joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410f49
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x6ba680
call fcn.006b9c3c
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x28], edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 1
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
mov byte [ebp - 4], 3
mov esi, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 8]
mov eax, ecx
dec ecx
mov dword [ebp + 8], ecx
test eax, eax
je 0x411039
mov al, byte [edx]
mov byte [ebp + esi - 0x14], al
inc esi
mov dword [ebp - 0x20], esi
inc edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edx
cmp esi, 3
jne 0x410f99
movzx ecx, byte [ebp - 0x14]
mov eax, ecx
shr eax, 2
mov byte [ebp - 0x18], al
movzx edx, byte [ebp - 0x13]
mov eax, edx
shr eax, 4
and ecx, esi
shl ecx, 4
add eax, ecx
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
movzx eax, cl
shr eax, 6
and edx, 0xf
lea eax, [eax + edx*4]
mov byte [ebp - 0x16], al
and cl, 0x3f
mov byte [ebp - 0x15], cl
mov esi, ebx
mov dword [ebp - 0x20], esi
cmp esi, 4
jge 0x41102c
mov ecx, 0x78fb3c
cmp dword [0x78fb50], 0x10
cmovae ecx, dword [0x78fb3c]
movzx eax, byte [ebp + esi - 0x18]
mov al, byte [eax + ecx]
mov byte [ebp - 0x2c], al
push dword [ebp - 0x2c]
push 1
lea ecx, [ebp - 0x58]
call fcn.00411eec
inc esi
jmp 0x410ff6
mov esi, ebx
mov dword [ebp - 0x20], esi
mov edx, dword [ebp - 0x30]
jmp 0x410f96
test esi, esi
je 0x4110d8
mov eax, esi
mov dword [ebp - 0x1c], eax
cmp eax, 3
jge 0x411052
mov byte [ebp + eax - 0x14], bl
inc eax
jmp 0x411043
movzx ecx, byte [ebp - 0x14]
mov eax, ecx
shr eax, 2
mov byte [ebp - 0x18], al
movzx edx, byte [ebp - 0x13]
mov eax, edx
shr eax, 4
and ecx, 3
shl ecx, 4
add eax, ecx
mov byte [ebp - 0x17], al
movzx eax, byte [ebp - 0x12]
shr eax, 6
and edx, 0xf
lea eax, [eax + edx*4]
mov byte [ebp - 0x16], al
mov edx, ebx
mov dword [ebp - 0x1c], edx
lea eax, [esi + 1]
cmp edx, eax
jge 0x4110bf
mov ecx, 0x78fb3c
cmp dword [0x78fb50], 0x10
cmovae ecx, dword [0x78fb3c]
movzx eax, byte [ebp + edx - 0x18]
mov al, byte [eax + ecx]
mov byte [ebp - 0x30], al
push dword [ebp - 0x30]
push 1
lea ecx, [ebp - 0x58]
call fcn.00411eec
mov edx, dword [ebp - 0x1c]
inc edx
jmp 0x411084
mov eax, esi
inc esi
mov dword [ebp - 0x20], esi
cmp eax, 3
jge 0x4110d8
push 0x3d
push 1
lea ecx, [ebp - 0x58]
call fcn.00411eec
jmp 0x4110bf
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
cmp dword [edi + 0x14], 0x10
jb 0x4110f2
mov eax, dword [edi]
jmp 0x4110f4
mov eax, edi
mov byte [eax], bl
lea eax, [ebp - 0x58]
push eax
mov ecx, edi
call fcn.0041208e
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
push ebx
push eax
lea ecx, [ebp - 0x58]
call fcn.00411bc8
mov byte [ebp - 4], 1
test ebx, ebx
je 0x411124
mov ecx, ebx
call fcn.0040f5b8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4146d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov ecx, 0x7a55bc
lock xadd dword [ecx], eax
push 0
push dword [esi + 4]
test eax, eax
je 0x414719
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
jmp 0x41472f
push fcn.004146a3
call dword [sym.imp.KERNEL32.DLL_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414734
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
mov edi, ecx
push eax
push eax
push 1
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov esi, dword [ebp + 8]
mov ebx, eax
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x414797
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [esi]
mov ecx, esi
push 1
mov edi, eax
call dword [edx]
call fcn.0040fadb
mov esi, eax
mov dword [ebp - 0x14], edi
mov edx, esi
mov ecx, edi
call fcn.0040f930
mov edx, str.thread.entry_event
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], esi
call fcn.0041037a
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [edi + 8], eax
mov dword [esi + 8], eax
cmp dword [edi + 8], 0
jne 0x4147ec
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [esi]
mov ecx, esi
push 1
mov edi, eax
call dword [edx]
call fcn.0040fadb
mov esi, eax
mov dword [ebp - 0x14], edi
mov edx, esi
mov ecx, edi
call fcn.0040f930
mov edx, str.thread.exit_event
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], esi
call fcn.0041037a
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 4]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x41487e
push dword [ebp + 0xc]
push 0
call fcn.00694f05
add esp, 0x18
mov dword [edi + 4], eax
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
jne 0x414865
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [esi]
mov ecx, esi
push 1
mov dword [ebp + 8], eax
call dword [edx]
test ebx, ebx
je 0x41482e
push ebx
call edi
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x41483c
push dword [eax + 8]
call edi
call fcn.0040fadb
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, esi
mov dword [ebp - 0x14], eax
mov ecx, eax
call fcn.0040f930
mov edx, str.thread
mov byte [ebp - 0x10], al
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], esi
call fcn.0041037a
test ebx, ebx
je 0x414875
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ebx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414e09
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x6bb033
call fcn.006b9c3c
sub esp, 0x34
xor edx, edx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x414e4d
call fcn.00414f2a
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], bl
call fcn.0040fadb
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x414ee4
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 0x30], ebx
call fcn.00582d73
pop ecx
mov dword [ebp - 4], ebx
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], 2
mov ecx, esi
push dword [0x7a5694]
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x7a5694]
call edi
mov byte [ebp - 4], 3
jmp 0x414eb4
cmp ebx, 0xffffffff
lea eax, [ebx + 1]
cmove eax, ebx
mov ebx, eax
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
push ecx
mov ecx, esi
call fcn.00415033
test eax, eax
jne 0x414ea9
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push dword [0x7a5694]
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.004140a1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4155bd
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ebx, edx
cmp edi, 0xffffffff
je 0x415694
cmp byte [ebp + 8], 0
je 0x415613
test byte [ebx], 8
je 0x415613
xor eax, eax
and dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov byte [ebp - 0xc], al
call fcn.0040fadb
mov dword [ebp - 8], eax
mov edx, ebx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
call fcn.00415a77
add esp, 0x14
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.0041556d
test esi, esi
je 0x415694
push ecx
push 0x2733
lea ecx, [ebp - 0x10]
call fcn.0041cb8b
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x10]
call fcn.0041400d
test al, al
jne 0x415667
push ecx
push 0x4d5
lea ecx, [ebp - 0x10]
call fcn.0041cb8b
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x10]
call fcn.0041400d
test al, al
je 0x415694
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [ebx], 0xfc
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.0041556d
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41569d
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
cmp ecx, 0xffffffff
jne 0x4156b7
mov ecx, dword [ebp + 0xc]
push 0x2719
call fcn.0041cb53
or eax, 0xffffffff
pop ebp
ret
push esi
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
setne dl
call fcn.0041556d
mov eax, esi
pop esi
pop ebp
ret

Function at 0x415a77
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
or esi, 0xffffffff
cmp ecx, esi
jne 0x415a94
push 0x2719
mov ecx, dword [ebp + 0x18]
call fcn.0041cb53
jmp 0x415b18
cmp dword [ebp + 8], 0xa5100000
mov eax, dword [ebp + 0xc]
jne 0x415ae5
cmp eax, 2
jne 0x415aac
push 0x2726
jmp 0x415a87
cmp eax, 1
jne 0x415af8
cmp dword [ebp + 0x14], 4
jne 0x415aa5
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x415ac4
or byte [edx], 4
jmp 0x415ac7
and byte [edx], 0xfb
push edi
mov edi, dword [ebp + 0x18]
xor ecx, ecx
mov esi, dword [edi + 8]
mov edx, esi
and dword [edi], 0
call fcn.0040f930
mov byte [edi + 4], al
xor eax, eax
mov dword [edi + 8], esi
pop edi
jmp 0x415b1a
cmp dword [ebp + 8], 0xffff
jne 0x415af8
cmp eax, 0x80
jne 0x415af8
or byte [edx], 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp + 0x18]
mov esi, eax
test esi, esi
setne dl
call fcn.0041556d
mov eax, esi
pop esi
pop ebp
ret

Function at 0x415b74
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp ecx, 0xffffffff
jne 0x415b94
mov ecx, dword [ebp + 0xc]
push 0x2719
call fcn.0041cb53
or eax, 0xffffffff
jmp 0x415bcd
push esi
xor eax, eax
mov dword [ebp - 0x100], ecx
push eax
push eax
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x104], 1
push eax
lea eax, [ecx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
sets dl
call fcn.0041556d
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415bd1
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp ecx, 0xffffffff
jne 0x415bf1
mov ecx, dword [ebp + 0xc]
push 0x2719
call fcn.0041cb53
or eax, 0xffffffff
jmp 0x415c2a
push esi
xor edx, edx
mov dword [ebp - 0x100], ecx
push edx
push edx
lea eax, [ebp - 0x104]
mov dword [ebp - 0x104], 1
push eax
push edx
lea eax, [ecx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
sets dl
call fcn.0041556d
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415c2e
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp ecx, 0xffffffff
jne 0x415c4e
mov ecx, dword [ebp + 8]
push 0x2719
call fcn.0041cb53
or eax, 0xffffffff
jmp 0x415c98
xor eax, eax
mov dword [ebp - 0x204], ecx
inc eax
mov dword [ebp - 0x100], ecx
push esi
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
push 0
push eax
lea eax, [ebp - 0x208]
push eax
push 0
lea eax, [ecx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp + 8]
mov esi, eax
test esi, esi
sets dl
call fcn.0041556d
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x422dcc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x422e27
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x422e18
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x422e14
cmp esi, ecx
jae 0x422e18
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x422e02
cmp esi, ecx
jb 0x422e1c
xor eax, eax
jmp 0x422e26
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x42436d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, edx
cmp ecx, 0xffffffff
jne 0x42438d
mov ecx, dword [ebp + 0xc]
push 0x2719
call fcn.0041cb53
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x8004667e
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [ebp + 0xc]
mov esi, eax
test esi, esi
sets dl
call fcn.0041556d
test esi, esi
pop esi
js 0x424386
or byte [edi], 2
mov al, 1
jmp 0x424388
Function at 0x42442e
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
xor eax, eax
xor ebx, ebx
push esi
inc eax
mov dword [ebp - 0x10], ebx
push edi
mov dword [ebp - 0x224], eax
mov esi, ecx
mov dword [ebp - 0x120], eax
mov edi, edx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x220], esi
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], esi
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0xc], ebx
push eax
push ebx
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x424486
xor al, al
jmp 0x4244ea
push edi
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x1007
push ecx
mov ecx, esi
call fcn.00415b1d
add esp, 0x14
test eax, eax
jne 0x4244e8
cmp dword [ebp - 4], ebx
je 0x4244d4
call fcn.0040fadb
mov ecx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov dword [ebp - 0x1c], ecx
call fcn.0040f930
mov dword [ebp - 0x14], esi
lea esi, [ebp - 0x1c]
mov byte [ebp - 0x18], al
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x4244e8
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, esi
mov dword [edi], ebx
call fcn.0040f930
mov byte [edi + 4], al
mov dword [edi + 8], esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42473a
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, ecx
push esi
test edx, edx
jne 0x424793
cmp dword [ebp + 8], edx
jne 0x424793
cmp dword [ebp + 0xc], edx
jne 0x424793
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4247b2
mov eax, dword [ecx + 4]
mov esi, 0x3e8
cdq
idiv esi
imul ecx, dword [ecx], 0x3e8
push edi
push 1
add eax, ecx
pop ecx
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov esi, dword [edi + 8]
mov edx, esi
and dword [edi], 0
call fcn.0040f930
mov byte [edi + 4], al
xor eax, eax
mov dword [edi + 8], esi
pop edi
jmp 0x4247d2
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4247b2
cmp dword [ecx], 0
jne 0x4247b2
cmp dword [ecx + 4], 0
jle 0x4247b2
mov esi, 0x3e8
cmp dword [ecx + 4], esi
jge 0x4247b2
mov dword [ecx + 4], esi
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [ebp + 0x14]
mov esi, eax
test esi, esi
sets dl
call fcn.0041556d
mov eax, esi
pop esi
pop ebp
ret
Function at 0x424efb
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6bcbef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.boost::asio::detail::select_reactor.0
mov dword [ebp - 4], 4
call fcn.00424fd8
mov byte [ebp - 4], 3
lea eax, [esi + 0xa8]
push 0x424138
push 3
push 0xc
push eax
call fcn.00689e62
mov byte [ebp - 4], 2
lea eax, [esi + 0x38]
push 0x424fa5
push 4
push 0x1c
push eax
call fcn.00689e62
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00424cee
mov byte [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x424f92
push 0xdc
push esi
call fcn.0068a1b1
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4255f7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x425612
push 0
push 0
jmp 0x425668
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x425625
push 0
push 0x2719
jmp 0x425668
and dword [ebp + 0x18], 0
lea ecx, [ebp + 0x18]
push esi
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
pop esi
je 0x425675
cmp eax, 0x3e5
je 0x425675
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
mov ecx, dword [edi + 4]
call fcn.0042400c
jmp 0x425680
push dword [ebp + 0x1c]
mov ecx, dword [edi + 4]
call fcn.00423f92
pop edi
pop ebp
ret 0x18

Function at 0x425685
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x4256a0
push 0
push 0
jmp 0x425709
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x4256b3
push 0
push 0x2719
jmp 0x425709
mov eax, dword [ebp + 0x14]
and dword [ebp + 0x18], 0
push edi
push 0
push dword [ebp + 0x1c]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4256ec
mov eax, 0x2746
jmp 0x4256f9
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test edi, edi
pop edi
je 0x425716
cmp eax, 0x3e5
je 0x425716
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.0042400c
jmp 0x425721
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.00423f92
pop esi
pop ebp
ret 0x18
Function at 0x425e92
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x6bcdb5
call fcn.006b9c3c
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
lea esi, [edi + 0x14]
mov dword [edi + 0xc], ebx
mov ecx, esi
mov dword [edi + 0x10], ebx
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.004aff9e
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov byte [ebp - 4], 4
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov byte [ebp - 4], 5
push ebx
push 1
call fcn.00410c7d
pop ecx
pop ecx
mov dword [edi + 0x34], eax
mov byte [ebp - 4], 6
mov byte [edi + 0x38], 1
or dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a3e7
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x6bd781
call fcn.006b9c3c
sub esp, 0x118
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov byte [ebp - 4], 2
mov esi, dword [ebp + 0x18]
push 0x73b808
lea ecx, [ebp - 0x30]
call fcn.004a63fc
mov byte [ebp - 4], 3
push dword [0x7a01a8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
mov dword [ebp - 0x18], ebx
cmp ebx, 1
jle 0x42a44a
push edi
lea ecx, [esi + 9]
add ecx, ebx
push ecx
lea ecx, [ebp - 0x30]
call fcn.004ab8d1
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push ebx
push eax
push dword [0x7a01a8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
call fcn.004a61c7
mov esi, dword [eax]
lea ebx, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004a61c7
mov dword [ebp - 0x34], ebx
cmp ebx, dword [eax]
je 0x42a499
cmp word [ebx], di
je 0x42a499
add ebx, 2
jmp 0x42a488
push esi
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004a61f7
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x18], ebx
jle 0x42a50b
push str._r_nMaster:
lea ecx, [ebp - 0x124]
call fcn.004a3f6b
mov ecx, eax
call fcn.004a3f39
push eax
lea ecx, [ebp - 0x64]
call fcn.00411aae
mov byte [ebp - 4], 4
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x94]
call fcn.00461060
mov byte [ebp - 4], 5
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x30]
call fcn.004abef0
mov byte [ebp - 4], 4
push edi
push ebx
lea ecx, [ebp - 0x94]
call fcn.004ab703
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
jmp 0x42a565
push str.Master:
lea ecx, [ebp - 0xf0]
call fcn.004a3e98
mov ecx, eax
call fcn.004a3e66
push eax
lea ecx, [ebp - 0x7c]
call fcn.00411aae
mov byte [ebp - 4], 6
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0xac]
call fcn.00461060
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x30]
call fcn.004abef0
mov byte [ebp - 4], 6
push edi
push ebx
lea ecx, [ebp - 0xac]
call fcn.004ab703
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
push edi
push ebx
call fcn.00411bc8
lea edx, [ebp + 8]
lea ecx, [ebp - 0xc4]
call fcn.00461060
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x42a586
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x30]
call fcn.004a6263
mov byte [ebp - 4], 3
push edi
push ebx
lea ecx, [ebp - 0xc4]
call fcn.004ab703
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
push dword [0x7a01a8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push 7
push 0x115
push dword [0x7a01a8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x30]
call fcn.004ab703
mov byte [ebp - 4], bl
test edi, edi
je 0x42a5e8
mov ecx, edi
call fcn.0040f5b8
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00411bc8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42cdb0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x6bdec4
call fcn.006b9c3c
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae ecx, dword [ebp + 8]
xor eax, eax
cmp edx, edi
sete al
push eax
push ebx
push ebx
push ecx
push 0x73ba4c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x73a9b8
mov ecx, esi
call fcn.00411aae
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.00411bc8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret