joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d0e5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 0xc]
mov ebx, edx
cmp dword [edx + 0x14], 0x10
jb 0x1002464a
mov ebx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10024668
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10024656
push edi
push edx
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.10025220
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10024699
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x1bacf91
je 0x100247db
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x94
mov dword [ebp - 0x1c], 0
call fcn.100b887b
add esp, 4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push dword [ebp + 0xc]
lea ecx, [ebx + 8]
call fcn.10006f40
lea ecx, [ebx + 0x20]
call fcn.10020a10
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014b760]
mov eax, dword [esi + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1014b760]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1002477b
divss xmm0, xmm3
call fcn.100209c0
call fcn.1010c0b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x1002475f
cmp eax, 0x200
jae 0x1002475d
shl eax, 3
cmp eax, ecx
jae 0x1002475f
mov eax, ecx
push eax
mov ecx, esi
call fcn.10024d80
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10025220
mov edx, dword [eax]
jmp 0x1002477e
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x20]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x100247a8
mov dword [ecx + eax*8], ebx
jmp 0x100247ba
cmp esi, edx
jne 0x100247b1
mov dword [ecx + eax*8], ebx
jmp 0x100247be
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100247be
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100b62ed
int3
Function at 0x10027200
Capabilities:
Get socket status

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d2d0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x298
mov eax, dword [0x10163164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x234], ecx
mov edi, dword [ebx + 0x10]
lea eax, [ebp - 0x2a8]
push 0x48
push 0
push eax
mov dword [ebp - 0x238], edi
mov byte [ebp - 0x229], 0
call fcn.100c2fd0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x2a8]
push 0x40
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x25c], 0
push eax
mov dword [ebp - 0x258], 0x186a0
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x288], 1
mov dword [ebp - 0x250], 2
mov dword [ebp - 0x254], 0xffffffff
call fcn.100ba360
add esp, 0x18
test eax, eax
jne 0x10027458
lea eax, [ebp - 0x254]
push eax
push 0x100274a0
push 2
push dword [ebp - 0x234]
push dword [ebp - 0x230]
call fcn.100b9c10
call fcn.1007dac0
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x240], edx
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x120], 0
call fcn.100b9ad0
add esp, 0x20
test eax, eax
je 0x100273f4
mov esi, dword [sym.imp.WS2_32.dll_select]
mov edi, dword [ebp - 0x234]
lea ecx, [ebp - 0x25c]
push ecx
push 0
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push eax
call esi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x230]
call fcn.100bc3d0
add esp, 0xc
call fcn.1007dac0
sub eax, edi
sbb edx, dword [ebp - 0x240]
test edx, edx
ja 0x100273ee
jb 0x100273b6
cmp eax, 0x3e8
ja 0x100273ee
lea eax, [ebp - 0x120]
mov dword [ebp - 0x228], 0
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x120], 0
push eax
push dword [ebp - 0x230]
call fcn.100b9ad0
add esp, 0xc
test eax, eax
jne 0x10027366
mov edi, dword [ebp - 0x238]
push dword [ebp - 0x230]
call fcn.100b9ff0
add esp, 4
cmp dword [ebp - 0x254], 0
jne 0x10027458
mov eax, dword [ebp - 0x248]
mov esi, dword [ebp - 0x24c]
mov byte [ebp - 0x229], 1
mov dword [ebp - 0x238], eax
cmp esi, eax
je 0x10027458
mov ecx, dword [edi + 4]
cmp ecx, dword [edi + 8]
je 0x10027444
movups xmm0, xmmword [esi]
movups xmmword [ecx], xmm0
mov ax, word [esi + 0x10]
mov word [ecx + 0x10], ax
add dword [edi + 4], 0x12
jmp 0x1002744d
push esi
push ecx
mov ecx, edi
call fcn.10026f60
add esi, 0x12
cmp esi, dword [ebp - 0x238]
jne 0x10027428
lea ecx, [ebp - 0x24c]
call fcn.10024010
mov al, byte [ebp - 0x229]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b8868
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10027780
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x1017537c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100277aa
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp - 4]
call fcn.10029e00
add esp, 8
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
xor ecx, ecx
push ecx
push dword [ebp - 4]
call fcn.10029e00
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x100277c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x1017537c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100277d8
mov ecx, dword [eax + 4]
jmp 0x100277da
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x3fc
ja 0x100277ff
test ecx, ecx
je 0x100277ff
xor eax, eax
nop dword [eax]
cmp dword [ecx + eax*4], 0
lea edx, [ecx + eax*4]
je 0x1002780d
inc eax
cmp eax, 2
jl 0x100277f0
push dword [ebp + 8]
call fcn.100b88ab
add esp, 4
pop esi
pop ebp
ret
mov ecx, dword [ebp + 8]
mov al, byte [ecx + esi]
mov byte [ecx], al
mov dword [edx], ecx
pop esi
pop ebp
ret
Function at 0x100279a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x100279c4
push 0x37
push str.E:workOpenNetfilter_third_party_asio_nonboostinclude_asioimplcancellation_signal.ipp
push str.handler_
call fcn.100cb42e
add esp, 0xc
mov eax, dword [esi]
xor edx, edx
mov ebx, dword [ebp + 8]
xor edi, edi
mov ecx, dword [eax]
mov dword [ebx], 0
mov dword [ebx + 4], 0
test ecx, ecx
je 0x100279fb
mov eax, dword [ecx]
lea edx, [ebp - 0xc]
push edx
call dword [eax + 4]
mov edi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esi]
mov dword [ebx], edi
mov dword [ebx + 4], edx
mov dword [eax], 0
mov esi, dword [ebp + 0xc]
cmp esi, edx
jbe 0x10027b20
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
test edi, edi
je 0x10027a60
push dword [0x1017537c]
call eax
test eax, eax
je 0x10027a20
mov edx, dword [eax + 4]
jmp 0x10027a22
xor edx, edx
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
cmp edi, 0x3fc
ja 0x10027a4f
test edx, edx
je 0x10027a4f
mov eax, 6
nop dword [eax + eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x10027ab2
inc eax
cmp eax, 8
jl 0x10027a40
push esi
call fcn.100b88ab
add esp, 4
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [ebp + 0xc]
push dword [0x1017537c]
call eax
lea ebx, [esi + 3]
shr ebx, 2
test eax, eax
je 0x10027aec
mov edi, dword [eax + 4]
test edi, edi
je 0x10027aec
mov ecx, 6
nop
mov edx, dword [edi + ecx*4]
lea esi, [edi + ecx*4]
test edx, edx
je 0x10027a91
movzx eax, byte [edx]
cmp eax, ebx
jae 0x10027abb
inc ecx
cmp ecx, 8
jl 0x10027a80
mov eax, 6
nop dword [eax]
mov edx, dword [edi + eax*4]
lea ecx, [edi + eax*4]
test edx, edx
jne 0x10027ada
inc eax
cmp eax, 8
jl 0x10027aa0
jmp 0x10027ae9
mov al, byte [esi + edi]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x10027a58
mov dword [esi], 0
mov esi, dword [ebp + 0xc]
mov al, byte [edx]
mov byte [edx + esi], al
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edx
mov dword [ecx], 0
call fcn.100b88ab
add esp, 4
mov esi, dword [ebp + 0xc]
lea eax, [ebx*4 + 1]
push eax
call fcn.100b887b
mov edx, eax
movzx ecx, bl
xor eax, eax
add esp, 4
cmp ebx, 0xff
cmova ecx, eax
mov eax, dword [ebp + 8]
mov byte [edx + esi], cl
mov dword [eax], edx
mov dword [eax + 4], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10027b30
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [ecx]
test esi, esi
je 0x10027b7c
push edi
push dword [0x1017537c]
mov edi, dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10027b50
mov edx, dword [eax + 4]
jmp 0x10027b52
xor edx, edx
cmp edi, 0x3fc
ja 0x10027b72
test edx, edx
je 0x10027b72
mov eax, 6
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x10027b7e
inc eax
cmp eax, 8
jl 0x10027b63
push esi
call fcn.100b88ab
add esp, 4
pop edi
pop esi
ret
mov al, byte [edi + esi]
mov byte [esi], al
pop edi
mov dword [ecx], esi
pop esi
ret
Function at 0x10027d30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 0
push 1
mov esi, ecx
push 0
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x10027d85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [esp + 0x18], esi
call fcn.10008d10
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x10027e4c
mov esi, dword [esp + 0x10]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x10027dc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [esp + 0x18], esi
call fcn.10008d10
mov dword [esp + 0x1c], eax
test esi, esi
jne 0x10027e5a
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0
push ebx
push 0x10027e80
push dword [ebp + 0xc]
push 0
call fcn.100cba9a
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10027e33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [esp + 0x1c], eax
call dword [edx]
test edi, edi
je 0x10027e10
push edi
call esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 8]
test eax, eax
je 0x10027e1e
push eax
call esi
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x18], ebx
call fcn.10008d10
mov dword [esp + 0x1c], eax
test ebx, ebx
jne 0x10027e68
test edi, edi
je 0x10027e43
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [esp + 0x18]
call fcn.10008cc0
mov edx, str.thread.exit_event
lea ecx, [esp + 0x18]
call fcn.10008cc0
mov edx, str.thread
lea ecx, [esp + 0x18]
call fcn.10008cc0
int3
Function at 0x10027f80
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d41e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.asio::detail::win_iocp_io_context.0
mov dword [edi + 0x14], 0
lea ebx, [edi + 0x18]
mov dword [edi + 0x1c], 0
mov dword [ebx], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x38]
mov dword [edi + 0x34], 0
call fcn.100278e0
mov esi, eax
call fcn.10008d10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x100280fa
mov dword [edi + 0x50], esi
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
mov dword [edi + 0x5c], 0xffffffff
mov dword [edi + 0x60], esi
push 0xffffffffffffffff
push esi
push esi
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 0x14], eax
test eax, eax
jne 0x1002807c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.10008d10
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x10028107
cmp byte [ebp + 0x10], 0
je 0x100280e4
lock inc dword [ebx]
push 0xc
call fcn.100b887b
mov esi, eax
add esp, 4
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 7
push 0x10
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.100b887b
add esp, 4
mov dword [ebp + 8], eax
mov ecx, esi
mov dword [eax], vtable.asio::detail::win_thread::func_struct_asio::detail::win_iocp_io_context::thread_function_.0
push 0
push eax
mov dword [eax + 0xc], edi
call fcn.10027d30
mov ebx, dword [edi + 0x60]
test ebx, ebx
je 0x100280e1
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push ebx
call fcn.100b88b0
add esp, 8
mov dword [edi + 0x60], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, str.mutex
lea ecx, [ebp - 0x1c]
call fcn.10008cc0
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.10008cc0
int3
Function at 0x10028120
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d440
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.asio::detail::win_iocp_io_context.0
je 0x100281dd
call fcn.10028710
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x101743f4
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
push 0
push ecx
test eax, eax
je 0x100281a9
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x100281bf
push sym.NetFilterInterface.dll_SetBlur
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x100281d6
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.100b88b0
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.1000b8e0
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x100281f9
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x10028210
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.100b88b0
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1002821a
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.asio::execution_context::service.0
je 0x10028231
push 0x64
push esi
call fcn.100b88b0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10028590
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d4a5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x10163164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea eax, [esi + 0x18]
lock xadd dword [eax], edx
test edx, edx
jne 0x100285f2
call fcn.10028710
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0x10163ad8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
push eax
call fcn.100b7ce3
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
add esp, 4
mov dword [ebp - 0x28], 0
movups xmmword [ebp - 0x4c], xmm0
movups xmmword [ebp - 0x3c], xmm0
mov ecx, esi
mov dword [ebp - 4], 0
push dword [0x1017537c]
neg ecx
lea eax, [esi + 0x14]
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push dword [0x1017537c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push ebx
push eax
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
xor edi, edi
call fcn.10028860
test eax, eax
je 0x1002868e
cmp edi, 0xffffffff
lea eax, [edi + 1]
push ebx
cmove eax, edi
mov edi, eax
lea eax, [ebp - 0x4c]
push eax
push ecx
mov ecx, esi
call fcn.10028860
test eax, eax
jne 0x10028672
push dword [ebp - 0x10]
push dword [0x1017537c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
nop
mov eax, dword [ebp + esi*4 - 0x4c]
test eax, eax
je 0x100286b1
push eax
call fcn.100b88ab
add esp, 4
inc esi
cmp esi, 0xa
jl 0x100286a0
lea eax, [ebp - 0x20]
push eax
call fcn.100b7dce
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10028d30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x10028e32
cmp byte [ebp + 8], 0
je 0x10028d88
mov al, byte [edx]
test al, 8
je 0x10028d88
or al, 8
xor ecx, ecx
push 4
mov byte [edx], al
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 4], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x10028d88
call fcn.10008d10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
test ebx, ebx
je 0x10028e08
call fcn.10008d10
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
call fcn.10008d10
mov ecx, eax
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jne 0x10028dc1
cmp dword [edi], 0x2733
je 0x10028ddb
call fcn.10008d10
mov ecx, eax
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jne 0x10028e0e
cmp dword [edi], 0x4d5
jne 0x10028e0e
mov esi, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0xc]
push esi
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
test ebx, ebx
jne 0x10028e17
mov dword [edi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10008d10
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov eax, ebx
mov dword [edi + 4], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10028e40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.10008d10
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [ebp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], esi
cmp eax, 0x40
jne 0x10028e8e
call fcn.10008d10
mov dword [edi], 0x2746
jmp 0x10028ea0
cmp eax, 0x4d2
jne 0x10028ea3
call fcn.10008d10
mov dword [edi], 0x274d
mov dword [edi + 4], eax
test ebx, ebx
je 0x10028eb1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029680
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
push dword [0x1017537c]
mov edi, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1002969b
mov edx, dword [eax + 4]
jmp 0x1002969d
xor edx, edx
cmp edi, 0x3fc
ja 0x100296bf
test edx, edx
je 0x100296bf
mov eax, 2
nop
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x100296cb
inc eax
cmp eax, 4
jl 0x100296b0
push esi
call fcn.100b88ab
add esp, 4
pop edi
pop esi
ret
mov al, byte [esi + edi]
mov byte [esi], al
pop edi
mov dword [ecx], esi
pop esi
ret
Function at 0x100296e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x1017537c]
mov ebx, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add ebx, 3
shr ebx, 2
test eax, eax
je 0x10029768
mov edi, dword [eax + 4]
test edi, edi
je 0x10029768
mov ecx, 2
nop
mov edx, dword [edi + ecx*4]
lea esi, [edi + ecx*4]
test edx, edx
je 0x10029721
movzx eax, byte [edx]
cmp eax, ebx
jae 0x10029742
inc ecx
cmp ecx, 4
jl 0x10029710
mov eax, 2
nop dword [eax]
mov edx, dword [edi + eax*4]
lea ecx, [edi + eax*4]
test edx, edx
jne 0x10029759
inc eax
cmp eax, 4
jl 0x10029730
jmp 0x10029768
mov dword [esi], 0
mov eax, edx
mov esi, dword [ebp - 4]
mov cl, byte [edx]
pop edi
mov byte [edx + esi], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edx
mov dword [ecx], 0
call fcn.100b88ab
add esp, 4
lea eax, [ebx*4 + 1]
push eax
call fcn.100b887b
mov esi, dword [ebp - 4]
add esp, 4
xor edx, edx
movzx ecx, bl
cmp ebx, 0xff
cmova ecx, edx
pop edi
mov byte [eax + esi], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret