joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d1e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd0
mov edx, dword [esp + 0xd4]
xor eax, eax
push esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x65
mov dword [esp + 0xc], 0x66
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 7
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 9
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x30], 0xb
mov dword [esp + 0x34], 0xc
mov dword [esp + 0x38], 0xd
mov dword [esp + 0x3c], 0x6271
mov dword [esp + 0x40], 0x6272
mov dword [esp + 0x44], 0x6273
mov dword [esp + 0x48], 0x6274
mov dword [esp + 0x4c], 0x6275
mov dword [esp + 0x50], 0x6276
mov dword [esp + 0x54], 0x6277
mov dword [esp + 0x58], 0x6278
mov dword [esp + 0x5c], 0xfd
mov dword [esp + 0x60], 0x6339
mov dword [esp + 0x64], 0x633a
mov dword [esp + 0x68], 0x633b
mov dword [esp + 0x6c], str.decimal
mov dword [esp + 0x70], str.tinyint
mov dword [esp + 0x74], str.bool
mov dword [esp + 0x78], str.smallint
mov dword [esp + 0x7c], 0x101643f4
mov dword [esp + 0x80], str.float
mov dword [esp + 0x84], str.double
mov dword [esp + 0x88], str.timestamp
mov dword [esp + 0x8c], str.bigint
mov dword [esp + 0x90], str.mediumint
mov dword [esp + 0x94], str.date
mov dword [esp + 0x98], str.time
mov dword [esp + 0x9c], str.datetime
mov dword [esp + 0xa0], str.year
mov dword [esp + 0xa4], str.tinyblob
mov dword [esp + 0xa8], str.tinytext
mov dword [esp + 0xac], str.text
mov dword [esp + 0xb0], str.blob
mov dword [esp + 0xb4], str.mediumblob
mov dword [esp + 0xb8], str.mediumtext
mov dword [esp + 0xbc], str.longblob
mov dword [esp + 0xc0], str.longtext
mov dword [esp + 0xc4], str.varchar
mov dword [esp + 0xc8], str.enum
mov dword [esp + 0xcc], 0x10164334
mov dword [esp + 0xd0], str.char
lea ecx, [esp + 4]
cmp edx, dword [ecx]
je 0x100d2096
inc eax
add ecx, 4
cmp eax, 0x1a
jb 0x100d207f
xor eax, eax
pop esi
add esp, 0xd0
ret
push edi
mov edi, dword [esp + eax*4 + 0x70]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0xe0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0xd0
ret

Function at 0x100e6c90
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call sub.WS2_32.dll_connect
ret
Function at 0x100ebb70
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x100ebb80
mov esi, 1
push esi
call fcn.100d6367
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100ebbd2
call fcn.100d6e6d
mov edi, eax
call fcn.100ee6d0
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x100ebbb6
mov edx, dword [0x1016b4f8]
mov dword [0x1016b4f4], edx
test al, 0x18
je 0x100ebbc7
push esi
push 0x24
push 5
call fcn.100eef20
add esp, 0xc
test edi, edi
je 0x100ebbed
push 1
call fcn.100d9595
test byte [esp + 0x14], 0x20
je 0x100ebbed
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x100eccf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x100ecde4
cmp byte [edx], 0
je 0x100ecdd7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.100ecc70
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.100ecc70
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.100ecbe0
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x100ecda1
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.100ecc20
fmul qword [0x10141210]
push ecx
fstp qword [esp]
call fcn.100d4cd8
fadd qword [0x10141208]
add esp, 8
call fcn.100d4da8
mov byte [ebx], al
inc ebx
dec edi
jne 0x100ecd74
lea ecx, [esp + 0x20]
push ecx
call fcn.100ecc20
fmul qword [0x10141210]
push ecx
fstp qword [esp]
call fcn.100d4cd8
add esp, 8
call fcn.100d4da8
cmp esi, ebx
je 0x100ecdcd
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x100ecdc6
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100eced0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
push edi
lea edi, [eax + ecx]
cmp eax, edi
jae 0x100ecef8
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [eax]
xor dl, byte [esi]
inc ecx
mov byte [ecx - 1], dl
inc esi
inc eax
cmp eax, edi
jb 0x100ecee9
pop esi
pop edi
ret
Function at 0x100ed1b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x100ed1e0
mov byte [edi + esi], 2
jmp 0x100ed217
test al, 4
je 0x100ed1ea
mov byte [edi + esi], 0xd
jmp 0x100ed217
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x100ed203
mov byte [edi + esi], 2
jmp 0x100ed217
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x100ed213
mov byte [edi + esi], 0x19
jmp 0x100ed217
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x100ed1c7
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x100ed28b
cmp dl, 0xd
je 0x100ed28b
xor edx, edx
jmp 0x100ed290
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x100ed27b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x100ed2b0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.100ebb70
mov esi, eax
add esp, 8
test esi, esi
jne 0x100ed2d1
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.100ee910
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x100ed2f6
push esi
call fcn.100ebc00
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.100e132b
push ebx
push edi
mov ebp, eax
call fcn.100ee980
push 0x100ed330
push ebp
push esi
call fcn.100efcb0
push esi
call fcn.100ebc00
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x100ee210
Capabilities:
Allocate thread local storage

Disassembly:
mov al, byte [0x1026c539]
test al, al
jne 0x100ee2b4
mov byte [0x1026c539], 1
call fcn.100ee540
test al, al
je 0x100ee230
mov al, 1
ret
mov eax, dword [0x1026c550]
test eax, eax
jne 0x100ee2af
call fcn.100ee340
push str.HOME
call fcn.100d507f
add esp, 4
test eax, eax
mov dword [0x1026c550], eax
je 0x100ee267
push eax
push 0x1026c758
call fcn.100f1df0
add esp, 8
mov dword [0x1026c550], eax
push str.UMASK
call fcn.100d507f
add esp, 4
test eax, eax
je 0x100ee28b
push eax
call fcn.100ee2c0
add esp, 4
or eax, 0x180
mov dword [0x1016b4cc], eax
push str.UMASK_DIR
call fcn.100d507f
add esp, 4
test eax, eax
je 0x100ee2af
push eax
call fcn.100ee2c0
add esp, 4
or eax, 0x1c0
mov dword [0x1016b4d0], eax
call fcn.100ee450
xor al, al
ret

Function at 0x100ee340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa04
push 0x1013dc00
push 2
mov dword [esp + 0xc], 0x100
mov dword [esp + 0x10], 0x400
call fcn.100e03bf
push 0x10169d30
call fcn.100d511d
add esp, 0xc
call fcn.100e255c
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMySQL
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ee448
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push edx
mov esi, 1
call edi
cmp eax, 0x103
je 0x100ee43b
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x51c]
push edx
call fcn.100ee320
lea eax, [esp + 0x520]
push eax
call fcn.100d953d
push eax
call fcn.100d511d
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
mov eax, esi
push edx
push eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x30], 0x400
inc esi
call edi
cmp eax, 0x103
jne 0x100ee3ce
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xa04
ret

Function at 0x100ee450
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
call fcn.100ee4b0
test al, al
je 0x100ee49f
lea eax, [esp]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x100ee47b
call sub.WS2_32.dll_WSACleanup
lea ecx, [esp]
push ecx
jmp 0x100ee48d
cmp word [esp], 2
je 0x100ee498
call sub.WS2_32.dll_WSACleanup
lea edx, [esp]
push edx
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x100ee49f
mov byte [0x1026c538], 1
xor al, al
add esp, 0x190
ret
Function at 0x100ee540
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x1027610c], eax
jne 0x100ee56d
call fcn.100d6e6d
mov eax, dword [eax]
push eax
push str.Cant_initialize_threads:_error__d_n
push 0x10165230
call fcn.100d64a1
add esp, 0xc
mov al, 1
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10276240
call esi
push 0x102761c0
call esi
push 0x102761e0
call esi
push 0x10276180
call esi
push 0x102761a0
call esi
push 0x10276140
call esi
push 0x10276120
call esi
push 0x10276200
call esi
call fcn.100f2100
push 0x10276220
call esi
push 0x10276160
call esi
call fcn.100ee640
test al, al
pop esi
je 0x100ee5d1
call fcn.100ee5e0
mov al, 1
ret
xor al, al
ret

Function at 0x100ee640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x102761e0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1027610c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100ee6bb
push 0x4c
push 1
call fcn.100d7295
mov esi, eax
add esp, 8
test esi, esi
jne 0x100ee683
push 0x102761e0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x1027610c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x1026c53c]
inc eax
lea edx, [esi + 0xc]
mov dword [0x1026c53c], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.100f2110
add esp, 8
mov byte [esi + 0x3c], 1
push 0x102761e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
Function at 0x100eeb40
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.100d6e6d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.100e132b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x100eec3a
call fcn.100d6e6d
cmp dword [eax], 0
je 0x100eeb87
call fcn.100d6e6d
mov ebp, dword [eax]
jmp 0x100eeb8a
or ebp, 0xffffffff
call fcn.100ee6d0
test esi, esi
mov dword [eax], ebp
jne 0x100eeb9f
call fcn.100d6e6d
cmp dword [eax], 4
je 0x100eebef
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x100eebd2
cmp esi, 0xffffffff
je 0x100eec14
test al, 6
je 0x100eebd2
call fcn.100ee6d0
mov ecx, dword [eax]
push ecx
push ebx
call fcn.100f2140
add esp, 4
push eax
push 0x24
push 9
call fcn.100eef20
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x100eec32
test al, 6
je 0x100eebe0
test ah, 2
je 0x100eec32
test esi, esi
jbe 0x100eec3e
test ah, 2
je 0x100eec3e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.100d6e6d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.100e132b
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x100eec3a
jmp 0x100eeb74
call fcn.100ee6d0
mov eax, dword [eax]
push eax
push ebx
call fcn.100f2140
add esp, 4
push eax
push 0x24
push 2
call fcn.100eef20
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x100eec4b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x100eec54
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x10100169
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10100189
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100d6dfa
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x101001ac
test byte [esp + 8], 2
je 0x101001ac
call fcn.100d6e6d
mov dword [eax], 0xd
call fcn.100d6e76
mov dword [eax], 5
jmp 0x10100185
xor eax, eax
ret

Function at 0x101052f3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1010532b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1010336a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10103342
jmp 0x10105337
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x101069e1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10106a23
call fcn.1010cb0b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10106a23
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10106a1a
xor eax, eax
jmp 0x10106a2b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10106a31
pop edi
pop esi
pop ebx
ret 4
Function at 0x405370
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4053a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.004051f0
mov dword [esp + 0xc], eax
test esi, esi
jne 0x4053a9
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x4b7fd0
lea ecx, [esp + 8]
call fcn.00405160
int3

Function at 0x405510
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x4e9cf4
lock xadd dword [ecx], eax
push 0
push dword [esi + 4]
test eax, eax
je 0x40555d
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
add esp, 8
ret
push fcn.00404280
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
add esp, 8
ret

Function at 0x4055e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49dcdf
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4d0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::asio::detail::win_iocp_io_service.0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.00405fa0
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x38]
mov dword [edi + 0x34], 0
call fcn.004053d0
mov esi, eax
call fcn.004051f0
mov dword [ebp - 0x14], eax
mov ecx, fcn.004032b0
xor eax, eax
mov dword [ebp - 0x18], esi
test esi, esi
cmove ecx, eax
test ecx, ecx
je 0x4056aa
mov edx, str.mutex
lea ecx, [ebp - 0x18]
call fcn.00405160
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
or ecx, 0xffffffff
mov byte [ebp - 4], 5
cmp dword [ebp + 0xc], 0xffffffff
cmovb ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x405706
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004051f0
mov dword [ebp - 0x14], eax
test esi, esi
je 0x405706
mov edx, str.iocp
lea ecx, [ebp - 0x18]
call fcn.00405160
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x405a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49dd40
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4d0070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor edx, edx
lea eax, [edi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x405a77
call fcn.00405b20
lea ecx, [ebp - 0x1c]
call fcn.00404d10
mov edx, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push dword [0x4e9f20]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4e9f20]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.00405c50
test eax, eax
je 0x405adb
cmp esi, 0xffffffff
lea eax, [esi + 1]
push ebx
cmove eax, esi
push ecx
mov ecx, edi
mov esi, eax
call fcn.00405c50
test eax, eax
jne 0x405ac3
push dword [ebp - 0x20]
push dword [0x4e9f20]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x405afa
push ecx
call fcn.004669d3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406380
Capabilities:
Get common file path

Disassembly:
sub esp, 0x110
mov eax, dword [0x4d0070]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
push eax
mov esi, ecx
push 0x104
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4063f8
mov edx, str.Failed_to_get_temp_path
mov ecx, 0x4e8b10
call fcn.00403d20
push eax
call fcn.00404240
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov eax, esi
mov byte [esi], 0
pop esi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.004664cd
add esp, 0x110
ret
push eax
lea eax, [esp + 0x10]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov byte [esi], 0
call fcn.00403330
mov ecx, dword [esp + 0x110]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004664cd
add esp, 0x110
ret
Function at 0x407180
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x4d0070]
xor eax, esp
mov dword [esp + 0x19c], eax
push esi
push edi
mov esi, ecx
mov eax, 1
lock xadd dword [0x4e9cf8], eax
inc eax
mov edi, 0x4e9cfc
cmp eax, 1
jne 0x4071c5
lea eax, [esp + 0x10]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [edi], eax
cmp byte [ebp + 8], 0
je 0x4071d5
xor eax, eax
lock xadd dword [edi], eax
test eax, eax
jne 0x4071ed
mov ecx, dword [esp + 0x1a4]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004664cd
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 8], eax
call fcn.004051f0
mov edx, str.winsock
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
call fcn.00405160
int3
Function at 0x409110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e128
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d0070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x409262
cmp byte [edi + 0x3d], 0
je 0x409262
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x409169
xor al, al
jmp 0x409264
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
nop
mov eax, dword [edi + 0x38]
lea ebx, [ebp - 0x28]
cmp ecx, 0x10
lea esi, [ebp - 0x28]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4091c5
mov dword [ebp - 0x2c], esi
xor eax, eax
jmp 0x4091e6
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [ebp - 0x30]
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub eax, 0
je 0x4091f9
sub eax, 1
je 0x4091fd
sub eax, 2
je 0x40924a
xor bl, bl
jmp 0x40924c
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [ebp - 0x28]
cmovae eax, edx
sub esi, eax
je 0x40922c
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00483a37
mov ecx, dword [ebp - 0x14]
add esp, 0x10
mov edx, dword [ebp - 0x28]
cmp esi, eax
jne 0x4091f5
cmp byte [edi + 0x3d], 0
je 0x40924a
test esi, esi
jne 0x4091a0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00409000
jmp 0x409199
mov bl, 1
cmp ecx, 0x10
jb 0x40925e
push 1
inc ecx
push ecx
push edx
call fcn.004022a0
add esp, 0xc
mov al, bl
jmp 0x409264
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004664cd
mov esp, ebp
pop ebp
ret