joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412aff
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x412a73
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x412a6e
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x412a58
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x412a60
cmp edx, ebx
jne 0x412bae
invalid
add byte [ebx + 0x45830448], cl
or byte [edx], al
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x412a2f
add eax, dword [eax + 4]
jmp 0x412a1c
mov dword [ebp + 0xc], ebx
jmp 0x412a7e
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x412a96
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x412ab4
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x412b12
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x412af9
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x412b02
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x412b0c
add ecx, eax
or byte [ecx], 4
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x412aee
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x412a78
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x4137e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x413815
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x4137bf
call fcn.004123bf
movsb byte es:[edi], byte [esi]
add al, 0xbd
cli
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
invalid
test edi, ebx
Function at 0x413c65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x73d], 0x99
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.004123cf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00412384
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.004123bf
inc byte [ebx + 0x6b]
scasb al, byte es:[edi]
lea eax, [ebp - 0x6f4]
push eax
call fcn.004123cf
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00412384
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x414465
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
invalid

Function at 0x413f78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.004123cf
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00412330
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x414337

Function at 0x416407
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x41640c
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x41642b
push 0
push 0x5e
push str.E:2020poco_poco_1.10.1Foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0040be73
add esp, 0x10
lea eax, [esi + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x416436
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x416460
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x416464
cmp eax, 3
jbe 0x41645c
cmp eax, 0xf
je 0x41645c
cmp eax, 0x15
jne 0x416464
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00416578
int3

Function at 0x4168d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x4168f6
push 0
push 0x9f
push str.E:2020poco_poco_1.10.1Foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0040be73
add esp, 0x10
lea eax, [esi + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x416901
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416914
shr eax, 4
and al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.00416578
int3
Function at 0x416923
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x416923
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x416945
push 0
push 0xaa
push str.E:2020poco_poco_1.10.1Foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.0040be73
add esp, 0x10
lea eax, [esi + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x416950
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41696b
and eax, 0x410
cmp eax, 0x400
pop esi
sete al
ret
lea eax, [esi + 4]
push eax
call fcn.00416578
int3

Function at 0x417012
Capabilities:
Query environment variable

Disassembly:
push 0x60
mov eax, 0x4871a9
call fcn.004304dd
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x6c], esi
and dword [ebp - 0x58], 0
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
push ebx
call fcn.0040e300
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
je 0x4170e4
push edi
lea ecx, [ebp - 0x68]
call fcn.0040e88c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
push dword [ebp - 0x60]
cmovae eax, dword [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
push esi
lea eax, [edi - 1]
mov dword [ebp - 0x58], 1
push eax
push dword [ebp - 0x60]
call fcn.0040e483
add esp, 0xc
cmp byte [ebp - 0x5c], 0
je 0x4170c2
push dword [ebp - 0x60]
call fcn.0043045c
pop ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4170dc
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x28]
call fcn.00404206
pop ecx
pop ecx
mov eax, esi
call fcn.00430487
ret
push 0
push ebx
lea ecx, [ebp - 0x54]
call fcn.00408b41
push 0x4c44ec
lea eax, [ebp - 0x54]
push eax
call fcn.004519dc
int3

Function at 0x417173
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 6
xor ebx, ebx
push ebx
push dword [ebp + 8]
call fcn.00451800
mov eax, 0x288
push eax
mov dword [ebp - 4], eax
call fcn.00430f2d
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
add esp, 0x10
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call esi
cmp eax, 0x6f
jne 0x4171c0
push edi
call fcn.0043045c
push dword [ebp - 4]
call fcn.00430f2d
pop ecx
pop ecx
mov edi, eax
jmp 0x4171c4
test eax, eax
jne 0x41720e
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
jne 0x417207
mov esi, edi
test edi, edi
je 0x417207
test bl, bl
jne 0x417207
cmp dword [esi + 0x1a0], 6
jne 0x417201
cmp dword [esi + 0x190], 6
jne 0x417201
push 6
lea eax, [esi + 0x194]
inc bl
push eax
push dword [ebp + 8]
call fcn.00450d00
add esp, 0xc
mov esi, dword [esi]
test esi, esi
jne 0x4171d5
push edi
call fcn.0043045c
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f05e
Capabilities:
Create service
Persist via windows service

Disassembly:
push 0x90
mov eax, 0x48856b
call fcn.004304dd
mov ebx, ecx
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.0041effa
and dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.0040e300
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
push esi
call fcn.0040e300
xor esi, esi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push edi
call fcn.0040e300
add esp, 0x18
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x58]
push 8
pop edi
cmp dword [ebp - 0x14], edi
push esi
cmovae edx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], edi
push esi
cmovae ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x44], edi
push esi
cmovae eax, dword [ebp - 0x58]
push esi
push esi
push edx
push 1
push 3
push 0x10
push 0xf01ff
push ecx
push eax
push dword [ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x41f18c
mov eax, dword [ebp - 0x14]
cmp eax, edi
jb 0x41f137
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x28]
call fcn.00404206
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], esi
push 7
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
pop ebx
mov dword [ebp - 0x14], ebx
cmp eax, edi
jb 0x41f15f
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.00404206
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x30], esi
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], ebx
cmp eax, edi
jb 0x41f184
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x58]
call fcn.00404206
pop ecx
pop ecx
call fcn.00430487
ret 8
push str.cannot_register_service
lea ecx, [ebp - 0x70]
call fcn.0040587c
push esi
push ebx
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x9c]
call fcn.00408f19
push 0x4c456c
lea eax, [ebp - 0x9c]
push eax
call fcn.004519dc
int3

Function at 0x41f255
Capabilities:
Modify service

Disassembly:
push 0x48
mov eax, 0x48684b
call fcn.004304dd
mov esi, ecx
call fcn.0041f012
mov eax, dword [ebp + 8]
xor edi, edi
sub eax, edi
je 0x41f288
sub eax, 1
je 0x41f284
sub eax, 1
je 0x41f280
or eax, 0xffffffff
jmp 0x41f28b
push 4
jmp 0x41f28a
push 3
jmp 0x41f28a
push 2
pop eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x41f2ac
call fcn.00430487
ret 4
push str.cannot_change_service_startup_mode
lea ecx, [ebp - 0x28]
call fcn.0040587c
push edi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x54]
call fcn.00408f3e
push 0x4c456c
lea eax, [ebp - 0x54]
push eax
call fcn.004519dc
int3
Function at 0x420979
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x488a0a
call fcn.004304dd
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
call fcn.00420859
and dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.0040e300
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push esi
call fcn.0040e300
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
add esp, 0x10
lea edx, [ebp - 0x40]
lea eax, [eax*2 + 2]
push 8
pop esi
cmp dword [ebp - 0x14], esi
push eax
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], esi
push ecx
cmovae edx, dword [ebp - 0x40]
push 1
push 0
push edx
push dword [edi + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x420a52
mov eax, dword [ebp - 0x14]
cmp eax, esi
jb 0x420a20
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x28]
call fcn.00404206
pop ecx
pop ecx
and dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
cmp eax, esi
jb 0x420a4a
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x40]
call fcn.00404206
pop ecx
pop ecx
call fcn.00430487
ret 8
push ebx
mov ecx, edi
call fcn.00420706
int3

Function at 0x422389
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x488bd2
call fcn.004304a9
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00422c74
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0x4227fa
push ebx
push ebx
call fcn.0045c0c8
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0x4223f1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp + 8]
push eax
call fcn.004055ea
pop ecx
pop ecx
cmp dword [ebp + 8], ebx
je 0x4223e7
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.0042393c
mov eax, esi
call fcn.00430472
ret 4
push 6
mov dword [edi], ebx
call fcn.0042f918
int3

Function at 0x42306b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 8], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret 8

Function at 0x42306f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esi + 8], eax
push dword [0x4d5728]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret 8
Function at 0x4241c2
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
cmp edi, 0xffffffff
je 0x4242b1
cmp byte [esp + 0x24], 0
mov ebp, dword [esp + 0x20]
je 0x424217
test byte [ebp], 8
je 0x424217
xor eax, eax
mov dword [esp + 0x1c], eax
call fcn.004227a5
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push 0x80
push 0xffff
push ebp
push edi
call fcn.004257c4
add esp, 0x1c
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00422b53
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4242b1
call fcn.00425cac
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x2733
call fcn.004060e5
pop ecx
pop ecx
test al, al
jne 0x424279
call fcn.00425cac
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x4d5
call fcn.004060e5
pop ecx
pop ecx
test al, al
je 0x4242ad
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [ebp], 0xfc
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
call fcn.00422b53
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x4242bc
call fcn.004227a5
and dword [ebx], 0
mov dword [ebx + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x424fff
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x4d5734
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x425049
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x42505f
push method.Poco::Util::Subsystem.virtual_20
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
leave
ret
Function at 0x4257c4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
or edi, 0xffffffff
cmp dword [ebp + 8], edi
jne 0x4257e8
call fcn.00425cac
mov ecx, dword [ebp + 0x20]
mov dword [ecx + 4], eax
mov eax, edi
mov dword [ecx], 0x2719
jmp 0x42589b
cmp dword [ebp + 0x10], 0xa5100000
push esi
mov esi, dword [ebp + 0x14]
jne 0x42584a
cmp esi, 2
jne 0x425810
call fcn.00425cac
mov ecx, dword [ebp + 0x20]
mov dword [ecx], 0x2726
mov dword [ecx + 4], eax
jmp 0x425898
cmp esi, 1
jne 0x425861
cmp dword [ebp + 0x1c], 4
jne 0x4257fa
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
mov al, cl
or cl, 4
and al, 0xfb
movzx edx, cl
movzx ecx, al
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
cmove edx, ecx
mov byte [esi], dl
call fcn.004227a5
mov ecx, dword [ebp + 0x20]
and dword [ecx], 0
mov dword [ecx + 4], eax
xor eax, eax
jmp 0x42589a
cmp dword [ebp + 0x10], 0xffff
jne 0x425861
cmp esi, 0x80
jne 0x425861
mov eax, dword [ebp + 0xc]
or byte [eax], 8
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [ebp + 0x20]
push esi
push eax
call fcn.00422b53
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x425898
call fcn.004227a5
and dword [esi], edi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebp
ret

Function at 0x425be0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4cf284]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, dword [ebp + 8]
inc eax
lock xadd dword [esi], eax
inc eax
cmp eax, 1
jne 0x425c29
movzx ecx, byte [ebp + 0x10]
lea eax, [ebp - 0x194]
push eax
movzx eax, byte [ebp + 0xc]
shl cx, 8
or cx, ax
movzx eax, cx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea ecx, [esi + 4]
xchg dword [ecx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00430461
leave
ret
Function at 0x42edf4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x42ee18
jl 0x42ee0f
test esi, esi
jne 0x42ee18
xor eax, eax
xor edx, edx
jmp 0x42ef0f
cmp dword [edi + 0x38], 0
je 0x42ee2d
push ebx
push esi
push dword [ebp + 8]
call fcn.0040cd75
jmp 0x42ef0f
mov eax, dword [edi + 0x1c]
mov edx, esi
mov dword [ebp - 8], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x42ee42
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x42ee44
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
test eax, eax
je 0x42ee85
cmp eax, esi
jb 0x42ee57
mov eax, esi
mov dword [ebp - 4], eax
push eax
push ecx
push dword [ebp + 8]
call fcn.00450d00
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp + 8]
sub edx, ecx
add eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], edx
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x42ee8b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x42ef03
mov ecx, edi
call fcn.0042e79f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x42eedf
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.0045dbf9
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x42eedb
cmp edx, eax
ja 0x42eea8
jmp 0x42eee2
sub esi, edx
jmp 0x42ef08
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x42ef06
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.0045dbf9
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x42ef06
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43bd3e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1001d270
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081600
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov eax, dword [0x101dea44]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x6c]
call fcn.1001e760
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0x101de1d4
lea ecx, [ebp - 0x20]
call fcn.100511f0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1001d2e8
mov dword [ebp - 0x34], 0
jmp 0x1001d318
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
add ecx, 1
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x70]
mov al, byte [edx]
mov byte [ebp - 0x75], al
add dword [ebp - 0x70], 1
cmp byte [ebp - 0x75], 0
jne 0x1001d2f7
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x74]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
call fcn.10027950
mov byte [ebp - 4], 1
mov edx, 0xce7bad2c
test edx, edx
jl 0x1001d347
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0xce7bad2c
jge 0x1001d351
push 0x80070057
call fcn.1001d020
jmp 0x1001d360
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x20]
sub edx, 0x10
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.10027aa0
add esp, 4
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
add ecx, 0x10
mov dword [ebp - 0x28], ecx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x1c]
call fcn.1001f8b0
lea ecx, [ebp - 0x28]
call fcn.10022aa0
lea ecx, [ebp - 0x20]
call fcn.10022aa0
lea ecx, [ebp - 0x1c]
call fcn.10035d60
jmp 0x1001d3bb
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret