joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10114e60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [0x101ef014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x101f3f98]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10114f60
movzx ebx, word [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test bx, bx
je 0x10114eed
mov esi, dword [edi + 0xa24]
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.10114290
cmp eax, 0xffffffff
je 0x10114fd8
cmp word [ebp - 0x14], bx
ja 0x10114fd8
cmp word [ebp - 0x12], bx
jb 0x10114fd8
test esi, esi
je 0x10114fc8
cmp esi, 1
jne 0x10114fd8
lea eax, [ebx - 0x302]
cmp ax, 3
jae 0x10114fd8
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10114f07
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10114f1b
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
test bx, bx
je 0x10114f8f
cmp word [edi + 0x26], bx
jbe 0x10114f8f
cmp dword [0x101f2f50], 0
je 0x10115070
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115047
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x10114f98
cmp dword [0x101f2f50], 0
je 0x1011505c
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115020
mov dword [eax + 0x28], 0xffffe891
jmp 0x10115001
mov word [edi + 0x714], bx
xor esi, esi
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10114fb2
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011500c
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
jmp 0x1011500c
lea eax, [ebx - 0x300]
cmp ax, 5
jb 0x10114eed
cmp dword [0x101f2f50], 0
je 0x10115066
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115035
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10114f86
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10114ffa
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10114f4c
call fcn.100029d0
jmp 0x10114f6d
call fcn.100029d0
jmp 0x10114fe5
call fcn.100029d0
jmp 0x10114f33
Function at 0x10115080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f3f98]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x101150b3
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x101150dc
add eax, 0x1c
jmp 0x1011510b
cmp dword [0x101f2f50], 0
je 0x10115138
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x10115110
mov dword [ecx + 0x28], 0xffffe891
jmp 0x10115103
cmp dword [0x101f2f50], 0
je 0x10115142
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x10115124
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov ecx, eax
jmp 0x101150d3
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov ecx, eax
jmp 0x101150fc
call fcn.100029d0
jmp 0x101150bc
call fcn.100029d0
jmp 0x101150e5

Function at 0x10115150
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [esp + 0x88], eax
mov eax, dword [edi]
mov esi, dword [eax + 8]
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movaps xmmword [ebx + 0x60], xmm0
movaps xmmword [ebx + 0x50], xmm0
movaps xmmword [ebx + 0x40], xmm0
movaps xmmword [ebx + 0x30], xmm0
movaps xmmword [ebx + 0x20], xmm0
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x64]
call dword [section..00cfg]
mov dword [esp + 4], ebx
mov dword [esp], esi
call ecx
xor esi, esi
dec esi
test eax, eax
js 0x10115245
mov dword [edi + 0x4c], 1
movzx eax, word [esp + 0x10]
cmp eax, 0x17
je 0x101151fc
cmp eax, 2
jne 0x10115218
mov eax, dword [esp + 0x14]
xor esi, esi
mov dword [edi + 0xb4], esi
mov dword [edi + 0xb0], esi
mov dword [edi + 0xb8], 0xffff0000
mov dword [edi + 0xbc], eax
movzx eax, word [esp + 0x12]
mov word [edi + 0xc0], ax
jmp 0x10115245
movups xmm0, xmmword [esp + 0x18]
movups xmmword [edi + 0xb0], xmm0
movzx eax, word [esp + 0x12]
mov word [edi + 0xc0], ax
xor esi, esi
jmp 0x10115245
cmp dword [0x101f2f50], 0
je 0x1011526f
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011525d
mov dword [eax + 0x28], 0xffffe89f
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10115236
call fcn.100029d0
jmp 0x10115221
Function at 0x10115280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f3f98]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x101152df
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
mov eax, dword [edi + 0xd0]
test eax, eax
je 0x101152c6
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
mov dword [edi + 0xd0], 0
test esi, esi
je 0x10115311
mov dword [esp], esi
call sym.nss3.dll_PORT_Strdup_Util
mov dword [edi + 0xd0], eax
test eax, eax
sete al
jmp 0x10115313
cmp dword [0x101f2f50], 0
je 0x10115338
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115326
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
jmp 0x1011531f
mov al, 1
test esi, esi
setne cl
and cl, al
movzx eax, cl
neg eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x101152fd
call fcn.100029d0
jmp 0x101152e8

Function at 0x101153a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
test esi, esi
je 0x101153d4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x101153d4
mov dword [esp], 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
test eax, eax
je 0x10115405
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 1
jmp 0x10115407
cmp dword [0x101f2f50], 0
je 0x10115422
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1011540e
mov dword [ecx + 0x28], 0xffffe89d
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
jmp 0x10115407
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov ecx, eax
jmp 0x101153f4
call fcn.100029d0
jmp 0x101153dd
Function at 0x10115470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x101154d1
cmp dword [ebp + 0xc], 0
je 0x101154d1
cmp dword [ebp + 0x10], 0
je 0x101154d1
mov dword [esp], 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
xor esi, esi
test eax, eax
je 0x101154fe
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], 1
mov dword [esp], 0x10
call sym.nss3.dll_PORT_ZAlloc_Util
test eax, eax
je 0x10115508
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edi
mov esi, eax
jmp 0x101154fe
cmp dword [0x101f2f50], 0
je 0x10115544
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115532
mov dword [eax + 0x28], 0xffffe89d
xor esi, esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
add eax, 8
lock dec dword [eax]
jne 0x101154fe
mov eax, dword [edi]
mov dword [esp], eax
call sym.nss3.dll_SECKEY_DestroyPrivateKey
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym.nss3.dll_SECKEY_DestroyPublicKey
mov dword [esp], edi
call dword [sym.imp.mozglue.dll_free]
jmp 0x101154fe
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x101154ef
call fcn.100029d0
jmp 0x101154da
Function at 0x101183c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 4
jne 0x10118476
mov ecx, dword [eax + 0x14]
cmp ecx, dword [0x101f3f98]
jne 0x10118476
mov ecx, dword [ebp + 0x18]
mov edi, dword [eax + 4]
mov dword [edi], eax
mov ebx, dword [edi + 0x160]
test ebx, ebx
je 0x10118428
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x101184c2
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], esi
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [edi + 0x154], ecx
test byte [edi + 0x1d], 1
jne 0x10118440
mov dword [edi + 0x150], ecx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call ecx
mov esi, eax
mov eax, dword [edi + 0x160]
test eax, eax
je 0x101184a6
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
jmp 0x101184a6
cmp dword [0x101f2f50], 0
je 0x101184d9
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101184b0
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10118494
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov esi, eax
jmp 0x10118413
call fcn.100029d0
jmp 0x1011847f
Function at 0x1011e400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x1011e448
mov edi, dword [ebp + 0x48]
mov eax, dword [ebp + 0x1c]
test eax, eax
lea ebx, [ebp - 0x28]
cmovne ebx, eax
mov edx, dword [ebp + 0x18]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c], ebx
je 0x1011e454
cmp ebx, edx
je 0x1011e490
push dword [ebp + 0x20]
push edx
push dword [ebp - 0x6c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1011e490
push 0
push 0xffffe005
jmp 0x1011e4f7
mov esi, dword [ebp + 0x28]
push dword [ebp + 0x20]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test esi, esi
je 0x1011e490
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
sub ecx, esi
add ecx, dword [ebp - 0x6c]
xor edx, edx
mov bl, byte [eax + edx]
xor byte [ecx + edx], bl
inc edx
cmp esi, edx
jne 0x1011e485
mov edx, edi
mov eax, edi
mov ecx, dword [ebp + 0x40]
sub eax, ecx
mov edi, dword [ebp + 0x44]
lea ecx, [edi + eax]
mov esi, dword [ebp + 0xc]
test esi, esi
lea ebx, [ebp - 0x68]
cmovne ebx, ecx
cmove eax, edx
push eax
push edi
push dword [ebp + 0x40]
push ebx
mov eax, dword [ebp + 0x3c]
push eax
mov edi, dword [ebp + 0x38]
push edi
mov eax, dword [ebp + 0x34]
push eax
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x6c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.nss3.dll_PK11_AEADOp
add esp, 0x38
mov esi, eax
or eax, dword [ebp + 0xc]
jne 0x1011e51a
mov eax, dword [edi]
mov edx, dword [ebp + 0x40]
lea ecx, [eax + edx]
cmp ecx, dword [ebp + 0x3c]
jbe 0x1011e504
push 0
push 0xffffe003
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1011e51a
mov ecx, edx
mov edx, dword [ebp + 0x34]
add edx, eax
push ecx
push ebx
push edx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10128c80
Capabilities:
Get thread local storage value
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10128d39
mov ecx, dword [eax + 0xe0]
mov edx, ecx
and edx, 0x1002
cmp edx, 2
je 0x10128d54
cmp dword [eax + 0xf4], 0
jne 0x10128d66
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x10128d7a
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [0x101f2f3c]
cmp dword [eax + 4], 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
jge 0x10128d7e
mov eax, dword [edi + 4]
mov edi, dword [eax + 0x18]
xor ebx, ebx
push 0
push ecx
push edx
push edi
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x10128d9f
add ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0
je 0x10128dc8
add esi, ebx
xor eax, eax
dec eax
test ebx, ebx
cmovs esi, eax
mov eax, dword [0x101f2f3c]
cmp dword [eax + 4], 4
jge 0x10128def
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x10128c9d
and ecx, 0xfffffffd
mov dword [eax + 0xe0], ecx
push 0
push 0xffffe897
jmp 0x10128d6d
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x10128d2f
xor esi, esi
jmp 0x10128d20
mov eax, dword [edi + 4]
push ecx
push edx
push dword [eax + 0x18]
push edi
push str.send:_fd_p_osfd_ld_buf_p_amount_d
call sym.nss3.dll_PR_LogPrint
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add esp, 0x14
jmp 0x10128ce9
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x10128db7
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
je 0x10128dcd
push eax
call fcn.101a5720
add esp, 4
xor esi, esi
dec esi
jmp 0x10128d20
cmp dword [ebp - 0x10], ebx
jle 0x10128e02
mov ecx, edi
mov edx, 2
push dword [ebp + 0x18]
call fcn.1019ed00
add esp, 4
test eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jns 0x10128cf1
jmp 0x10128dc0
push esi
push str.send_____d
call sym.nss3.dll_PR_LogPrint
add esp, 8
jmp 0x10128d2f
test ebx, ebx
js 0x10128dc0
add esi, ebx
mov edx, dword [ebp - 0x14]
add edx, ebx
mov ecx, dword [ebp - 0x10]
sub ecx, ebx
mov edi, dword [ebp + 8]
jg 0x10128cd4
jmp 0x10128d20
Function at 0x10154c60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101f2f50], 0
je 0x10154c9b
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10154c89
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10154c84
call fcn.100029e0
jmp 0x10154c6f

Function at 0x101554c0
Capabilities:
Get thread local storage value
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
cmp ecx, 0x10074030
jne 0x10155582
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10155591
mov ecx, dword [eax + 0xe0]
mov edx, ecx
and edx, 0x1002
cmp edx, 2
je 0x101555ac
cmp dword [eax + 0xf4], 0
jne 0x101555be
mov eax, dword [0x101f2f3c]
cmp dword [eax + 4], 4
jge 0x101555d2
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x18]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edi
call sub.wsock32.dll_recv
mov esi, eax
cmp eax, 0xffffffff
jne 0x1015556d
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x10155564
mov ecx, dword [ebx + 4]
cmp dword [ecx + 4], 0
je 0x10155614
push eax
call fcn.10128810
add esp, 4
mov eax, dword [0x101f2f3c]
cmp dword [eax + 4], 4
jge 0x101555f3
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [section..00cfg]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp ecx
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x101554fd
and ecx, 0xfffffffd
mov dword [eax + 0xe0], ecx
push 0
push 0xffffe897
jmp 0x101555c5
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x10155578
mov eax, dword [ebx + 4]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [eax + 0x18]
push ebx
push str.recv:_fd_p_osfd_ld_buf_p_amount_d_flags_d
call sym.nss3.dll_PR_LogPrint
add esp, 0x18
jmp 0x10155530
call sym.nss3.dll_PR_GetOSError
mov edi, eax
call sym.nss3.dll_PR_GetError
push edi
push eax
push esi
push str.recv_____d__error___d__os_error___d
call sym.nss3.dll_PR_LogPrint
add esp, 0x10
jmp 0x10155578
xor edx, edx
inc edx
mov ecx, edi
push 0xffffffffffffffff
call fcn.1019ed00
add esp, 4
test eax, eax
jns 0x10155536
jmp 0x1015556d

Function at 0x10155630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10155650
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x1015564b
Function at 0x10155670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
cmp dword [0x101f2f50], 0
je 0x101556c2
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101556b0
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x1015569c
call fcn.100029e0
jmp 0x10155681

Function at 0x101556d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101f2f50], 0
je 0x1015570e
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101556fc
mov eax, dword [eax + 0x28]
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x101556f4
call fcn.100029e0
jmp 0x101556df

Function at 0x10155720
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x1015575b
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov esi, eax
jmp 0x10155742

Function at 0x10155770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
cmp dword [0x101f2f50], 0
je 0x101557c3
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101557b1
mov edx, dword [eax + 0x24]
xor ecx, ecx
test edx, edx
je 0x101557a9
mov esi, dword [ebp + 8]
cmp dword [eax + 0x20], esi
jbe 0x101557a9
mov ecx, dword [edx + esi*4]
mov eax, ecx
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10155795
call fcn.100029e0
jmp 0x10155780
Function at 0x10155a80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x10155acc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x10], eax
xor edi, edi
push 0
mov ebx, ecx
push ecx
mov esi, edx
push edx
push dword [ebp - 0x10]
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x10155ad0
add edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0
je 0x10155b05
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10155ac4
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x10155b2f
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x10155b2f
mov ecx, dword [ebp - 0x10]
mov edx, 2
push dword [ebp + 0x18]
call fcn.1019ed00
add esp, 4
test eax, eax
mov ecx, ebx
mov edx, esi
jns 0x10155a9f
jmp 0x10155b38
cmp edi, ebx
jge 0x10155ac2
mov ecx, dword [ebp - 0x10]
mov edx, 2
push dword [ebp + 0x18]
call fcn.1019ed00
add esp, 4
mov ecx, eax
xor eax, eax
dec eax
test ecx, ecx
mov ecx, ebx
mov edx, esi
jns 0x10155a9f
jmp 0x10155ac4
push eax
call fcn.101a5720
add esp, 4
xor eax, eax
dec eax
jmp 0x10155ac4

Function at 0x10156e03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10156e12
pop dword [ebp - 0x18]
mov eax, 0x10156e12
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6ad61756
sub dword [ebp - 0x28], 0x1c83d20b
mov dword [ebp - 0x24], 0xe48eb35a
sub dword [ebp - 0x24], 0xb25b6715
mov dword [ebp - 0x20], 0x23d5fb90
sub dword [ebp - 0x20], 0xd789b762
mov dword [ebp - 0x1c], 0xc0932c84
add dword [ebp - 0x1c], 0x3f6cd37c
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x70d924d0
add dword [ebp - 0x28], 0x3994486
mov dword [ebp - 0x24], 0xbad77db3
add dword [ebp - 0x24], 0x8694e3c2
mov dword [ebp - 0x20], 0xc766b340
sub dword [ebp - 0x20], 0x63f746d4
mov dword [ebp - 0x1c], 0xb447078c
add dword [ebp - 0x1c], 0x4bb8f874
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39974
push 0
call eax
mov ecx, 0x79fa1584
add ecx, 0x86063eb1
mov edi, eax
mov esi, 0xb8687e4a
sub esi, 0xa847f84a
add esi, dword [ebp - 0x18]
mov ebx, 0x51ce9aec
sub ebx, 0x9326c588
mov dword [ebp - 8], 0xd9e65425
mov edx, dword [esi]
xor dword [ebp - 0x10], ebx
add edx, ebx
xor dword [ebp - 0x14], ebx
mov dword [edi], edx
add dword [ebp - 0x14], eax
add edi, 0x5ef203c6
sub edi, 0x5ef203c2
add esi, 0x136d3b14
add esi, 0xec92c4f0
loop 0x10156f25
add eax, 0x8cbb1981
sub eax, 0x8cb9d5da
mov ebx, eax
add eax, 0xc05fb511
add eax, 0x3fa04af4
mov ecx, 0x7491d257
add ecx, 0x9b6e2da9
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x10159130
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10159140