joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f520c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x5f7118
sub eax, eax
test esi, esi
je 0x5f52e4
sub eax, 1
test ecx, ecx
je 0x5f52e2
test esi, 3
je 0x5f524a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x5f522f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x5f52c9
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x5f5254
mov ecx, edx
test ecx, ecx
je 0x5f52e2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x5f52cf
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x5f52ec
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.005f536f
jae 0x5f52fa
xor ecx, ecx
call fcn.005f536f
jae 0x5f5329
xor eax, eax
call fcn.005f536f
jae 0x5f5339
mov bl, 2
inc ecx
mov al, 0x10
call fcn.005f536f
adc al, al
jae 0x5f531b
jne 0x5f5365
stosb byte es:[edi], al
jmp 0x5f52fd
call fcn.005f537b
sub ecx, ebx
jne 0x5f5342
call fcn.005f5379
jmp 0x5f5361
lodsb al, byte [esi]
shr eax, 1
je 0x5f538b
adc ecx, ecx
jmp 0x5f535e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.005f5379
cmp eax, 0x7d00
jae 0x5f535e
cmp ah, 5
jae 0x5f535f
cmp eax, 0x7f
ja 0x5f5360
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5f52fd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x5f5c7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5f8000]
jne 0x5f5c86
repz ret
jmp fcn.005f5f2d
Function at 0x40dea0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x55b18c]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40df21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x56519c]
cmp ecx, dword [edx + 4]
jle 0x40df11
push 0x56519c
call fcn.004d212f
add esp, 4
cmp dword [0x56519c], esi
jne 0x40df11
push 0x50a520
call fcn.004d25d3
add esp, 4
push 0x56519c
call fcn.004d20de
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x55bc28
test edi, edi
jne 0x40df34
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004d20a0
mov esp, ebp
pop ebp
ret
mov edx, 0x532d88
lea ecx, [esp + 0xc]
call fcn.0040ddd0
int3

Function at 0x40e520
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x370
mov eax, dword [0x55b18c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
lea eax, [ebp - 0x360]
push 0
push eax
call fcn.004db730
add esp, 0xc
lea eax, [ebp - 0x110]
xorps xmm0, xmm0
movaps xmmword [ebp - 0x370], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
push eax
push str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___nul__del__f__q___s_
lea eax, [ebp - 0x318]
push 0x208
push eax
call fcn.00409c40
add esp, 0x10
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x360]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x318]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x370]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d20a0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x410d60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcf6d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x55b18c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov eax, esi
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x20], 0
jb 0x410dc3
mov eax, dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ebx, eax
push ebx
call fcn.004d25f6
add esp, 4
mov edi, eax
push ebx
push 0
push edi
call fcn.004db730
add esp, 0xc
mov dword [ebp - 0x18], edi
cmp dword [esi + 0x14], 0x10
jb 0x410df2
mov esi, dword [esi]
push edi
push ebx
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x533354
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x410ec4
cmp dword [ebp - 0x1c], 0
je 0x410ec4
mov ecx, dword [edx + 8]
mov eax, ecx
mov ebx, dword [ebp - 0x28]
mov edx, dword [edx + 0xc]
shr eax, 0x10
mov esi, dword [ebp - 0x30]
mov dword [ebx], eax
add esi, 0x284
movzx eax, cx
mov dword [ebx + 4], eax
mov eax, edx
shr eax, 0x10
mov dword [ebx + 8], eax
movzx eax, dx
mov edx, dword [ebp - 0x2c]
mov dword [ebx + 0xc], eax
mov dword [edx], 0
imul ecx, dword [ebx], 0x64
mov dword [edx], ecx
mov eax, dword [ebx + 4]
add eax, ecx
imul ecx, eax, 0x64
mov dword [edx], ecx
mov eax, dword [ebx + 8]
add eax, ecx
imul ecx, eax, 0x64
mov dword [edx], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [edx], eax
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
push str.2Current_version_of_5Tiny6Rcon_2is_5_d._d._d._d_n
push 0x200
push esi
call fcn.00409c40
add esp, 0x1c
mov edx, esi
push 1
push 0
push 1
push 1
push ecx
mov ecx, dword [0x5653c4]
call fcn.004a4e90
add esp, 0x14
test edi, edi
je 0x410ec0
push edi
call fcn.004d20ae
add esp, 4
mov al, 1
jmp 0x410ee3
test edi, edi
je 0x410ee1
push edi
jmp 0x410ed9
call fcn.004d20ae
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d20a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411c20
Capabilities:
Create http request
Create thread
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd0c0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1040
call fcn.004d3180
mov eax, dword [0x55b18c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x101c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x101c], esi
movups xmmword [ebp - 0x1040], xmm0
movups xmmword [ebp - 0x1030], xmm0
push 0
push 0
push 0
push 0
push str.IP_retriever
mov dword [ebp - 4], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp - 0x1040]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x1044], eax
test ecx, ecx
je 0x411cbd
push ecx
call edi
mov eax, dword [ebp - 0x1044]
mov dword [ebp - 0x1040], eax
test eax, eax
je 0x411df3
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], 0
push eax
push 0
lea eax, [ebp - 0x1040]
mov dword [ebp - 0x1020], 0
push eax
push 0x411a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1048], eax
test eax, eax
je 0x411df3
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x411d68
push 1
push 0
push 1
push 1
push ecx
mov ecx, dword [0x5653c4]
mov edx, str.3Could_not_connect_to_5http:__myexternalip.com_raw_3to_retrieve_your_1external_IP_address_3for_5Tiny6Rcon_3updates__n
call fcn.004a4e90
add esp, 0x14
push 0xffffffffffffffff
push dword [ebp - 0x1048]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1048]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 0x1048]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1020], 0
je 0x411dbb
xorps xmm0, xmm0
mov ecx, esi
push 7
movups xmmword [esi], xmm0
push str.unknown
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00417660
mov eax, dword [ebp - 0x103c]
test eax, eax
je 0x411daa
push eax
call edi
mov dword [ebp - 0x103c], 0
mov ecx, dword [ebp - 0x1040]
test ecx, ecx
je 0x411e39
push ecx
jmp 0x411e37
lea eax, [ebp - 0x1044]
mov dword [ebp - 0x1044], 0
push eax
push 0x1000
lea eax, [ebp - 0x1018]
push eax
push dword [ebp - 0x103c]
call dword [sym.imp.WININET.dll_InternetReadFile]
push dword [ebp - 0x1044]
lea eax, [ebp - 0x1018]
push eax
jmp 0x411dfa
push 7
push str.unknown
xorps xmm0, xmm0
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00417660
mov eax, dword [ebp - 0x103c]
test eax, eax
je 0x411e2c
push eax
call edi
mov dword [ebp - 0x103c], 0
mov eax, dword [ebp - 0x1040]
test eax, eax
je 0x411e39
push eax
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d20a0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x412970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4129a2
jl 0x412995
test ecx, ecx
jne 0x4129a2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x412a62
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00414ee0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x412a0e
jg 0x4129cd
test esi, esi
je 0x412a0e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4129e5
mov eax, dword [esp + 0x10]
jl 0x4129df
cmp eax, esi
jae 0x4129e5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004db1b0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x412a2f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x412a4b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x4129b4
jl 0x412a4b
test ecx, ecx
jne 0x4129b4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x412aa0
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x412aa0
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.004db1b0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x412b09
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x412ac6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x412af4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004e5420
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x412b09
cmp edi, eax
ja 0x412ad2
test edi, edi
je 0x412b09
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004e5420
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x413590
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x55b18c]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 1
lock xadd dword [0x5651cc], eax
inc eax
mov ebx, 0x5651d0
cmp eax, 1
jne 0x4135d6
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
cmp byte [ebp + 8], 0
je 0x4135e6
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
jne 0x4135ff
mov ecx, dword [esp + 0x1ac]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d20a0
mov esp, ebp
pop ebp
ret 4
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x56519c]
cmp eax, dword [ecx + 4]
jle 0x413644
push 0x56519c
call fcn.004d212f
add esp, 4
cmp dword [0x56519c], 0xffffffff
jne 0x413644
push 0x50a520
call fcn.004d25d3
add esp, 4
push 0x56519c
call fcn.004d20de
add esp, 4
mov edx, str.winsock
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x55bc28
call fcn.0040ddd0
int3

Function at 0x414c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd3d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x55b18c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 8
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004d2193
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004cfd1d
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.004155b0
mov eax, dword [ebp - 0x10]
lea ebx, [edi + 4]
mov dword [edi + 0xc], ebx
lea esi, [edi + 8]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea ecx, [eax + 0x18]
mov byte [edi + 0x48], 0
lea edx, [eax + 0x24]
mov byte [edi + 0x3d], 0
mov dword [edi + 0x10], esi
add edi, 0x14
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x5651c0]
mov edx, dword [0x5651c4]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x417db0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x417de1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x417dd0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41a170
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd833
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55b18c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov esi, dword [ebp + 0x14]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], 0
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
mov edx, dword [esi + 8]
shr edx, 3
and dl, 1
mov byte [edi + 0x6c], dl
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x70], edx
push dword [esi + 0x18]
call fcn.0041a380
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x428030
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x55b18c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0
push 0
push 1
push 0
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x4280d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [esp + 0x14], eax
call dword [edx]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x56519c]
mov edx, dword [eax]
cmp ecx, dword [edx + 4]
jle 0x4280bf
push 0x56519c
call fcn.004d212f
add esp, 4
cmp dword [0x56519c], 0xffffffff
jne 0x4280bf
push 0x50a520
call fcn.004d25d3
add esp, 4
push 0x56519c
call fcn.004d20de
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x55bc28
test eax, eax
jne 0x428237
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 8], eax
mov dword [edi + 8], eax
cmp dword [ebx + 8], 0
jne 0x428161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [esp + 0x14], eax
call dword [edx]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x56519c]
mov edx, dword [eax]
cmp ecx, dword [edx + 4]
jle 0x428149
push 0x56519c
call fcn.004d212f
add esp, 4
cmp dword [0x56519c], 0xffffffff
jne 0x428149
push 0x50a520
call fcn.004d25d3
add esp, 4
push 0x56519c
call fcn.004d20de
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x55bc28
test eax, eax
jne 0x428245
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0
push edi
push 0x428270
push 0
push 0
call fcn.004e6065
add esp, 0x18
mov dword [ebx + 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x428213
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [esp + 0x14], eax
call dword [edx]
test esi, esi
je 0x4281ac
push esi
call ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 8]
test eax, eax
je 0x4281ba
push eax
call ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x56519c]
cmp eax, dword [ecx + 4]
jle 0x4281ff
push 0x56519c
call fcn.004d212f
add esp, 4
cmp dword [0x56519c], 0xffffffff
jne 0x4281ff
push 0x50a520
call fcn.004d25d3
add esp, 4
push 0x56519c
call fcn.004d20de
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x55bc28
test eax, eax
jne 0x428253
test esi, esi
je 0x428223
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebx
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004d20a0
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [esp + 0x10]
call fcn.0040ddd0
mov edx, str.thread.exit_event
lea ecx, [esp + 0x10]
call fcn.0040ddd0
mov edx, str.thread
lea ecx, [esp + 0x18]
call fcn.0040ddd0
int3
Function at 0x4283c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdede
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x55b18c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
lea edi, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [edi], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.00429050
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.00427b90
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x42851a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x56519c]
cmp eax, dword [ecx + 4]
jle 0x428505
push 0x56519c
call fcn.004d212f
add esp, 4
cmp dword [0x56519c], 0xffffffff
jne 0x428505
push 0x50a520
call fcn.004d25d3
add esp, 4
push 0x56519c
call fcn.004d20de
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x55bc28
test edi, edi
jne 0x4285b8
lea edi, [esi + 0x18]
cmp byte [ebx + 0x10], 0
je 0x428596
lock inc dword [edi]
push 0xc
call fcn.004d2193
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 7
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.004d2193
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
push eax
mov ecx, edi
movups xmmword [eax], xmm0
mov dword [eax], vtable.asio::detail::win_thread::func_struct_asio::detail::win_iocp_io_context::thread_function_.0
mov dword [eax + 0xc], esi
call fcn.00428030
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x428593
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push dword [ebp - 0x20]
call fcn.004d25e8
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d20a0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.0040ddd0
int3