joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f219b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.6f218c70
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x6f219b82
call fcn.6f218ca0
test byte [ebx + 0x20], 0x30
jne 0x6f219b9c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x6f219bdd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x6f219c1d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x6f219bd2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x6f219be6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.6f218a60
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x6f219bdd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x6f219c31
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x6f219bfe

Function at 0x6f219c40
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x6f254af8]
test eax, eax
jne 0x6f219c50
xor eax, eax
ret
sub esp, 0x1c
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6f219c90
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x6f219c80
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x6f219c74
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x6f219c76
call fcn.6f218b40
test eax, eax
jne 0x6f219c6d
jmp 0x6f219c74

Function at 0x6f219ca0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6f219ce0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x6f219cd0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.6f218b40
test eax, eax
jne 0x6f219cbd
add esp, 0x1c
ret
Function at 0x6f219de0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6f219e50
test byte [ebx + 0x20], 0xc
jne 0x6f219e10
mov eax, dword [0x6f254af8]
test eax, eax
jne 0x6f219e20
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call sym.hal.dll_pthread_mutex_lock
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x6f219e42
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x6f219e42
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x6f219e61
mov dword [esp], esi
call sym.hal.dll_pthread_mutex_unlock
add esp, 0x14
pop ebx
pop esi
ret
call fcn.6f218b40
mov ebx, eax
test eax, eax
jne 0x6f219e01
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6f219e81
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call sym.hal.dll_pthread_mutex_unlock
call sym.hal.dll__pthread_invoke_cancel
nop

Function at 0x6f219e90
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6f219f10
mov dword [esp], eax
call sym.hal.dll__pthread_time_in_ms_from_timespec
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x6f219f50
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6f219fb0
test edi, edi
je 0x6f219f2a
call sym.hal.dll_pthread_testcancel
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6f219f88
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.hal.dll__pthread_wait_for_single_object
call sym.hal.dll_pthread_testcancel
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6f219fa0
call sym.hal.dll_pthread_testcancel
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call sym.hal.dll_pthread_testcancel
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x6f219ee2
call fcn.6f218b40
mov ebx, eax
jmp 0x6f219ee2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x6f219efe
call fcn.6f218b40
jmp 0x6f219f2a
call fcn.6f218b40
mov ebx, eax
jmp 0x6f219ede
Function at 0x6f219fc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6f21a038
test esi, esi
je 0x6f21a010
call sym.hal.dll_pthread_testcancel
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x6f21a048
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.hal.dll__pthread_wait_for_single_object
call sym.hal.dll_pthread_testcancel
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call sym.hal.dll_pthread_testcancel
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call sym.hal.dll_pthread_testcancel
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.6f218b40
mov ebx, eax
jmp 0x6f219fe5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x6f21a001
Function at 0x6f21a2e0
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_lock
mov eax, ebx
call fcn.6f218400
test eax, eax
je 0x6f21a350
cmp dword [eax + 0xb4], ebx
jne 0x6f21a350
test byte [eax + 0x20], 0xc
jne 0x6f21a350
mov edx, dword [eax + 0x68]
test edx, edx
jne 0x6f21a350
mov eax, dword [eax + 0x14]
sub eax, 1
cmp eax, 0xfffffffd
ja 0x6f21a350
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
test esi, esi
je 0x6f21a370
sub esi, 2
cmp esi, 0x15
ja 0x6f21a378
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp sym.hal.dll_pthread_cancel
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
mov eax, 3
add esp, 0x14
pop ebx
pop esi
ret
xor eax, eax
jmp 0x6f21a361
mov eax, 0x16
jmp 0x6f21a361

Function at 0x6f21a590
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6f21a600
cmp edi, 1
ja 0x6f21a60b
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call sym.hal.dll_pthread_mutex_lock
test ebp, ebp
je 0x6f21a5d8
mov eax, dword [ebx + 0x24]
and eax, 1
mov dword [ebp], eax
mov eax, dword [ebx + 0x24]
and eax, 0xfffffffe
or eax, edi
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0xb4]
call fcn.6f219d50
mov dword [esp], esi
call sym.hal.dll_pthread_mutex_unlock
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6f218b40
mov ebx, eax
test eax, eax
jne 0x6f21a5bb
add esp, 0x1c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6f21a620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x30]
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6f21a698
mov esi, ebp
and esi, 0xfffffffd
jne 0x6f21a6a3
lea edi, [ebx + 0x1c]
mov dword [esp], edi
call sym.hal.dll_pthread_mutex_lock
mov eax, dword [esp + 0x34]
test eax, eax
je 0x6f21a66d
mov eax, dword [ebx + 0x24]
mov edx, dword [esp + 0x34]
and eax, 2
mov dword [edx], eax
mov eax, dword [ebx + 0x24]
and eax, 0xfffffffd
or eax, ebp
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0xb4]
call fcn.6f219d50
mov dword [esp], edi
call sym.hal.dll_pthread_mutex_unlock
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.6f218b40
mov ebx, eax
test eax, eax
jne 0x6f21a647
add esp, 0x1c
mov esi, 0x16
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x6f21a990
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x6f2540f4]
mov dword [esp + 0x1c], eax
xor eax, eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
test esi, esi
je 0x6f21aac8
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_lock
mov eax, esi
call fcn.6f218400
mov dword [esp], 0x6f23605c
mov ebx, eax
call sym.hal.dll_pthread_mutex_unlock
test ebx, ebx
je 0x6f21aac8
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x6f21aac8
lea edx, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
sub esp, 8
test eax, eax
je 0x6f21aac8
test byte [ebx + 0x24], 4
jne 0x6f21aae0
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6f21ab00
cmp esi, dword [eax + 0xb4]
je 0x6f21ab30
mov edx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x14]
test edx, edx
je 0x6f21aa47
lea edx, [eax - 1]
cmp edx, 0xfffffffd
ja 0x6f21aa5e
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebx + 0x14]
sub esp, 8
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x6f21aa7b
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
test edi, edi
je 0x6f21ab18
mov eax, dword [ebx + 4]
mov dword [edi], eax
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym.hal.dll_pthread_mutex_destroy
lea eax, [ebx + 0x38]
mov dword [esp], eax
call sym.hal.dll_pthread_spin_destroy
cmp eax, 1
je 0x6f21ab3c
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x6f21aaf0
xor eax, eax
jmp 0x6f21aacd
mov eax, 3
mov edx, dword [esp + 0x1c]
sub edx, dword [0x6f2540f4]
jne 0x6f21ab37
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, 0x16
jmp 0x6f21aacd
mov eax, ebx
call fcn.6f2188c0
xor eax, eax
jmp 0x6f21aacd
call fcn.6f218b40
test eax, eax
jne 0x6f21aa29
jmp 0x6f21aa35
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym.hal.dll_pthread_mutex_destroy
lea eax, [ebx + 0x38]
jmp 0x6f21aa9d
mov eax, 0x24
jmp 0x6f21aacd
call fcn.6f211f00
call fcn.6f218690
lea esi, cs:[esi]
lea esi, [esi]
Function at 0x6f21ab50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov dword [esp], 0x6f23605c
mov eax, dword [0x6f2540f4]
mov dword [esp + 0x1c], eax
xor eax, eax
call sym.hal.dll_pthread_mutex_lock
mov eax, edi
call fcn.6f218400
test eax, eax
je 0x6f21aca0
mov ebx, eax
mov eax, dword [eax + 0x14]
test eax, eax
je 0x6f21aca0
lea edx, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
sub esp, 8
test eax, eax
je 0x6f21aca0
mov esi, dword [ebx + 0x24]
and esi, 4
jne 0x6f21acb8
call fcn.6f218a80
mov eax, dword [0x6f236064]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6f21acf0
mov esi, dword [eax + 0xb4]
cmp edi, esi
je 0x6f21ad30
mov ecx, dword [ebx + 0x68]
mov eax, dword [ebx + 0x14]
test ecx, ecx
jne 0x6f21ac0f
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x6f21acd0
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x6f21ac2c
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
test ebp, ebp
je 0x6f21ad08
mov eax, dword [ebx + 4]
mov dword [ebp], eax
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym.hal.dll_pthread_mutex_destroy
lea eax, [ebx + 0x38]
mov dword [esp], eax
call sym.hal.dll_pthread_spin_destroy
cmp eax, 1
je 0x6f21ad4b
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x6f21ad20
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
xor eax, eax
mov edx, dword [esp + 0x1c]
sub edx, dword [0x6f2540f4]
jne 0x6f21ad46
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
mov eax, 3
jmp 0x6f21ac83
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
mov eax, 0x16
jmp 0x6f21ac83
mov edx, dword [ebx + 0x68]
test edx, edx
jne 0x6f21ac0c
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
mov eax, 0x10
jmp 0x6f21ac83
call fcn.6f218b40
test eax, eax
jne 0x6f21abd8
jmp 0x6f21abde
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call sym.hal.dll_pthread_mutex_destroy
lea eax, [ebx + 0x38]
jmp 0x6f21ac4f
mov eax, ebx
call fcn.6f2188c0
jmp 0x6f21ac75
mov dword [esp], 0x6f23605c
call sym.hal.dll_pthread_mutex_unlock
mov eax, 0x24
jmp 0x6f21ac83
call fcn.6f211f00
call fcn.6f218690
Function at 0x6f21f890
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
jmp 0x6f21f8f6
mov eax, 4
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
add edx, ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x6f21f8f0
mov eax, 0
jmp 0x6f21f977
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jle 0x6f21f8aa
mov eax, dword [ebp - 0x18]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.resize_unsigned_int_
sub esp, 4
mov dword [ebp - 0xc], 0
jmp 0x6f21f96a
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0xc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov edx, dword [ebp - 0xc]
add eax, edx
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6f21f964
mov eax, 0
jmp 0x6f21f977
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jl 0x6f21f91a
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x6f21f980
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2d]
mov dword [ebp - 0x18], eax
nop
nop
mov eax, dword [ebp - 0x34]
lea ecx, [eax + 4]
lea eax, [ebp - 0x40]
lea edx, [ebp - 0x2d]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_unsigned_int__std::allocator_unsigned_char__const_
sub esp, 8
nop
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov ebx, eax
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
add eax, 4
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov byte [ebp - 0xd], 1
mov dword [ebp - 0xc], 0
nop
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
lock cmpxchg dword [edx], ecx
nop
test eax, eax
setne al
test al, al
jne 0x6f21fa0e
jmp 0x6f21fa9a
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov edx, dword [ebp - 0xc]
sub eax, edx
mov ebx, eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
mov dword [esp], edx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.operator___unsigned_int_
sub esp, 4
mov edx, dword [ebp - 0x4c]
mov edx, dword [edx + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x6f21fa94
mov byte [ebp - 0xd], 0
jmp 0x6f21fab0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov edx, dword [ebp - 0xc]
cmp edx, eax
setb al
test al, al
jne 0x6f21fa3e
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xchg dword [eax], edx
mov ebx, 1
lea eax, [ebp - 0x40]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov eax, ebx
jmp 0x6f21faf1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4
Function at 0x6f21fafc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1e4
mov dword [ebp - 0x1bc], ecx
mov dword [esp], str.Ws2_32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp + 4], str.inet_pton
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1a4]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov edx, eax
mov eax, dword [ebp - 0x1bc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x6f21fb9a
mov eax, 0
jmp 0x6f21fc90
mov dword [esp], 4
call fcn.6f232ad0
mov edx, eax
mov eax, dword [ebp - 0x1bc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax + 0x10]
mov dword [eax], 0
mov word [ebp - 0x1b4], 2
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1b2], ax
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
lea edx, [ebp - 0x1b4]
add edx, 4
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 2
call ebx
sub esp, 0xc
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax + 0xc]
mov edx, eax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x6f21fc47
mov eax, 0
jmp 0x6f21fc90
mov dword [ebp - 0x1b8], 1
mov eax, dword [ebp - 0x1bc]
mov eax, dword [eax + 0xc]
mov edx, eax
mov dword [esp + 0x10], 4
lea eax, [ebp - 0x1b8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 8
Function at 0x401780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x403228
push 0x403230
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp - 8]
mov edx, eax
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call section..text
add esp, 0x10
test eax, eax
je 0x401806
mov edi, dword [ebp - 8]
lea eax, [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push eax
push edi
push esi
push ecx
call fcn.00401350
add esp, 0x10
push 0x4000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10