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.00533d40
add esp, 0x24
jmp 0x534b41
test ebp, ebp
jl 0x534b0e
cmp ebp, 0x80
jle 0x534b22
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.00531120
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x534b66
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x534b6f
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.00533ad0
push esi
call fcn.0053c520
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00533c40
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x534bab
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.00533ad0
push esi
call fcn.0053c520
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.00533c40
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.00533df0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x534bde
jmp 0x534b6d
Function at 0x574d12
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push SysReAllocStringLen
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x574da2
cmp eax, ebx
je 0x574da2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x574daa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x574f55
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x5750a7
xor edx, edx
cmp eax, edx
je 0x5750a7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x574f8a
cmp eax, ecx
jb 0x574f8a
xor ecx, ecx
jmp 0x574f8f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x574fa9
jg 0x5750a7
cmp eax, dword [esi + 8]
ja 0x5750a7
cmp ecx, edx
jne 0x574fc3
cmp eax, dword [esi + 0x42c]
ja 0x574fc3
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x575008
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x574fe3
cmp edi, edx
jb 0x574fe3
xor edx, edx
jmp 0x574fe8
mov edx, 1
cmp ecx, ebx
ja 0x575008
cmp dword [esp + 0x14], edx
jg 0x575008
jl 0x574ff8
cmp eax, edi
ja 0x575008
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.005750c0
test eax, eax
je 0x5750a7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x575056
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push SysReAllocString
push ecx
call edi
cmp eax, 0xffffffff
je 0x575097
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x575097
jmp 0x575066
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x575097
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x575097
cmp dword [edi], ebp
jne 0x575097
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x575610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x57561d
xor eax, eax
ret 0xc
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x575720
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5b83d0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5b83d0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5b83d0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5b83d0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5b83d0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5b83d0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5b83d0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5b83d0]
xor eax, edx
inc ecx
dec edi
jne 0x575638
pop edi
test esi, esi
je 0x575742
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5b83d0]
xor eax, edx
inc ecx
dec esi
jne 0x575724
pop esi
pop ebx
not eax
ret 0xc

Function at 0x57bb15
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x57bb4d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0057a0c5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0057a09d
jmp 0x57bb59
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x580cd0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x580d00
push edi
call ebx
push eax
call fcn.00580e1d
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x580d2a
test byte [ebp - 4], 1
je 0x580d2a
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x580d2a
push edi
call ebx
push eax
call fcn.00580e1d
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x580dd0
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00580c1d
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x580d5c
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00580c1d
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x580d72
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00580c1d
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x580d9c
push 0
call ebx
push eax
call fcn.00580e1d
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x580dba
push eax
call ebx
push eax
call fcn.00580e1d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x580dce
push eax
call ebx
push eax
call fcn.00580e1d
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x580df7
test byte [ebp - 4], 1
jne 0x580df7
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x580df7
push edi
call ebx
push eax
call fcn.00580e1d
pop edi
pop ebx
leave
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x46d75cdf
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x5e4c7232
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4040a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e590
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x49d980]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
je 0x404165
call fcn.00404710
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x49f8d4
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
test eax, eax
push 0
setne al
push ecx
test al, al
je 0x404131
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x404147
push method.boost::asio::detail::execution_context_service_base_class_boost::asio::detail::win_iocp_socket_service_class_boost::asio::ip::tcp__.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x40415e
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.0047cd98
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.00409be0
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x404181
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x404198
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.0047cd98
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4041a2
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x4041b9
push 0x64
push esi
call fcn.0047cd98
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047cd55
mov esp, ebp
pop ebp
ret 4
Function at 0x404ec0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49d980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
cmp ebx, 0xffffffff
je 0x405096
cmp byte [ebp + 8], 0
je 0x404f22
mov al, byte [edx]
test al, 8
je 0x404f22
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x14]
setne dl
call fcn.00404e30
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
mov ecx, esi
test ebx, ebx
setne dl
call fcn.00404e30
test ebx, ebx
je 0x405084
mov esi, dword [0x49da5c]
push edi
mov edi, dword [0x49da58]
cmp edi, 0x257edfd1
jne 0x404f5c
cmp esi, 0xb2ab117a
je 0x404f6c
cmp edi, 0x257edfd0
jne 0x404f70
cmp esi, 0xb2ab117a
jne 0x404f70
mov al, 1
jmp 0x404f90
mov eax, dword [0x49da50]
mov ecx, 0x49da50
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x49da5c]
mov edi, dword [0x49da58]
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], 0x2733
add eax, 2
mov dword [ebp - 0x10], 0x49da50
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
call fcn.00402aa0
test al, al
jne 0x40503b
cmp edi, 0x257edfd1
jne 0x404fd0
cmp esi, 0xb2ab117a
je 0x404fe0
cmp edi, 0x257edfd0
jne 0x404fe4
cmp esi, 0xb2ab117a
jne 0x404fe4
mov al, 1
jmp 0x404ff8
mov eax, dword [0x49da50]
mov ecx, 0x49da50
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
movzx eax, al
mov dword [ebp - 0x14], 0x4d5
add eax, 2
mov dword [ebp - 0x10], 0x49da50
movq xmm0, qword [ebp - 0x14]
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
call fcn.00402aa0
test al, al
jne 0x40503b
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd55
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x20]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
setne dl
call fcn.00404e30
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd55
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd55
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0047cd55
mov esp, ebp
pop ebp
ret
Function at 0x4053f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49d980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push edi
push 0
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x49da58]
mov edi, eax
mov ecx, dword [0x49da5c]
cmp edx, 0x257edfd1
jne 0x405451
cmp ecx, 0xb2ab117a
je 0x405461
cmp edx, 0x257edfd0
jne 0x405468
cmp ecx, 0xb2ab117a
jne 0x405468
test edi, edi
setne al
jmp 0x405478
mov eax, dword [0x49da50]
mov ecx, 0x49da50
push edi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x49da50
mov edi, eax
movq xmm0, qword [ebp - 0x1c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
mov dword [ebp - 0x10], 0x1ffff7
cmp edi, 1
je 0x4054a8
mov eax, dword [esi]
mov ecx, eax
jmp 0x4054ba
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
mov ecx, dword [esi]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x405513
mov ecx, dword [0x49da58]
mov eax, dword [0x49da5c]
cmp ecx, 0x257edfd1
jne 0x4054d9
cmp eax, 0xb2ab117a
je 0x4054e8
cmp ecx, 0x257edfd0
jne 0x4054f6
cmp eax, 0xb2ab117a
jne 0x4054f6
mov al, 1
mov dword [ebp - 0x1c], 0x2746
jmp 0x40557b
mov eax, dword [0x49da50]
mov ecx, 0x49da50
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x1c], 0x2746
jmp 0x40557b
cmp edi, 1
je 0x40551c
mov eax, ecx
jmp 0x40552c
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x4d2
jne 0x405596
mov ecx, dword [0x49da58]
mov eax, dword [0x49da5c]
cmp ecx, 0x257edfd1
jne 0x40554d
cmp eax, 0xb2ab117a
je 0x40555c
cmp ecx, 0x257edfd0
jne 0x405560
cmp eax, 0xb2ab117a
jne 0x405560
mov al, 1
jmp 0x405574
mov eax, dword [0x49da50]
mov ecx, 0x49da50
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [ebp - 0x1c], 0x274d
movzx eax, al
mov dword [ebp - 0x18], 0x49da50
add eax, 2
movq xmm0, qword [ebp - 0x1c]
movq qword [esi], xmm0
mov dword [esi + 8], eax
jmp 0x4055d7
cmp edi, 1
je 0x40559f
mov eax, ecx
jmp 0x4055af
mov eax, dword [esi + 4]
xor edx, edx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x2738
je 0x4055ef
cmp edi, 1
jne 0x4055cf
mov eax, dword [esi + 4]
xor edx, edx
mov edi, 0x1ffff7
div edi
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0xea
je 0x4055ef
test ebx, ebx
je 0x4055ef
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047cd55
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.0047cd55
mov esp, ebp
pop ebp
ret