joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021320
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov ebx, edx
push 0
push dword [esi + 0xc]
push dword [esi + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x8c], eax
mov dword [ebx], eax
test eax, eax
jne 0x10021371
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
test byte [esi], 2
xorps xmm0, xmm0
movzx ecx, word [esi + 2]
mov eax, dword [0x10059a90]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x90], 0
lea edi, [eax + ecx*8]
je 0x100213b0
mov ecx, dword [edi]
xor edx, edx
xor eax, eax
bts edx, ecx
cmp ecx, 0x20
cmovae eax, edx
xor edx, eax
mov dword [ebp - 0x98], edx
jmp 0x100213c2
movzx ecx, word [edi + 4]
mov eax, dword [0x10059aa8]
mov eax, dword [eax + ecx*8]
mov dword [ebp - 0x98], eax
mov ax, word [edi + 4]
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x98]
push 0
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
test byte [esi], 1
je 0x100213f1
push dword [edi]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
test byte [esi], 4
je 0x10021400
push 2
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esi, dword [esi + 4]
test esi, esi
je 0x1002145d
push 0x80
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.10049330
push 0xffffffffffffffff
push esi
push 0x3f
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
add esp, 0x20
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 8
lea eax, [ebp - 0xa0]
push eax
push 0x26
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret
Function at 0x1003aa70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x98]
mov dl, byte [esi + 0x138]
push eax
lea eax, [esi + 0x18]
shr dl, 2
mov ecx, dword [ecx + 8]
and dl, 0xf
push eax
call fcn.1003efe0
mov edi, eax
add esp, 8
lfence
test edi, edi
jns 0x1003aae9
test byte [0x10059ab8], 4
je 0x1003aac7
push 0x1004bf7c
push str.C:__w1_s_srccorepacket_builder.c
push 0x282
call fcn.1003e120
add esp, 0xc
mov ecx, dword [esi]
mov eax, edi
push 0xa
cdq
push str.HP_failure
push edx
push eax
mov edx, 0x12
call fcn.10010570
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [esi + 0x138]
xor bl, bl
test cl, 0x3c
jbe 0x1003ab64
nop word [eax + eax]
movzx edi, bl
mov ecx, dword [esi + edi*4 + 0x118]
shl edi, 4
mov al, byte [edi + esi + 0x98]
and al, 0x1f
xor byte [ecx], al
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x68]
movzx eax, byte [eax + 0x19]
lea edx, [eax + 1]
xor al, al
add edx, ecx
mov dword [ebp - 4], edx
cmp byte [esi + 0x141], al
jbe 0x1003ab51
movzx ecx, al
inc al
add edx, ecx
add ecx, edi
mov cl, byte [ecx + esi + 0x99]
xor byte [edx], cl
mov edx, dword [ebp - 4]
cmp al, byte [esi + 0x141]
jb 0x1003ab34
mov cl, byte [esi + 0x138]
inc bl
mov al, cl
shr al, 2
and al, 0xf
cmp bl, al
jb 0x1003ab00
and cl, 0xc3
pop edi
mov byte [esi + 0x138], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c7f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 2
mov esi, ecx
mov dword [ebp - 8], 0
push 4
lea eax, [ebp - 8]
push eax
push 0
mov dword [esi + 0x9c], 2
mov dword [esi + 0x70], 0x200
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ecx, dword [ebp - 8]
mov eax, 0x24924925
mul ecx
mov eax, ecx
add ecx, 2
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
add eax, ecx
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [esi + 0xa4], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x84], eax
xor ecx, ebp
mov eax, dword [eax*4 + 0x1004def8]
mov dword [esi + 0x74], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xa0], eax
pop esi
call fcn.100483f7
mov esp, ebp
pop ebp
ret
Function at 0x1003e5c0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0
push 0
mov dword [ebp - 0xc8], 0x40
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10059a38], eax
test eax, eax
jne 0x1003e607
mov eax, 0x8007000e
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
call fcn.1003e1f0
mov esi, eax
test esi, esi
jns 0x1003e636
test byte [0x10059ab8], 4
je 0x1003e6b6
push str.CxPlatProcessorInfoInit_failed
mov edx, 0x1004c7d0
call fcn.10001490
add esp, 4
jmp 0x1003e6b6
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x1003e65f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x10059ab8], 4
mov esi, eax
je 0x1003e6a0
push str.GlobalMemoryStatusEx_failed
jmp 0x1003e697
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xac]
push 8
push 0x10059a88
mov dword [0x10059aa0], eax
mov dword [0x10059aa4], ecx
call dword [sym.imp.WINMM.dll_timeGetDevCaps]
mov esi, eax
test esi, esi
je 0x1003e6e1
test byte [0x10059ab8], 4
je 0x1003e6a0
push str.timeGetDevCaps_failed
push esi
call fcn.10001400
add esp, 8
test esi, esi
jle 0x1003e6af
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1003e6d0
call fcn.1003e580
mov eax, dword [0x10059a38]
test eax, eax
je 0x1003e6d0
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x10059a38], 0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
push 0
push str.Microsoft_Primitive_Provider
push str.CHACHA20_POLY1305
push 0x10059a3c
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jns 0x1003e71a
test byte [0x10059ab8], 4
je 0x1003e716
push str.Open_ChaCha20_Poly1305_algorithm
push eax
lfence
call fcn.10001400
add esp, 8
xor esi, esi
jmp 0x1003e770
push 0
push 0x20
push str.ChainingModeN_A
push str.ChainingMode
push dword [0x10059a3c]
call dword [sym.imp.bcrypt.dll_BCryptSetProperty]
mov esi, eax
test esi, esi
jns 0x1003e770
test byte [0x10059ab8], 4
je 0x1003e754
push str.Set_ChaCha20_Poly1305_chaining_mode
push esi
lfence
call fcn.10001400
add esp, 8
mov eax, dword [0x10059a3c]
test eax, eax
je 0x1003e770
push 0
push eax
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov dword [0x10059a3c], 0
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
test esi, esi
jle 0x1003e788
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x1003e6b1
push 0x10059a60
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test byte [0x10059abe], 0x40
je 0x1003e6d0
push dword [0x10059a8c]
lea eax, [ebp - 0x88]
push dword [0x10059a88]
push dword [0x10059aa4]
push dword [0x10059aa0]
push str.__dll__Initialized__AvailMem___llu_bytes__TimerResolution____u___u__
push 0xffffffffffffffff
push 0x80
push eax
call fcn.100015f0
lea eax, [ebp - 0x88]
mov edx, 0x1004ca90
push eax
call fcn.10001490
mov ecx, dword [ebp - 4]
add esp, 0x24
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100483f7
mov esp, ebp
pop ebp
ret
Function at 0x1003ee80
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, ecx
movzx ecx, word [ebp + 0x10]
mov dword [ebp - 0x38], eax
movzx eax, word [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [edi - 0x10]
push 0
add eax, ecx
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
push eax
push ecx
push edi
push 0
push 0
lea eax, [ebp - 0x48]
movlpd qword [ebp - 0x20], xmm0
push eax
lea eax, [ecx - 0x10]
movlpd qword [ebp - 0x18], xmm0
push eax
push edi
push ebx
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x1003ef16
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret

Function at 0x1003ef30
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, ecx
movzx ecx, word [ebp + 0x10]
mov dword [ebp - 0x38], eax
movzx eax, word [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [edi - 0x10]
push 0
add eax, ecx
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x30], eax
add ecx, 0xfffffff0
lea eax, [ebp - 8]
movlpd qword [ebp - 0x20], xmm0
push eax
push ecx
push edi
push 0
push 0
lea eax, [ebp - 0x48]
movlpd qword [ebp - 0x18], xmm0
push eax
push ecx
push edi
push ebx
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.bcrypt.dll_BCryptDecrypt]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x1003efc6
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret
Function at 0x1003efe0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 4], 2
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], 0
movzx ebx, dl
jne 0x1003f09e
push edi
xor edi, edi
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
mov dword [ecx + 0x14], 0x10
test dl, dl
je 0x1003f08b
mov edx, eax
sub edx, esi
mov dword [ebp - 0x14], edx
nop
push 0
lea eax, [edx + esi]
mov dword [ecx + 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x10
push esi
push 0
push 0
lea eax, [ecx + 8]
push eax
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ecx]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x1003f06a
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1003f07a
mov ecx, dword [ebp - 0x18]
inc edi
mov edx, dword [ebp - 0x14]
add esi, 0x10
cmp edi, ebx
jb 0x1003f030
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x10]
shl ebx, 4
push edx
push ebx
push esi
push 0
push 0
push 0
push ebx
push eax
push dword [ecx]
call dword [sym.imp.bcrypt.dll_BCryptEncrypt]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x1003f07b
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
pop esi
or eax, 0x80070000
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret

Function at 0x1003f160
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push dword [ebp + 8]
mov edi, ecx
push edx
push edi
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
jns 0x1003f18b
test byte [0x10059ab8], 4
je 0x1003f1bd
push 0x10054e88
jmp 0x1003f1b1
push 0
push dword [ebp + 0xc]
lfence
push dword [ebp + 0x10]
push edi
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov esi, eax
test esi, esi
jns 0x1003f1bd
test byte [0x10059ab8], 4
je 0x1003f1bd
push 0x10054e98
push esi
lfence
call fcn.10001400
add esp, 8
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x1003f1d0
movzx eax, ax
or eax, 0x80070000
pop edi
pop esi
pop ecx
pop ebp
ret
Function at 0x10040ca0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
push 0x140
push 0
push dword [0x10059a38]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10040d03
test byte [0x10059ab8], 2
je 0x10040ced
push eax
push 0x140
push str.CXPLAT_SOCKET
call fcn.10001500
add esp, 0xc
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
test byte [0x10059abe], 8
je 0x10040d1d
push 0
push 0
push 0
push 0
push edi
call fcn.1003f420
add esp, 0x14
push 0x140
push 0
push edi
call fcn.10049330
or byte [edi + 0x4c], 7
mov eax, 0x17
mov word [edi + 8], ax
add esp, 0xc
mov dword [edi], esi
mov eax, 0x5dc
mov word [edi + 0x44], ax
mov ecx, 0xfff7
mov eax, esi
push 0
push 0
push 0
test byte [eax + 0x64], 2
mov eax, 0x5c0
mov dword [edi + 0x40], 1
mov dword [edi + 0x80], 1
cmovne eax, ecx
mov dword [edi + 0x48], eax
lea eax, [edi + 0x88]
mov dword [edi + 0xc8], edi
mov dword [edi + 0xcc], 0xffffffff
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [eax], 0x8004
mov dword [eax + 4], eax
push 0
mov dword [edi + 0xd0], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push 0
push 0
push 6
mov dword [edi + 0xd4], eax
lea eax, [edi + 0xec]
push 1
push 0x17
mov dword [edi + 0xdc], 0
mov dword [edi + 0xe0], 0
mov dword [eax + 4], eax
mov dword [eax], eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [edi + 0xcc], eax
cmp eax, 0xffffffff
jne 0x10040e39
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10059abe], 4
mov esi, eax
je 0x10040eaa
push 0x1005520c
jmp 0x10040e9b
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push dword [edi + 0xcc]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x10040e73
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10059abe], 4
mov esi, eax
je 0x10040eaa
push str.Set_IPV6_V6ONLY
jmp 0x10040e9b
push 3
push dword [edi + 0xcc]
call dword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
test eax, eax
jne 0x10040ed1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x10059abe], 4
mov esi, eax
je 0x10040eaa
push 0x100552d4
push esi
push edi
mov edx, 0x1004c660
call fcn.100048b0
add esp, 0xc
test esi, esi
jle 0x10040eb7
movzx esi, si
or esi, 0x80070000
mov ecx, edi
call fcn.10040f10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
lea edx, [edi + 8]
lea ecx, [edi + 8]
call fcn.1003f5b0
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [edi + 0x26], ax
xor ecx, ebp
mov dword [ebx], edi
pop edi
pop esi
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret
Function at 0x10041450
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [edx + 8]
mov edi, ecx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
cmp esi, 0x2736
je 0x10041656
cmp esi, 0x3e3
je 0x10041656
lea ebx, [edi + 0x4c]
mov ecx, ebx
call fcn.10004730
test al, al
je 0x10041656
test esi, esi
jne 0x10041625
mov ebx, dword [edi + 0x58]
xorps xmm0, xmm0
sub ebx, 0xffffff80
movlpd qword [ebp - 0x10], xmm0
test byte [0x10059abe], 4
je 0x100414cf
push str.AcceptEx_Completed_
push esi
push dword [edi + 0x44]
mov edx, 0x1004c660
call fcn.100048b0
add esp, 0xc
push 4
lea eax, [edi + 0x48]
push eax
push 0x700b
push 0xffff
push dword [ebx + 0x4c]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1004155e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x10059abe], 4
je 0x10041512
push str.Set_UPDATE_ACCEPT_CONTEXT
push eax
push dword [edi + 0x58]
mov edx, 0x1004c660
call fcn.100048b0
add esp, 0xc
lea ebx, [edi + 0x4c]
mov ecx, dword [edi + 0x58]
test ecx, ecx
je 0x10041528
call fcn.10040f10
mov dword [edi + 0x58], 0
lea ecx, [edi - 4]
call fcn.10041310
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x10041656
je 0x1004164d
mov ecx, 0xe
int 0x29
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100483f7
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x48000025
push dword [ebx + 0x4c]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x10041597
movzx ecx, word [ebp - 0x10]
mov eax, dword [0x10059aa8]
movzx edx, byte [ebp - 0xe]
add dx, word [eax + ecx*8 + 4]
movzx esi, dx
mov ecx, dword [edi + 0x44]
mov edx, esi
mov ecx, dword [ecx]
call fcn.1003f610
mov dword [ebx + 0x44], eax
lea ecx, [eax + 8]
call fcn.10008080
mov eax, dword [ebx + 0x44]
push 0
push 0
mov esi, dword [eax + 4]
push dword [esi]
push dword [ebx + 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp dword [esi], eax
je 0x100415e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x10059abe], 4
je 0x10041512
push str.CreateIoCompletionPort__accepted_
jmp 0x10041501
push 0
push 0
xor edx, edx
mov ecx, ebx
call fcn.10042160
or byte [ebx + 0x58], 1
add esp, 8
mov ecx, dword [edi + 0x58]
mov edx, dword [edi + 0x44]
lea eax, [ecx + 4]
mov esi, dword [edx]
push eax
push ecx
push dword [edx + 4]
mov esi, dword [esi + 8]
mov ecx, esi
push edx
call dword [0x1004b298]
call esi
add esp, 0x10
mov dword [edi + 0x58], 0
jmp 0x10041512
test byte [0x10059abe], 4
je 0x10041515
push str.AcceptEx_completion
push esi
push dword [edi + 0x44]
mov edx, 0x1004c660
call fcn.100048b0
add esp, 0xc
jmp 0x10041515
push dword [edi + 0x50]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret
Function at 0x10043410
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
movups xmm0, xmmword [ecx + 0x20]
push esi
mov esi, edx
lea edx, [esi + 4]
push edi
movups xmmword [esi + 0x9c], xmm0
movq xmm0, qword [ecx + 0x30]
movq qword [esi + 0xac], xmm0
xorps xmm0, xmm0
mov eax, dword [ecx + 0x38]
mov dword [esi + 0xb4], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [eax], 0x8004
mov dword [eax + 4], eax
mov eax, 1
mov ecx, dword [esi]
mov dword [edx], 0x57494e58
movups xmmword [edx + 0xc], xmm0
mov dword [edx + 0x1c], 0
lock xadd dword [ecx], eax
inc eax
cmp eax, 1
jg 0x100433eb
mov ecx, 0xe
int 0x29
mov ecx, dword [esi]
push 0
call fcn.10040220
mov edi, eax
add esp, 4
test edi, edi
jns 0x10043409
lfence
mov ecx, dword [esi]
call fcn.10041050
mov eax, edi
pop edi
pop esi
pop ecx
ret
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov edx, dword [esi + 0x44]
mov eax, dword [edi]
mov dword [esi], eax
mov al, byte [esi + 0x38]
test edx, edx
jne 0x1004343b
test al, al
je 0x10043468
movzx eax, al
mov eax, dword [esi + eax*8 + 0x34]
add dword [esi + 0x30], eax
jmp 0x10043468
movzx eax, al
add dword [esi + eax*8 + 0x34], edx
mov eax, dword [esi + 0x44]
movzx ecx, word [esi + 0x34]
add dword [esi + 0x30], eax
mov dword [esi + 0x44], 0
cmp eax, ecx
jne 0x10043461
mov eax, dword [esi + 0x48]
add eax, ecx
mov dword [esi + 0x48], eax
jmp 0x10043468
mov dword [esi + 0x48], 0
lea edx, [esi + 0xb8]
lea ecx, [edi + 4]
call fcn.1003f4e0
mov al, byte [ebx + 0x4c]
test al, 0x20
je 0x1004348a
mov edx, esi
mov ecx, edi
pop edi
pop esi
pop ebx
pop ebp
jmp 0x10043360
test al, 3
jne 0x100434a1
test byte [esi + 0x37], 1
je 0x100434a1
mov edx, esi
mov ecx, edi
pop edi
pop esi
pop ebx
pop ebp
jmp 0x10043360
lea ecx, [edi + 0x20]
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.10042eb0
Function at 0x100466f0
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0x20
push 0x14
push ecx
push 0
push 0
push eax
push 0xb1
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
jns 0x10046758
test byte [0x10059ab8], 4
je 0x10046758
push 0x10054e74
push esi
lfence
call fcn.10001400
add esp, 8
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
test esi, esi
jle 0x10046770
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100468d4
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 0x74]
push eax
movzx eax, byte [ebp + 8]
push 0x20
push eax
call fcn.1003f160
mov esi, eax
add esp, 0xc
test esi, esi
js 0x100468d4
push 0x20
push 0x20
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
lea eax, [ebp - 0x70]
push eax
push 0xb1
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
jns 0x100467d4
test byte [0x10059ab8], 4
je 0x100467d4
push 0x10054e74
push esi
lfence
call fcn.10001400
add esp, 8
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
test esi, esi
jle 0x100467ec
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100468d4
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov eax, dword [str.tls13]
movq xmm0, qword [str.client_in]
mov ebx, dword [ebp - 0x70]
mov dword [ebp - 0x49], eax
mov ax, word [0x10055e34]
mov word [ebp - 0x45], ax
mov al, byte [0x10055e40]
push 0
mov byte [ebp - 0x3b], al
lea eax, [ebp - 0x4c]
push 0x14
push eax
push ebx
mov word [ebp - 0x4c], 0x2000
mov byte [ebp - 0x4a], 0xf
movq qword [ebp - 0x43], xmm0
mov word [ebp - 0x3a], 0x100
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
jns 0x1004685e
test byte [0x10059ab8], 4
je 0x10046893
push 0x10054e88
jmp 0x10046887
mov eax, dword [ebp - 0x7c]
push 0
push 0x20
add eax, 8
push eax
push ebx
lfence
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov esi, eax
test esi, esi
jns 0x10046893
test byte [0x10059ab8], 4
je 0x10046893
push 0x10054e98
push esi
lfence
call fcn.10001400
add esp, 8
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
test esi, esi
jle 0x100468ab
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x100468d4
mov ecx, dword [ebp - 0x70]
lea eax, [edi + 8]
push eax
push 0x20
push 0x20
mov edx, str.server_in
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.10046650
add esp, 0xc
mov esi, eax
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x100468e2
push eax
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x100468f0
push eax
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov ecx, 0x20
lea eax, [ebp - 0x6c]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10046900
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100483f7
mov esp, ebp
pop ebp
ret