joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push 4
call fcn.010012b0
test eax, eax
pop ecx
je 0x10021b6
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_void___thiscall_CLASS_DESCRIPTOR::constructor_void_]
jmp 0x10021b8
xor eax, eax
test eax, eax
mov dword [0x1004004], eax
je 0x10021c9
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_CLASS_DESCRIPTOR::Initialize_void_]
lea ecx, [ebp - 0x78]
call fcn.010012ff
lea ecx, [ebp - 0x78]
call fcn.01001cd6
test al, al
je 0x10021ee
lea ecx, [ebp - 0x78]
call fcn.0100133e
test al, al
je 0x10021ee
push dword [ebp + 0x10]
jmp 0x10021f0
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x10021f7
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1001288
call fcn.01002394
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002232
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002232
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100224a
cmp eax, 0x20b
je 0x1002237
mov dword [ebp - 0x1c], edi
jmp 0x100225e
cmp dword [ecx + 0x84], 0xe
jbe 0x1002232
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002258
cmp dword [ecx + 0x74], 0xe
jbe 0x1002232
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004018], 0xffffffff
or dword [0x100401c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004014]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004010]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004020], eax
call fcn.01002390
cmp dword [section..data], edi
jne 0x10022b9
push fcn.01002390
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100237e
push 0x100117c
push 0x1001178
call sub.msvcrt.dll__initterm
mov eax, dword [0x100400c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1004008]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001174
push 0x1001170
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002195
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002330
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002365
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010023cd
ret

Function at 0x4010dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x4010bc
call fcn.00401050
push 1
push 0x401110
push 0x401114
push 0x401120
push 0x401144
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00401008
Function at 0x7ec840
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x322000]
push edi
or ebp, 0xffffffff
jmp 0x7ec862
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7ec869
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ec858
mov eax, 1
add ebx, ebx
jne 0x7ec87b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7ec88c
jne 0x7ec8ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ec8ab
dec eax
add ebx, ebx
jne 0x7ec898
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7ec870
add ebx, ebx
jne 0x7ec8a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7ec8fd
xor ecx, ecx
sub eax, 3
jb 0x7ec8c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7ec932
sar eax, 1
mov ebp, eax
jmp 0x7ec8ce
add ebx, ebx
jne 0x7ec8ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ec89c
inc ecx
add ebx, ebx
jne 0x7ec8dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7ec89c
add ebx, ebx
jne 0x7ec8e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7ec8de
jne 0x7ec8fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7ec8de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7ec91c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7ec90e
jmp 0x7ec85e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7ec91c
add edi, ecx
jmp 0x7ec85e
pop esi
mov edi, esi
mov ecx, 0x1d7a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7ec93a
cmp byte [edi], 0x2a
jne 0x7ec93a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7ec93f
lea edi, [esi + 0x3ea000]
mov eax, dword [edi]
or eax, eax
je 0x7ec9b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41503c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x415078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7ec96c
mov ecx, edi
jns 0x7ec99b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41507c]
or eax, eax
je 0x7ec9b1
mov dword [ebx], eax
add ebx, 4
jmp 0x7ec989
call dword [esi + 0x41508c]
mov ebp, dword [esi + 0x415080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7ec9eb
sub esp, 0xffffff80
jmp 0x40c240
Function at 0x10002fc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10003067
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10098c38]
mov esi, eax
mov eax, dword [0x10098c3c]
cmp ecx, 0x257edfd1
jne 0x10002ffe
cmp eax, 0xb2ab117a
je 0x1000300d
cmp ecx, 0x257edfd0
jne 0x10003014
cmp eax, 0xb2ab117a
jne 0x10003014
test esi, esi
setne al
jmp 0x10003024
mov eax, dword [0x10098c30]
mov ecx, 0x10098c30
push esi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x10098c30
mov dword [esp + 0x18], str.D:ProgrammsLibrares_boost_boost_asiodetailimplwin_tss_ptr.ipp
mov dword [esp + 0x1c], str.win_tss_ptr_create
mov dword [esp + 0x20], 0x2e
mov dword [esp + 0x24], 0x1a
test al, 1
je 0x10003067
cmp eax, 1
jne 0x1000306f
test esi, esi
jne 0x1000306f
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x18]
mov edx, 0x10087bfc
push eax
lea ecx, [esp + 0x10]
call fcn.10002d80
int3

Function at 0x10003130
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x1009e5c0
lock xadd dword [ecx], eax
mov ecx, dword [esi + 4]
push 0
push ecx
test eax, eax
je 0x1000317e
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
mov esp, ebp
pop ebp
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100034e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x10098140]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 1
lock xadd dword [0x1009e5c4], eax
inc eax
mov ebx, 0x1009e5c8
cmp eax, 1
jne 0x10003526
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
cmp byte [ebp + 8], 0
je 0x100035b1
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
je 0x100035b1
mov ecx, dword [0x10098c38]
mov eax, dword [0x10098c3c]
cmp ecx, 0x257edfd1
jne 0x10003554
cmp eax, 0xb2ab117a
je 0x10003563
cmp ecx, 0x257edfd0
jne 0x10003567
cmp eax, 0xb2ab117a
jne 0x10003567
mov al, 1
jmp 0x10003577
mov eax, dword [0x10098c30]
mov ecx, 0x10098c30
push esi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x10098c30
mov dword [esp + 0x18], str.D:ProgrammsLibrares_boost_boost_asiodetailimplwinsock_init.ipp
mov dword [esp + 0x1c], str.throw_on_error
mov dword [esp + 0x20], 0x48
mov dword [esp + 0x24], 0x1a
test al, 1
jne 0x100035ca
mov ecx, dword [esp + 0x1bc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004fde9
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x18]
mov edx, str.winsock
push eax
lea ecx, [esp + 0x10]
call fcn.10002d80
int3

Function at 0x1000b700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x1009e9a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000b72a
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp - 4]
call fcn.1001b9b0
add esp, 8
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
xor ecx, ecx
push ecx
push dword [ebp - 4]
call fcn.1001b9b0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x1000b740
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x1009e9a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1000b758
mov ecx, dword [eax + 4]
jmp 0x1000b75a
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x3fc
ja 0x1000b77f
test ecx, ecx
je 0x1000b77f
xor eax, eax
nop dword [eax]
cmp dword [ecx + eax*4], 0
lea edx, [ecx + eax*4]
je 0x1000b78d
inc eax
cmp eax, 2
jl 0x1000b770
push dword [ebp + 8]
call fcn.10050141
add esp, 4
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
mov al, byte [ecx + esi]
mov byte [ecx], al
mov dword [edx], ecx
pop esi
pop ebp
ret
Function at 0x1000be60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 8], edx
cmp esi, 0xffffffff
je 0x1000c01d
cmp byte [ebp + 8], 0
push edi
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
je 0x1000bebc
mov al, byte [edx]
test al, 8
je 0x1000bebc
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push esi
mov dword [ebp - 4], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1000bebc
call edi
push 0x10098c30
push eax
lea ecx, [ebp - 0x14]
call fcn.10002300
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000bedd
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
pop edi
pop esi
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret
push ebx
call edi
push 0x10098c30
push eax
lea ecx, [ebp - 0x14]
call fcn.10002300
mov ecx, dword [ebp + 0xc]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov ebx, dword [0x10098c38]
mov edi, dword [0x10098c3c]
cmp ebx, 0x257edfd1
jne 0x1000bf1b
cmp edi, 0xb2ab117a
je 0x1000bf2b
cmp ebx, 0x257edfd0
jne 0x1000bf2f
cmp edi, 0xb2ab117a
jne 0x1000bf2f
mov al, 1
jmp 0x1000bf52
mov eax, dword [0x10098c30]
mov ecx, 0x10098c30
push 0x2733
mov eax, dword [eax + 0x18]
call eax
mov edi, dword [0x10098c3c]
mov ebx, dword [0x10098c38]
mov ecx, dword [ebp + 0xc]
movzx eax, al
lea edx, [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], 0x2733
mov dword [ebp - 0x10], 0x10098c30
mov dword [ebp - 0xc], eax
call fcn.1000b360
test al, al
jne 0x1000bfdf
cmp ebx, 0x257edfd1
jne 0x1000bf85
cmp edi, 0xb2ab117a
je 0x1000bf95
cmp ebx, 0x257edfd0
jne 0x1000bf99
cmp edi, 0xb2ab117a
jne 0x1000bf99
mov al, 1
jmp 0x1000bfad
mov eax, dword [0x10098c30]
mov ecx, 0x10098c30
push 0x4d5
mov eax, dword [eax + 0x18]
call eax
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
movzx eax, al
mov ecx, edi
add eax, 2
mov dword [ebp - 0x14], 0x4d5
mov dword [ebp - 0x10], 0x10098c30
mov dword [ebp - 0xc], eax
call fcn.1000b360
test al, al
jne 0x1000bfe2
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 8]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.1000bbd0
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c430
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 1
push 0
push 0
push dword [ebp + 8]
mov edi, ecx
push edx
push edi
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c488
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
cmp edi, 0x17
jne 0x1000c480
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x10098c30
push eax
lea ecx, [ebp - 0x10]
call fcn.10002300
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x1000cb50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077c4e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10098140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
lea ebx, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [ebx], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.1000b860
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1000ccba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10098c38]
mov edi, eax
mov eax, dword [0x10098c3c]
cmp ecx, 0x257edfd1
jne 0x1000cc54
cmp eax, 0xb2ab117a
je 0x1000cc63
cmp ecx, 0x257edfd0
jne 0x1000cc6a
cmp eax, 0xb2ab117a
jne 0x1000cc6a
test edi, edi
setne al
jmp 0x1000cc7a
mov eax, dword [0x10098c30]
mov ecx, 0x10098c30
push edi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x10098c30
mov dword [ebp - 0x30], str.D:ProgrammsLibrares_boost_boost_asiodetailimplwin_iocp_io_context.ipp
mov dword [ebp - 0x2c], str.win_iocp_io_context
mov dword [ebp - 0x28], 0x67
mov dword [ebp - 0x24], 0x1a
test al, 1
je 0x1000ccba
cmp eax, 1
jne 0x1000cd38
test edi, edi
jne 0x1000cd38
cmp byte [ebp + 0x10], 0
je 0x1000cd22
lock inc dword [ebx]
push 0xc
call fcn.1004fdf7
mov edi, eax
add esp, 4
mov dword [ebp + 0x10], edi
mov byte [ebp - 4], 7
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1004fdf7
add esp, 4
mov dword [ebp + 8], eax
mov ecx, edi
mov dword [eax], vtable.boost::asio::detail::win_thread::func_struct_boost::asio::detail::win_iocp_io_context::thread_function_.0
push 0
push eax
mov dword [eax + 0xc], esi
call fcn.1000c770
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x1000cd1f
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push ebx
call fcn.10050146
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x30]
mov edx, str.iocp
push eax
lea ecx, [ebp - 0x20]
call fcn.10002d80
int3
Function at 0x1000d160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077cb5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x10098140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x1000d1c3
call fcn.1000d2f0
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.1004dfea
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
add esp, 4
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
mov ecx, esi
mov dword [ebp - 4], 0
push dword [0x1009e9a0]
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x1009e9a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push ebx
push eax
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
xor edi, edi
call fcn.1000d530
test eax, eax
je 0x1000d26d
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.1000d530
test eax, eax
jne 0x1000d251
push dword [ebp - 0x10]
push dword [0x1009e9a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
nop
mov eax, dword [ebp + esi*4 - 0x4c]
test eax, eax
je 0x1000d291
push eax
call fcn.10050141
add esp, 4
inc esi
cmp esi, 0xa
jl 0x1000d280
lea eax, [ebp - 0x20]
push eax
call fcn.1004e0d6
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000dbc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077d6d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10098140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
xor bl, bl
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea esi, [eax + 0x4c]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000dc42
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [esi]
mov ecx, dword [esi - 0x10]
lea edx, [eax + edx*8]
mov eax, dword [edx]
cmp eax, ecx
je 0x1000dc45
mov ecx, dword [edx + 4]
mov edx, dword [ecx]
cmp eax, edx
je 0x1000dc42
cmp dword [eax + 8], edi
je 0x1000dc5f
mov ecx, dword [eax]
mov eax, ecx
cmp ecx, edx
jne 0x1000dc35
mov ecx, dword [esi - 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
push ecx
lea ecx, [esi - 0x14]
call fcn.10017830
test al, al
jne 0x1000dc63
test bl, bl
jne 0x1000dc63
jmp 0x1000dc65
mov ecx, eax
jmp 0x1000dc45
mov bl, 1
add esi, 0x1c
sub dword [ebp - 0x10], 1
jne 0x1000dc11
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [esi + 0x14]
call fcn.100031b0
test bl, bl
je 0x1000dd83
push 0
push 0
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push dword [esi + 0x34]
mov dword [ebp + 0xc], 0
call dword [sym.imp.WS2_32.dll_WSASend]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x10098c30
push eax
lea ecx, [ebp - 0x38]
call fcn.10002300
mov ebx, 0x1ffff7
movq xmm0, qword [eax]
mov esi, dword [eax + 8]
movq qword [ebp - 0x2c], xmm0
mov edi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
cmp esi, 1
je 0x1000dcea
mov eax, ecx
jmp 0x1000dcf8
xor edx, edx
mov eax, edi
div ebx
imul eax, edx, 0x3e8
add eax, ecx
cmp eax, 0x40
jne 0x1000dd2d
mov ecx, dword [0x10098c38]
mov eax, dword [0x10098c3c]
cmp ecx, 0x257edfd1
jne 0x1000dd17
cmp eax, 0xb2ab117a
je 0x1000dd83
cmp ecx, 0x257edfd0
jne 0x1000dd26
cmp eax, 0xb2ab117a
je 0x1000dd83
push 0x2746
jmp 0x1000dd76
cmp esi, 1
jne 0x1000dd40
xor edx, edx
mov eax, edi
div ebx
imul eax, edx, 0x3e8
add ecx, eax
cmp ecx, 0x4d2
jne 0x1000dd83
mov ecx, dword [0x10098c38]
mov eax, dword [0x10098c3c]
cmp ecx, 0x257edfd1
jne 0x1000dd62
cmp eax, 0xb2ab117a
je 0x1000dd83
cmp ecx, 0x257edfd0
jne 0x1000dd71
cmp eax, 0xb2ab117a
je 0x1000dd83
push 0x274d
mov eax, dword [0x10098c30]
mov ecx, 0x10098c30
call dword [eax + 0x18]
mov dword [ebp - 4], 1
mov edi, dword [ebp - 0x20]
mov ecx, edi
test ecx, ecx
je 0x1000ddd4
mov esi, ecx
nop word [eax + eax]
mov eax, dword [edi + 0x14]
xorps xmm0, xmm0
mov dword [esi + 0x14], 0
mov edi, eax
mov esi, eax
movq qword [ebp - 0x2c], xmm0
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], 0
push eax
mov eax, dword [ecx + 0x18]
push ecx
push 0
call eax
add esp, 0x10
mov ecx, esi
test esi, esi
jne 0x1000dda0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8