joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415328
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi + 0x18], ecx
lea ecx, [ebp + 0xc]
mov dword [esi + 0x10], eax
lea eax, [esi + 0x14]
push ecx
push ebx
push eax
mov byte [esi + 0x1d], bl
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
mov dword [eax], esi
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x41536b
push 1
mov byte [esi + 0x1d], bl
pop eax
jmp 0x415373
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x41539c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x1d], bl
je 0x4153db
cmp dword [esi + 8], ebx
je 0x4153db
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4153db
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 4]
call fcn.0041546a
pop ecx
mov dword [esi + 8], ebx
mov byte [esi + 0x1d], bl
pop esi
pop ebx
ret

Function at 0x415419
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
jne 0x415426
mov al, 1
jmp 0x415462
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, eax
push 0x32
call edi
cmp byte [esi + 0x1d], 0
je 0x41545c
cmp dword [esp + 0x14], 0xffffffff
je 0x415454
call ebp
sub eax, ebx
cmp eax, dword [esp + 0x14]
ja 0x415458
push 0x32
jmp 0x41543b
cmp byte [esi + 0x1d], 0
pop edi
pop ebp
sete al
pop ebx
pop esi
ret 4

Function at 0x416332
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x421e98], 0
jne 0x416355
push 0
call fcn.00414caa
push eax
push 0x416374
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x421e98], eax
push 1
pop eax
ret
Function at 0x4164b9
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
mov dword [esp + 0x10], ebp
jne 0x4164e1
xor eax, eax
jmp 0x41660b
push esi
mov ecx, edi
call fcn.0041647d
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [edi + 8], eax
call esi
push eax
push ebx
call esi
push eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [edi + 8]
mov dword [edi + 4], eax
call ebp
push 0x40cc0020
push ebx
push ebx
mov dword [esp + 0x28], eax
push dword [esp + 0x20]
push 1
call esi
push eax
push ebx
call esi
push eax
push ebx
push ebx
push dword [edi + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x416559
push dword [esp + 0x1c]
push dword [edi + 8]
call ebp
mov ecx, edi
mov dword [edi + 4], eax
call fcn.0041647d
xor esi, esi
jmp 0x4165f7
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 1
mov dword [esp + 0x1c], eax
call esi
push eax
push ebx
call esi
push eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [esp + 0x1c]
call ebp
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], 0x80
mov byte [esp + 0x13], bl
push dword [esp + 0x10]
mov dword [esp + 0x24], eax
push 1
call esi
push eax
push ebx
call esi
push eax
push ebx
push ebx
push dword [esp + 0x2c]
push 1
call esi
push eax
push ebx
call esi
push eax
push ebx
push ebx
push dword [edi + 8]
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov esi, eax
cmp esi, ebx
jne 0x4165d6
push dword [esp + 0x1c]
push dword [edi + 8]
call ebp
mov ecx, edi
mov dword [edi + 4], eax
call fcn.0041647d
push dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edi
call ebp
cmp eax, ebx
je 0x4165ec
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp edi, ebx
je 0x4165f7
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x1000afd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000b031
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000b014
cmp edi, 2
jb 0x1000b014
cmp byte [esi], cl
jne 0x1000b014
cmp byte [esi + 1], cl
jne 0x1000b014
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f89d8]
jmp 0x1000afe5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f89d8]
test edi, edi
jne 0x1000afe5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000b060
cmp cl, 0x23
jne 0x1000b047
cmp byte [esi], cl
jne 0x1000b047
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100f89d8]
test cl, cl
jne 0x1000b038
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000b170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1000b184
mov dword [ebx], 0
mov edx, 0x100f8824
call fcn.1000b070
mov esi, eax
test esi, esi
je 0x1000b272
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1000b268
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000b268
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x1000b268
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000b268
mov eax, dword [0x10133a70]
test eax, eax
je 0x1000b1fc
inc dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1000b268
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000b24d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10133a70]
add esp, 4
test eax, eax
je 0x1000b23a
dec dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000b25f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d0a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f89d8]
sub edi, 1
jne 0x1000d0c0
mov ecx, dword [0x10133a70]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1bc8], eax
jne 0x1000d0f2
mov dword [ecx + 0x1bcc], eax
cmp dword [ecx + 0x1c04], eax
jne 0x1000d101
mov byte [ecx + 0x1c08], 1
pop ebp
ret 4
Function at 0x10016410
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10133a70]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1b94]
mov esi, 4
mov eax, dword [edi + 0xc0]
add edi, 0xc0
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100f89d8]
sub esi, 1
jne 0x10016450
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10016497
inc ecx
test esi, esi
je 0x10016485
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1001648a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001bdf0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x1001a9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2ee0], 0
lea esi, [edi + 0x2ee4]
je 0x1001aa42
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001a9fc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1001c0c0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.1000b5a0
mov edx, dword [esi]
mov ecx, 0x10133a6c
push dword [edi + 0x2ee0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2eec]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.1000b5a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001afd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10133a70]
sub esp, 8
push esi
mov esi, ecx
mov dword [eax + 0x2e94], 0
push edi
test esi, esi
je 0x1001b02d
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.1001b040
mov edx, 0x100f8828
mov ecx, esi
mov edi, eax
call fcn.1000b070
mov esi, eax
test esi, esi
je 0x1001b02d
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002486a
mov eax, dword [0x10133a70]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002485d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002489b
mov eax, dword [0x10133a70]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002488e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100248cc
mov eax, dword [0x10133a70]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100248bf
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10024919
mov eax, dword [0x10133a70]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002490c
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002494a
mov eax, dword [0x10133a70]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002493d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002497b
mov eax, dword [0x10133a70]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002496e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10027020
Function at 0x1002cdb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10133a70]
lea eax, [ebp - 0x30]
push esi
push edi
push eax
push dword [0x1013ac60]
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
movd xmm1, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [0x1013ac68]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [0x1013ac6c]
call fcn.100e6220
mov edx, dword [0x1013ac74]
mov ecx, dword [0x1013ac70]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.100e6220
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1013ac6c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1013ac68], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x10133a70]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
cmp byte [esi + 0x357], 0
je 0x1002cee8
cvttss2si eax, dword [esi + 0xe4]
mov dword [ebp - 0xc], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [0x1013ac60]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1002cee8
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1002cf5e
mov ecx, dword [0x1013ac60]
cmp eax, ecx
je 0x1002cf1c
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1002cf5e
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1002cf5e
lea eax, [ebp - 0x20]
push eax
push dword [0x1013ac60]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1002cf5e
movd xmm0, dword [ebp - 0x20]
movd xmm1, dword [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x1002cf6c
or eax, 0xffffffff
jmp 0x1002cf77
mov eax, dword [0x10133a70]
mov eax, dword [eax + 0x1e38]
cmp dword [0x1012edec], eax
je 0x1002cf89
mov dword [0x1012edec], eax
call fcn.1002c9e0
call fcn.1002cb10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x10049f30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10049f61
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10049f50
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x100543f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8fc0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
je 0x100544b0
call fcn.10054b00
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x1013aca8
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
push 0
push ecx
test eax, eax
je 0x1005447c
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x10054492
push method.boost::asio::detail::execution_context_service_base_class_boost::asio::detail::win_iocp_socket_service_class_boost::asio::ip::tcp__.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x100544a9
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.100e50ed
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.1007ca00
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x100544cc
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x100544e3
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.100e50ed
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100544ed
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x10054504
push 0x64
push esi
call fcn.100e50ed
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret 4
Function at 0x10055940
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
cmp ebx, 0xffffffff
je 0x10055b02
cmp byte [ebp + 8], 0
je 0x100559a2
mov al, byte [edx]
test al, 8
je 0x100559a2
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 8]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x18]
setne dl
call fcn.10055620
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
mov ecx, esi
test ebx, ebx
setne dl
call fcn.10055620
test ebx, ebx
je 0x10055af0
mov esi, dword [0x1012ee84]
push edi
mov edi, dword [0x1012ee80]
cmp edi, 0x257edfd1
jne 0x100559dc
cmp esi, 0xb2ab117a
je 0x100559ec
cmp edi, 0x257edfd0
jne 0x100559f0
cmp esi, 0xb2ab117a
jne 0x100559f0
mov al, 1
jmp 0x10055a10
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov esi, dword [0x1012ee84]
mov edi, dword [0x1012ee80]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], 0x2733
mov dword [ebp - 0x14], 0x1012ee78
mov dword [ebp - 0x10], eax
call fcn.10052ca0
test al, al
jne 0x10055aa7
cmp edi, 0x257edfd1
jne 0x10055a46
cmp esi, 0xb2ab117a
je 0x10055a56
cmp edi, 0x257edfd0
jne 0x10055a5a
cmp esi, 0xb2ab117a
jne 0x10055a5a
mov al, 1
jmp 0x10055a6e
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], 0x4d5
mov dword [ebp - 0x14], 0x1012ee78
mov dword [ebp - 0x10], eax
call fcn.10052ca0
test al, al
jne 0x10055aa7
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 8]
push eax
push 0x8004667e
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x20]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.10055620
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
Function at 0x10055b20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1012eb00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push 0
push 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x1012ee80]
mov esi, eax
mov ecx, dword [0x1012ee84]
cmp edx, 0x257edfd1
jne 0x10055b82
cmp ecx, 0xb2ab117a
je 0x10055b92
cmp edx, 0x257edfd0
jne 0x10055b99
cmp ecx, 0xb2ab117a
jne 0x10055b99
test esi, esi
setne al
jmp 0x10055ba9
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push esi
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov ebx, 0x1ffff7
mov dword [edi], esi
mov dword [edi + 4], 0x1012ee78
mov dword [ebp - 0x10], ebx
lea eax, [ecx + 2]
mov dword [edi + 8], eax
cmp ecx, 0xffffffff
je 0x10055bd1
mov eax, esi
mov ebx, 0x1012ee78
jmp 0x10055be5
xor edx, edx
mov eax, 0x1012ee78
div ebx
mov ebx, dword [edi + 4]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x40
jne 0x10055c3c
mov ecx, dword [0x1012ee80]
mov eax, dword [0x1012ee84]
cmp ecx, 0x257edfd1
jne 0x10055c04
cmp eax, 0xb2ab117a
je 0x10055c13
cmp ecx, 0x257edfd0
jne 0x10055c20
cmp eax, 0xb2ab117a
jne 0x10055c20
mov al, 1
mov dword [edi], 0x2746
jmp 0x10055ca2
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [edi], 0x2746
jmp 0x10055ca2
cmp ecx, 0xffffffff
je 0x10055c45
mov eax, esi
jmp 0x10055c54
xor edx, edx
mov eax, ebx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x4d2
jne 0x10055cb4
mov ecx, dword [0x1012ee80]
mov eax, dword [0x1012ee84]
cmp ecx, 0x257edfd1
jne 0x10055c75
cmp eax, 0xb2ab117a
je 0x10055c84
cmp ecx, 0x257edfd0
jne 0x10055c88
cmp eax, 0xb2ab117a
jne 0x10055c88
mov al, 1
jmp 0x10055c9c
mov eax, dword [0x1012ee78]
mov ecx, 0x1012ee78
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [edi], 0x274d
movzx eax, al
add eax, 2
mov dword [edi + 4], 0x1012ee78
mov dword [edi + 8], eax
jmp 0x10055cf3
cmp ecx, 0xffffffff
je 0x10055cbd
mov eax, esi
jmp 0x10055ccc
xor edx, edx
mov eax, ebx
div dword [ebp - 0x10]
imul eax, edx, 0x3e8
add eax, esi
cmp eax, 0x2738
je 0x10055d0d
cmp ecx, 0xffffffff
jne 0x10055ceb
xor edx, edx
mov eax, ebx
mov ecx, 0x1ffff7
div ecx
imul eax, edx, 0x3e8
add esi, eax
cmp esi, 0xea
je 0x10055d0d
cmp dword [ebp - 0x14], 0
je 0x10055d0d
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e4fca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [edi], xmm0
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
call fcn.100e4fca
mov esp, ebp
pop ebp
ret