joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, ecx
cmp dword [esi + 0x2c0], 0
jne 0x40585f
push 0x18
call fcn.004b9961
add esp, 4
test eax, eax
je 0x405853
mov ecx, eax
call fcn.0041a4b0
jmp 0x405855
xor eax, eax
mov dword [esi + 0x2c0], eax
test eax, eax
je 0x4058cb
cmp byte [ebp + 8], 0
xorps xmm0, xmm0
mov word [ebp - 0xb], 0x65
mov word [ebp - 0xe], 0x614e
mov dword [ebp - 0x13], 0x65766965
mov word [ebp - 0x18], 0x7342
mov word [ebp - 0x15], 0x6365
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xc], 0x6d
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x24], 0
movq qword [ebp - 0x23], xmm0
mov byte [ebp - 0x1b], 0
lea eax, [ebp - 0x24]
je 0x4058aa
push str.ENABLE
jmp 0x4058af
push str.DISABLE
push eax
call fcn.00406340
mov ecx, dword [esi + 0x2c0]
add esp, 8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041a4d0
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.005cd355
mov esp, ebp
pop ebp
ret 4

Function at 0x405fa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a3d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x685680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, cl
call fcn.00404060
call fcn.004bd57a
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x405fea
push 0x80004005
call fcn.00403360
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
test bl, bl
je 0x40600c
push 5
push 0x646d94
jmp 0x406013
push 4
push 0x646d9c
call fcn.004066a0
lea eax, [ebp - 0x14]
push eax
push 0x690594
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x406052
push dword [esi - 0xc]
push esi
push 1
push 0
push 0x690580
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406073
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.00404060
push 0x800
lea eax, [ebp - 0x807]
push 0
push eax
mov dword [ebp - 0x80c], 1
mov byte [ebp - 0x808], 0
call fcn.005d1b40
add esp, 0xc
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0x690580
push 0x690594
push SysReAllocStringLen
mov dword [ebp - 0x814], 0x801
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x810]
call fcn.00406780
push 0x646da4
push dword [eax]
call fcn.005ce3e4
mov edx, dword [ebp - 0x810]
add esp, 8
test eax, eax
sete bl
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40614a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
test bl, bl
sete al
xor ecx, ebp
pop ebx
call fcn.005cd355
mov esp, ebp
pop ebp
ret

Function at 0x406160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60a378
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x685680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call fcn.005ce561
add esp, 4
mov edi, eax
mov ebx, edx
call fcn.004bd57a
xor ecx, ecx
mov esi, eax
test esi, esi
setne cl
test ecx, ecx
jne 0x4061b2
push 0x80004005
call fcn.00403360
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push ebx
push edi
lea eax, [ebp - 0x10]
push str._I64d
push eax
mov dword [ebp - 4], 0
call fcn.00402f20
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push 0x690594
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x406213
push dword [esi - 0xc]
push esi
push 1
push 0
push 0x690568
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x406234
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
lea eax, [ebp - 0x80f]
push 0
push eax
mov dword [ebp - 0x814], 1
mov byte [ebp - 0x810], 0
call fcn.005d1b40
add esp, 0xc
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x814]
push eax
push 0x690568
push 0x690594
push SysReAllocStringLen
mov dword [ebp - 0x824], 0x801
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x820]
push eax
push 0
lea eax, [ebp - 0x810]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x820], xmm0
call dword [sym.imp.SHLWAPI.dll_StrToInt64ExA]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x820]
mov edx, dword [ebp - 0x81c]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret

Function at 0x406300
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x690594
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x406333
push 0x690568
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x406360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004be6c1

Function at 0x4064b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4064c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406504
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406500
lea ebx, [ebx]
cmp esi, edx
jae 0x406504
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4064f0
cmp esi, edx
jb 0x406509
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40a610
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push edi
mov al, byte [ebx]
mov edi, edx
test al, al
je 0x40a6f0
push esi
cmp al, 0x24
je 0x40a65f
cmp al, 0x26
je 0x40a65f
cmp al, 0x2b
je 0x40a65f
cmp al, 0x2c
je 0x40a65f
cmp al, 0x2f
je 0x40a65f
cmp al, 0x3a
je 0x40a65f
cmp al, 0x3b
je 0x40a65f
cmp al, 0x3d
je 0x40a65f
cmp al, 0x3f
je 0x40a65f
cmp al, 0x40
je 0x40a65f
cmp al, 0x23
je 0x40a65f
cmp al, 0x20
je 0x40a65f
mov byte [edi], al
inc edi
jmp 0x40a6e3
movsx eax, al
push eax
lea eax, [ebp - 4]
push 0x647820
push eax
call fcn.005cdf98
lea ecx, [ebp - 4]
add esp, 0xc
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a680
sub ecx, edx
je 0x40a6bd
jmp 0x40a690
movsx eax, byte [ebp + esi - 4]
push eax
call fcn.005ce7e7
mov byte [ebp + esi - 4], al
lea eax, [ebp - 4]
add esp, 4
inc esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a6b0
sub eax, edx
cmp esi, eax
jb 0x40a690
lea ecx, [ebp - 4]
mov edx, edi
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x40a6c6
lea ecx, [ebp - 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a6d8
sub ecx, edx
add edi, ecx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x40a627
pop esi
mov byte [edi], 0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40af60
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60af9f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x685680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], 0
mov byte [esi + 0x18], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x5c], 0xf
mov dword [esi + 0x58], 0
mov byte [esi + 0x48], 0
mov dword [esi + 0x74], 0xf
mov dword [esi + 0x70], 0
mov byte [esi + 0x60], 0
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 5
push 0x44
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko
mov byte [ecx], 0
call fcn.00403850
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0x1388
mov word [esi + 0x9d], 0
mov dword [esi + 0xa0], 0
mov byte [esi + 0x78], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60b92b
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edx + 0x14], 0x10
mov esi, dword [ebp + 8]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x430], 0x400
jb 0x40b7ce
mov edx, dword [edx]
lea eax, [ebp - 0x434]
push eax
push 1
push 0
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b8b5
cmp dword [esi + 0x14], 0x10
jb 0x40b7f5
mov esi, dword [esi]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x434]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40b8b5
mov eax, dword [ebp - 0x430]
test eax, eax
je 0x40b8b5
cmp eax, 0x400
ja 0x40b8b5
dec eax
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], esi
mov byte [ebp - 0x42c], 0
call fcn.00403850
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x40b899
mov edx, dword [ebp - 0x418]
mov esi, dword [ebp - 0x42c]
cmp edx, 0x10
lea eax, [ebp - 0x42c]
cmovae eax, esi
cmp byte [eax + ecx - 1], 0
jne 0x40b899
dec ecx
jne 0x40b883
push ecx
push 0
push edi
lea ecx, [ebp - 0x42c]
call fcn.0040d2e0
lea ecx, [ebp - 0x42c]
call fcn.00401720
jmp 0x40b8c6
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret
Function at 0x4106d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x410711
call fcn.005fa280
mov dword [edi + 4], eax
mov dword [edi], 0x2719
or eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
push esi
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
je 0x41076b
jle 0x410779
call fcn.005fa280
mov dword [edi + 4], eax
mov dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005cd355
mov esp, ebp
pop ebp
ret

Function at 0x410b00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp eax, 0x40
jne 0x410b63
call fcn.005fa280
mov dword [edi], 0x2746
jmp 0x410b75
cmp eax, 0x4d2
jne 0x410b78
call fcn.005fa280
mov dword [edi], 0x274d
mov dword [edi + 4], eax
test ebx, ebx
je 0x410b86
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005fa280
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410ba0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x410be1
call fcn.005fa280
mov dword [edi + 4], eax
mov dword [edi], 0x2719
or eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
je 0x410c3b
jle 0x410c49
call fcn.005fa280
mov dword [edi + 4], eax
mov dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005cd355
mov esp, ebp
pop ebp
ret
Function at 0x411f60
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x411fa0
call fcn.005fa280
mov dword [edi + 4], eax
mov dword [edi], 0x2719
or eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
js 0x412007
call fcn.005fa280
mov dword [edi], 0
mov dword [edi + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.005cd355
mov esp, ebp
pop ebp
ret

Function at 0x412b20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60aee0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x685680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005cda2b
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00403720
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x412bb0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x413a40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 0
push 1
mov esi, ecx
push 0
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x413a95
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
push 1
mov ecx, ebx
mov esi, eax
call dword [edx]
mov dword [esp + 0x18], esi
call fcn.005fa280
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x413b5b
mov esi, dword [esp + 0x10]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x413ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
push 1
mov ecx, ebx
mov esi, eax
call dword [edx]
mov dword [esp + 0x18], esi
call fcn.005fa280
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x413b69
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0
push ebx
push 0x413990
push 0
push 0
mov dword [esp + 0x2c], 0
call fcn.005cebce
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x413b42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
push 1
mov ecx, ebx
mov dword [esp + 0x1c], eax
call dword [edx]
test edi, edi
je 0x413b1f
push edi
call esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 8]
test eax, eax
je 0x413b2d
push eax
call esi
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.005fa280
mov dword [esp + 0x1c], eax
test ebx, ebx
jne 0x413b77
test edi, edi
je 0x413b52
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [esp + 0x18]
call fcn.00416b40
mov edx, str.thread.exit_event
lea ecx, [esp + 0x18]
call fcn.00416b40
mov edx, str.thread
lea ecx, [esp + 0x18]
call fcn.00416b40
int3

Function at 0x413ba0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x413bd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.005fa280
mov dword [esp + 0xc], eax
test esi, esi
jne 0x413bd9
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x650818
lea ecx, [esp + 8]
call fcn.00416b40
int3
Function at 0x413f10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60bbf0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x685680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea eax, [edi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
jne 0x413f78
mov ecx, edi
call fcn.00414200
call fcn.005fa280
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov dword [ecx], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push dword [0x6928dc]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x6928dc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
push ebx
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
xor esi, esi
call fcn.00413ca0
test eax, eax
je 0x413fd7
cmp esi, 0xffffffff
je 0x413fca
inc esi
push ebx
push ecx
mov ecx, edi
call fcn.00413ca0
test eax, eax
jne 0x413fc4
push dword [ebp - 0x14]
push dword [0x6928dc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x413ff6
push ecx
call fcn.004b9997
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4146d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
mov esi, edx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp eax, 0x40
jne 0x41472a
call fcn.005fa280
mov dword [edi], 0x2746
jmp 0x41473c
cmp eax, 0x4d2
jne 0x41473f
call fcn.005fa280
mov dword [edi], 0x274d
mov dword [edi + 4], eax
test ebx, ebx
je 0x41474d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.005fa280
mov dword [edi + 4], eax
mov eax, dword [ebp - 4]
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4148d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov eax, edx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esi
cmp esi, 0xffffffff
je 0x4149b0
cmp byte [ebp + 8], bl
je 0x41491e
test byte [eax], 8
je 0x41491e
xor eax, eax
mov dword [ebp - 4], eax
call fcn.005fa280
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 4]
push eax
sub esp, 8
mov ecx, esi
call fcn.00414850
add esp, 0x14
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
je 0x4149b0
call fcn.005fa280
cmp dword [edi + 4], eax
jne 0x414957
cmp dword [edi], 0x2733
je 0x414969
call fcn.005fa280
cmp dword [edi + 4], eax
jne 0x4149ac
cmp dword [edi], 0x4d5
jne 0x4149ac
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 8]
push 0
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.005fa280
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
jne 0x4149be
call fcn.005fa280
mov dword [edi], 0
mov dword [edi + 4], eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret