joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098570
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1024
call fcn.100f2490
mov esi, edx
mov edi, ecx
lea ebx, [ebp - 0x1030]
push 0x1000
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push 0x100a2910
push eax
push 0x1000
push ebx
mov dword [ebp - 0x10], edi
push edi
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x10098695
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x100985ce
cmp dword [ebp - 0x18], 0
jne 0x1009869c
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1009869c
cmp ebx, 0x1000
ja 0x100986c6
xor edi, edi
mov eax, ebx
sub eax, edi
jb 0x100986b5
xorps xmm0, xmm0
lea edx, [ebp - 0x1c]
lea ecx, [ebp + edi - 0x1030]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], edx
push 0x100a2910
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push esi
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x10098697
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x10098640
cmp dword [ebp - 0x18], 0
jne 0x1009869c
add edi, dword [ebp - 0x14]
cmp edi, ebx
jne 0x10098600
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
push 0x100a2910
lea eax, [ebp - 0x30]
push eax
push 0x1000
lea eax, [ebp - 0x1030]
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x100985ce
jmp 0x10098697
call sub.kernel32.dll_GetLastError
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
add esp, 0x1024
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1017ba2c
push ebx
push edi
call fcn.100e1bd0
add esp, 0xc
jmp 0x100986d9
push 0x1017ba2c
push 0x1000
push ebx
call fcn.100e1b70
add esp, 0xc
ud2
Function at 0x1009d440
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [ebp - 0x24]
push dword [ebp + 8]
call fcn.100a9c80
add esp, 4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp edx, 0x80000000
je 0x1009d494
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
push 1
call fcn.100abfe0
add esp, 4
mov edi, dword [ebp - 0x18]
cmp edi, 0x80000000
jne 0x1009d4a1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x1009d4b9
mov byte [esi], 4
test edi, edi
jne 0x1009d4c8
jmp 0x1009d499
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x1009d499
add edi, edi
push 2
push edi
push ebx
call fcn.1000d080
add esp, 0x30
jmp 0x1009d49c

Function at 0x1009fd30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1009fd74
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1009fd7a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1009fdad
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x1009fdbd
mov dword [esi + 4], 0
jmp 0x1009fdcf
cmp eax, 0x103
je 0x1009fde8
test eax, eax
js 0x1009fdda
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1009fdd2
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1017b758
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push esi
call fcn.1008ebe0
add esp, 0xc
mov ecx, esi
call fcn.100625f0
mov ecx, 7
int 0x29
ud2
Function at 0x1009fe50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1009fe94
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1009fe9a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtWriteFile
cmp eax, 0x103
jne 0x1009fed4
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x1009fef5
test eax, eax
js 0x1009fee0
mov eax, dword [esp + 0xc]
mov bl, 4
jmp 0x1009fee8
xor ebx, ebx
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov dword [esi + 4], eax
mov byte [esi], bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1017b758
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push esi
call fcn.1008ebe0
add esp, 0xc
mov ecx, esi
call fcn.100625f0
mov ecx, 7
int 0x29
ud2

Function at 0x100a03c0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call sub.ws2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x100a0404
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2726
je 0x100a0417
cmp eax, 0x2739
jne 0x100a0440
push 1
push 0
push 0
push 0
push edi
push ebx
call sub.ws2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x100a0448
mov edi, eax
push 0
push 1
push eax
call sub.kernel32.dll_SetHandleInformation
test eax, eax
je 0x100a0458
mov dword [esi + 4], edi
jmp 0x100a03fa
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x100a03fd
call sub.ws2_32.dll_WSAGetLastError
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x100a03fd
call sub.kernel32.dll_GetLastError
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call sub.ws2_32.dll_closesocket
jmp 0x100a03fd
Function at 0x100a2570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
lea edi, [ebp - 0x30]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], ecx
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
sub eax, esi
add ecx, esi
push 0x100a2910
push edi
push eax
push ecx
push edx
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x100a25e3
nop word cs:[eax + eax]
nop
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 0
je 0x100a25c0
mov edi, dword [ebp - 0x18]
test edi, edi
je 0x100a2603
mov ecx, edi
call fcn.100a95a0
cmp al, 0xb
jne 0x100a25f5
jmp 0x100a2614
call sub.kernel32.dll_GetLastError
mov edi, eax
mov ecx, edi
call fcn.100a95a0
cmp al, 0xb
je 0x100a2614
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [eax], 0
jmp 0x100a261a
add esi, dword [ebp - 0x14]
mov dword [ebx + 8], esi
mov eax, dword [ebx + 0xc]
cmp eax, esi
cmova esi, eax
mov dword [ebx + 0xc], esi
mov eax, dword [ebp - 0x10]
mov byte [eax], 4
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100a2c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [edx], 0
mov edi, edx
jne 0x100a2d11
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x100a2ced
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [ebp - 0x2c], 0
lea ebx, [ebp - 0x2c]
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x100a2c90
mov eax, dword [ebp - 0x2c]
mov ecx, 2
test eax, eax
je 0x100a2cbc
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
jmp 0x100a2ce5
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x100a2cc3
cmp eax, 0x6d
jne 0x100a2cdc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 1
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
jne 0x100a2c7b
jmp 0x100a2cd5
mov word [esi], 4
jmp 0x100a2ce5
lea eax, [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
jne 0x100a2c7b
mov ecx, 1
jmp 0x100a2c84
mov dword [esi], 0
mov dword [esi + 4], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
test edx, edx
mov ecx, 0x10
mov eax, 1
cmove eax, ecx
mov ecx, ebx
push eax
call fcn.1006f890
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x100a2c56
lea edx, [ebp - 0x2c]
mov ecx, edi
mov dword [ebp - 0x2c], 0
call fcn.1006a820
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x100a7940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
call fcn.100a9c80
add esp, 4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
cmp ecx, 0x80000000
je 0x100a7990
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x34]
call fcn.1009c850
mov edi, dword [ebp - 0x1c]
cmp edi, 0x80000000
jne 0x100a79d7
movzx eax, byte [ebp - 0x18]
mov edi, dword [ebp - 0x14]
cmp al, 3
jne 0x100a79cc
mov ebx, dword [edi + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edi]
mov eax, dword [ebx]
test eax, eax
je 0x100a79a8
push esi
call eax
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x100a79bc
push dword [ebx + 8]
push eax
push esi
call fcn.1000d080
add esp, 0xc
push 4
push 0xc
push edi
call fcn.1000d080
add esp, 0xc
mov esi, dword [ebp - 0x10]
mov dword [esi], 0x80000000
add esp, 0x28
jmp 0x100a7a13
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x100a79fb
mov eax, dword [ebp - 0x10]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
add esp, 0x28
jmp 0x100a7a13
test edi, edi
mov dword [esi], 0x80000000
je 0x100a79f6
add edi, edi
push 2
push edi
push ebx
call fcn.1000d080
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100a90f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x10194460]
mov ebx, dword [ebp + 0x10]
movzx eax, byte [eax]
push 4
push 8
call fcn.1000d070
add esp, 8
test eax, eax
je 0x100a9189
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push 0x100a91e0
push eax
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x100a9142
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x100a9182
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x100a9153
push edi
call eax
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x100a9167
push dword [ebx + 8]
push eax
push edi
call fcn.1000d080
add esp, 0xc
push 4
push 8
push esi
call fcn.1000d080
add esp, 0xc
call sub.kernel32.dll_GetLastError
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ebx
mov ebx, dword [ebp + 0x14]
push 8
push 4
call fcn.100d08b0
add esp, 8
ud2

Function at 0x100ad920
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0xc]
test eax, 0x3fffffff
jne 0x100ad908
mov esi, dword [ebp + 8]
cmp eax, 0x80000000
jne 0x100ad8b6
xor ecx, ecx
mov eax, 0x80000000
lock cmpxchg dword [esi], ecx
jne 0x100ad8b6
lock inc dword [esi + 4]
add esi, 4
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
pop esi
pop ebp
ret
cmp eax, 0xc0000000
je 0x100ad8d3
cmp eax, 0x40000000
jne 0x100ad8b3
xor ecx, ecx
mov eax, 0x40000000
lock cmpxchg dword [esi], ecx
jne 0x100ad8b3
jmp 0x100ad8fe
mov ecx, 0x40000000
mov eax, 0xc0000000
lock cmpxchg dword [esi], ecx
jne 0x100ad8b3
lock inc dword [esi + 4]
lea eax, [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
xor ecx, ecx
mov eax, 0x40000000
lock cmpxchg dword [esi], ecx
jne 0x100ad8b3
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressAll]
pop esi
pop ebp
ret
push 0x1017c328
push 0x24
push str.assertion_failed:_is_unlocked_state_
call fcn.100dc1e0
nop dword [eax]
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
push 8
push 0x10
push edi
call fcn.1000d080
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret
Function at 0x100adaa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x100adab7
test eax, eax
jne 0x100adbee
mov esi, dword [0x101bf160]
mov cl, 1
nop
test esi, esi
je 0x100adafd
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x100adc31
mov esi, dword [esi + 8]
test ebx, ebx
je 0x100adac0
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x100adac0
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
xor ecx, ecx
jmp 0x100adac0
test cl, 1
jne 0x100adbee
mov esi, dword [0x101bf160]
mov cl, 1
nop
test esi, esi
je 0x100adb4d
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x100adc31
mov esi, dword [esi + 8]
test ebx, ebx
je 0x100adb10
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x100adb10
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
xor ecx, ecx
jmp 0x100adb10
test cl, 1
jne 0x100adbee
mov esi, dword [0x101bf160]
mov cl, 1
nop
test esi, esi
je 0x100adb9d
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x100adc31
mov esi, dword [esi + 8]
test ebx, ebx
je 0x100adb60
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x100adb60
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
xor ecx, ecx
jmp 0x100adb60
test cl, 1
jne 0x100adbee
mov esi, dword [0x101bf160]
mov cl, 1
nop word [eax + eax]
test esi, esi
je 0x100adbe9
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x100adc31
mov esi, dword [esi + 8]
test ebx, ebx
je 0x100adbb0
dec ebx
push ebx
mov dword [ebp - 0x10], ecx
call sub.kernel32.dll_TlsGetValue
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x100adbb0
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
xor ecx, ecx
jmp 0x100adbb0
test cl, 1
je 0x100adbf8
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x101bf160]
nop
test edi, edi
je 0x100adbee
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x100adc31
mov edi, dword [edi + 8]
test esi, esi
je 0x100adc00
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x100adc00
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x100adc00
push 0x1017c3b8
call fcn.100dbfb0
add esp, 4
ud2
Function at 0x100adf90
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
movzx eax, word [eax + 8]
mov word [ebp - 0xe], ax
mov eax, dword [0x101bf144]
cmp eax, 4
jne 0x100ae07e
lea eax, [ebp - 0xe]
cmp ebx, 0x17f
mov dword [ebp - 0x18], eax
ja 0x100ae095
lea esi, [ebp - 0x1c4]
push ebx
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov byte [ebp + ebx - 0x1c4], 0
inc ebx
lea eax, [ebp - 0x24]
push ebx
push esi
push eax
call fcn.100d9ab0
add esp, 0xc
cmp dword [ebp - 0x24], 0
je 0x100ae01c
mov eax, dword [0x1017a860]
mov esi, dword [ebp + 8]
mov ecx, dword [0x1017a864]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x100ae0a6
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x44]
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x3c], 1
push ecx
push edx
push 0
push eax
call sub.ws2_32.dll_getaddrinfo
mov esi, dword [ebp + 8]
test eax, eax
je 0x100ae067
call sub.ws2_32.dll_WSAGetLastError
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x100ae0a6
mov eax, dword [ebp - 0x14]
movzx ecx, word [ebp - 0xe]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], cx
mov dword [esi], eax
jmp 0x100ae0a6
call fcn.10096b20
lea eax, [ebp - 0xe]
cmp ebx, 0x17f
mov dword [ebp - 0x18], eax
jbe 0x100adfcf
lea eax, [ebp - 0x18]
mov ecx, esi
mov edx, edi
push eax
push ebx
call fcn.10097a90
add esp, 8
mov eax, esi
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100aed30
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [ebp + 8]
mov edi, ecx
xorps xmm0, xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 7
movsd qword [esp + 0x32], xmm0
movsd qword [esp + 0x2c], xmm0
mov byte [esp + 0x34], 1
lea esi, [esp + 0x18]
lea ecx, [esp + 0x10]
push esi
push eax
call fcn.1009cc80
add esp, 8
cmp byte [esp + 0x10], 4
jne 0x100aed94
mov esi, dword [esp + 0x14]
jmp 0x100aeda1
movzx eax, byte [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp al, 4
jne 0x100aee1b
lea ebx, [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.1009cea0
mov eax, dword [esp + 0x18]
xor eax, 2
or eax, dword [esp + 0x1c]
jne 0x100aee09
cmp byte [esp + 0x20], 3
jne 0x100aee10
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [edi]
test eax, eax
je 0x100aeddf
push ebx
call eax
add esp, 4
mov eax, dword [edi + 4]
test eax, eax
je 0x100aedf3
push dword [edi + 8]
push eax
push ebx
call fcn.1000d080
add esp, 0xc
push 4
push 0xc
push dword [esp + 0x14]
call fcn.1000d080
add esp, 0xc
mov edi, dword [esp + 4]
jmp 0x100aee10
cmp dword [esp + 0x54], 0
je 0x100aee67
mov dword [edi], 0
jmp 0x100aef0e
cmp al, 3
jne 0x100aee5c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [ebx]
test eax, eax
je 0x100aee37
push dword [esp + 4]
call eax
add esp, 4
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 4]
test eax, eax
je 0x100aee4f
push dword [ebx + 8]
push eax
push ecx
call fcn.1000d080
add esp, 0xc
push 4
push 0xc
push esi
call fcn.1000d080
add esp, 0xc
mov dword [edi], 0
jmp 0x100aef14
mov eax, dword [esp + 0x50]
test esi, esi
mov dword [esp + 0xc], eax
je 0x100aee99
mov dword [esp + 0x18], 0
call sub.kernel32.dll_GetCurrentProcess
push 2
push 0
push 0
push ebx
push eax
push esi
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x100aef03
mov eax, dword [esp + 0x18]
jmp 0x100aee9b
xor eax, eax
push 0
push 0
push 0
push 2
push 0
mov dword [esp + 0x1c], eax
push eax
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x100aeef2
push dword [esp + 0xc]
push 0
push 0
push 4
push eax
mov dword [esp + 0x18], edi
mov edi, eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
push edi
mov edi, dword [esp + 8]
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x100aeef2
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ecx
mov dword [edi], 1
jmp 0x100aef0e
mov dword [edi], 0
push dword [esp + 8]
call sub.kernel32.dll_CloseHandle
jmp 0x100aef0e
call sub.kernel32.dll_GetLastError
mov dword [edi], 0
push esi
call sub.kernel32.dll_CloseHandle
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100b3c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
xor eax, eax
cmp dword [ebp + 8], 0
jne 0x100b3d1a
mov esi, dword [ecx + 0x30]
test esi, esi
je 0x100b3d1a
mov eax, dword [ecx + 0x2c]
xor ebx, ebx
mov edi, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
nop dword [eax]
shr edi, 1
add edi, ebx
mov ecx, dword [eax + edi*8]
cmp ecx, edx
je 0x100b3ca3
cmp ecx, edx
lea ecx, [edi + 1]
cmova esi, edi
cmovb ebx, ecx
mov edi, esi
sub edi, ebx
ja 0x100b3c80
test ebx, ebx
je 0x100b3d18
dec ebx
mov edi, ebx
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
jae 0x100b3d22
mov esi, dword [eax + edi*8 + 4]
cmp byte [esi], 0
je 0x100b3ccd
push 8
push esi
push 0
call fcn.100b7720
add esp, 0xc
test eax, eax
je 0x100b3d0f
cmp edx, 9
jae 0x100b3d2e
mov eax, esi
jmp 0x100b3d1a
mov edi, dword [ebp - 0x14]
xor eax, eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x100b3d1a
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi + 0x18]
mov ebx, dword [edi + 0x1c]
mov esi, dword [esi + 4]
mov edx, ecx
add edx, esi
mov edx, ebx
adc edx, 0
jb 0x100b3d1a
add ecx, esi
adc ebx, 0
push 0
push dword [edi + 0x24]
push dword [edi + 0x20]
push ebx
push ecx
push dword [edi + 0x14]
push dword [ebp - 0x10]
call fcn.100b4510
add esp, 0x1c
jmp 0x100b3d1a
mov edx, 8
mov eax, esi
jmp 0x100b3d1a
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1017c640
push ecx
push edi
call fcn.100dc320
push 0x10178ed8
push 8
push edx
call fcn.100e1b70
nop dword [eax + eax]

Function at 0x100b3d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x10101100]
mov edi, ecx
test esi, esi
je 0x100b3de2
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x100b3dda
je 0x100b3d82
test edi, edi
je 0x100b3d86
mov ebx, dword [edi]
mov dword [edi], 0
mov eax, dword [edi + 8]
test ebx, ebx
cmove eax, ebx
cmovne ebx, dword [edi + 4]
mov dword [ebp - 0x10], eax
jmp 0x100b3d8f
xor eax, eax
jmp 0x100b3dda
mov dword [ebp - 0x10], 0
xor ebx, ebx
mov eax, dword [0x10194460]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.1000d070
add esp, 8
test eax, eax
je 0x100b3e02
mov ecx, dword [ebp - 0x10]
mov dword [eax], ebx
mov byte [eax + 4], cl
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x100b3dd7
push 4
push 0xc
push edi
call fcn.1000d080
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10101100
call fcn.100adc50
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x100b3d63
jmp 0x100b3dda
push 0xc
push 4
call fcn.100d08b0
nop dword [eax + eax]