joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cb8d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
nop
mov dword [esp + 0x18], 0xffffffff
test edi, edi
jg 0x100cb904
test esi, esi
jle 0x100cba40
lea eax, [edi - 1]
add eax, ebx
cmp eax, 0xffffffff
jae 0x100cba4a
test edi, edi
je 0x100cba2c
test esi, esi
je 0x100cba12
push esi
push ebp
push edi
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push ebx
push eax
movups xmmword [esp + 0x30], xmm0
call fcn.100cb4c0
add esp, 0x14
test eax, eax
js 0x100cba06
jne 0x100cb9cc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
test ecx, ecx
jne 0x100cb959
test eax, eax
je 0x100cb99e
mov edx, dword [esp + 0x10]
sub eax, ebp
push eax
sub ecx, ebx
push ebp
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.100cb8d0
add esp, 0x10
test eax, eax
jne 0x100cba4d
mov eax, dword [esp + 0x20]
sub ebx, eax
mov edx, dword [esp + 0x10]
dec ebx
mov ecx, dword [esp + 0x14]
add edi, ebx
lea ebx, [eax + 1]
mov eax, dword [esp + 0x28]
sub ebp, eax
dec ebp
add esi, ebp
lea ebp, [eax + 1]
jmp 0x100cb8f0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x34]
lea ebx, [ebx + 1]
mov byte [eax + ebx - 2], 1
sub edi, 1
jne 0x100cb9a2
mov eax, dword [ecx + 0x78]
lea ebp, [ebp + 1]
mov byte [eax + ebp - 2], 1
sub esi, 1
jne 0x100cb9b2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov ecx, dword [esp + 0x10]
xorps xmm0, xmm0
push esi
push ebp
mov eax, dword [eax]
and eax, 0xffff3fff
movlpd qword [esp + 0x28], xmm0
push edi
push ebx
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x2c], eax
call fcn.100c2940
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [edx + 0x34]
lea ebx, [ebx + 1]
mov byte [eax + ebx - 2], 1
sub edi, 1
jne 0x100cba12
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
test esi, esi
je 0x100cba40
mov eax, dword [edx + 0x78]
lea ebp, [ebp + 1]
mov byte [eax + ebp - 2], 1
sub esi, 1
jne 0x100cba30
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x100ccae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10157d35
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x101a7680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
jne 0x100ccb68
push 4
call fcn.1012fb05
add esp, 4
test eax, eax
je 0x100ccb21
mov dword [eax], fcn.10032a50
jmp 0x100ccb23
xor eax, eax
mov dword [ebp + 0xc], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100cca50
push 0
push 0
call fcn.1013522b
add esp, 0x18
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100ccb85
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x100ccb7e
push ecx
push eax
call fcn.1012d7fc
add esp, 8
test eax, eax
jne 0x100ccb7e
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
push 1
call fcn.1012da72
push 6
mov dword [ebp - 0x10], 0
call fcn.1012da72
int3
Function at 0x100cd6e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10157e1d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x101a7680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x68], eax
lea eax, [esi + 0x10]
push eax
call fcn.100da8c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
lea ebx, [esi + 4]
push dword [0x101acaf8]
mov esi, dword [ebx]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], 0
mov dword [ebp - 0x6c], eax
call edi
test eax, eax
je 0x100cd763
cmp dword [eax], esi
je 0x100cd77a
mov eax, dword [eax + 8]
test eax, eax
jne 0x100cd758
push dword [0x101acae4]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x78], eax
call edi
test eax, eax
je 0x100cd793
mov eax, dword [eax + 4]
jmp 0x100cd795
cmp dword [eax + 4], 0
je 0x100cd763
nop
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.100df080
nop
jmp 0x100cd84f
xor eax, eax
push 8
push 0x80
push eax
push dword [ebp - 0x6c]
call fcn.100cf250
add esp, 0x10
mov edi, eax
mov dword [edi + 0x14], 0
lea ecx, [edi + 0x30]
mov dword [edi + 0x18], 0x100e3310
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov eax, dword [ebp - 0x68]
mov dword [edi + 0x20], eax
mov eax, dword [ebp - 0x60]
mov dword [edi + 0x28], eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.100db9d0
mov ecx, dword [ebp - 0x6c]
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x60], eax
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x64], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push edi
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], edx
mov eax, dword [ebp - 0x18]
push ebx
mov dword [edi + 0x70], eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x74], 0
call fcn.100e3880
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x100cd877
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x100cd877
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x100cd877
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100cd88f
mov edx, dword [ecx]
lea eax, [ebp - 0x50]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012fb43
mov esp, ebp
pop ebp
ret 8
Function at 0x100cf780
Capabilities:
Get thread local storage value

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x101580ed
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101a7680]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 0x218]
mov ecx, dword [ebp + 0x224]
push dword [0x101acae4]
mov esi, dword [ebp + 0x214]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x220]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100cf7f8
mov eax, dword [eax + 4]
jmp 0x100cf7fa
xor eax, eax
push 8
push 0x148
push eax
push dword [ebp - 0x1c]
call fcn.100cf250
add esp, 0x10
mov ebx, eax
mov ecx, dword [esi + 0xc]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x100cf829
mov edx, dword [esi + 8]
mov eax, ecx
mov dword [ebp - 0x10], eax
lock inc dword [ecx + 8]
mov dword [ebx + 0x14], 0
lea ecx, [eax + 8]
mov dword [ebx + 0x18], 0x100e3600
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x100cf883
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], eax
lock inc dword [ecx]
jmp 0x100cf886
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0x18]
lea edi, [ebx + 0x28]
push dword [ebp - 0x20]
mov ecx, 0x21
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0xb0]
call fcn.100dbac0
push dword [ebp - 0x24]
lea ecx, [ebx + 0x128]
push 0
push 0
call fcn.100db830
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100cf8cb
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x100cf8cb
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x18]
lea ecx, [ebp]
call fcn.100db210
mov eax, dword [ebp - 0x28]
test byte [eax + 4], 0x10
je 0x100cf8ec
cmp dword [ebp + 0x204], 0
jne 0x100cf8ec
mov cl, 1
jmp 0x100cf8ee
xor cl, cl
push ebx
push ecx
push dword [ebp + 0x21c]
lea ecx, [ebp]
push dword [ebp + 0x200]
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.100eb200
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.100ea160
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1012fb43
lea esp, [ebp + 0x20c]
pop ebp
ret 0x14
Function at 0x100cf950
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158130
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x101a7680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x84], eax
call fcn.100db320
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x64], 0
mov eax, dword [edx]
lea esi, [edx + 0x18]
mov ecx, dword [edx + 4]
mov dword [ebp - 0x60], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [edx + 0x10]
push esi
mov dword [ebp - 0x50], eax
call fcn.100db9d0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x14], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x10c]
push 0x10000
push eax
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 0
mov dword [ebp - 0x64], 1
call fcn.100e97f0
lea ecx, [esi + 0x44]
push ecx
lea ecx, [ebp - 0x88]
push ecx
mov ecx, dword [esi]
push 0
push eax
lea eax, [esi + 4]
add ecx, 0x14
push eax
call fcn.100cf780
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100cfa45
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x100cfa45
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x100cfa45
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100cfa64
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x80]
test edx, edx
je 0x100cfa97
mov ecx, dword [ebp - 0x78]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x100cfa8d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cfab2
push ecx
push edx
call fcn.1012fb35
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012fb43
mov esp, ebp
pop ebp
ret
call fcn.101355d8
int3
Function at 0x100df110
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158d25
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x101a7680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
lea esi, [ecx + 8]
push dword [0x101acaf8]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100df163
cmp dword [eax], edi
je 0x100df17b
mov eax, dword [eax + 8]
test eax, eax
jne 0x100df158
push dword [0x101acae4]
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100df1a7
mov eax, dword [eax + 4]
jmp 0x100df1a9
cmp dword [eax + 4], 0
je 0x100df163
nop
mov ecx, dword [esi + 0x24]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x100df1ff
mov eax, dword [ecx]
call dword [eax + 8]
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
push 8
push 0x50
push eax
push dword [ebp - 0x14]
call fcn.100cf250
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
push ecx
push esi
mov ecx, eax
call fcn.100db280
mov ecx, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
call fcn.100e3880
lea ecx, [ebp - 0x28]
call fcn.100e9fc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1012dbc6
int3
Function at 0x100e2ee0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101590cd
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x101a7680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 0x7c]
xor edx, edx
mov esi, dword [ecx + 0x80]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x100e2f43
mov eax, dword [ecx]
lea edx, [ebp - 0x70]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x4c], edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x14], 0
test edx, edx
je 0x100e2f91
lea eax, [ebp - 0x70]
cmp edx, eax
jne 0x100e2f87
mov eax, dword [edx]
lea ecx, [ebp - 0x38]
push ecx
mov ecx, edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x100e2f91
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [ebp - 0x70]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x100e2f8a
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x4c], 0
push dword [0x101acaf8]
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100e2fb3
cmp dword [eax], esi
je 0x100e2fd0
mov eax, dword [eax + 8]
test eax, eax
jne 0x100e2fa8
xor eax, eax
push dword [0x101acae4]
test eax, eax
setne byte [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100e2fd5
mov eax, dword [eax + 4]
jmp 0x100e2fd7
mov eax, dword [eax + 4]
jmp 0x100e2fb5
xor eax, eax
push 8
push 0x58
push eax
push dword [ebp - 0x48]
call fcn.100cf250
mov esi, eax
add esp, 0x10
lea eax, [ebp - 0x40]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x100e3550
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.100dba40
mov ecx, dword [ebp - 0x48]
push dword [ebp - 0x44]
push esi
mov ecx, dword [ecx + 8]
call fcn.100e9760
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100e3053
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp + 0x30]
mov dword [edi], 0
mov dword [edi + 4], 0x101a7038
test ecx, ecx
je 0x100e3078
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012fb43
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x100e7810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
movzx ebp, ax
xor eax, eax
mov esi, ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x20], eax
jbe 0x100e7871
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x100e7871
jne 0x100e7868
cmp eax, edx
jge 0x100e7868
mov ecx, dword [esp + 0x18]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x100e7899
inc eax
cmp eax, edx
jl 0x100e7856
mov esi, dword [esp + 0x10]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x20]
jb 0x100e7833
mov edi, dword [esp + 0x2c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x100e78af
mov esi, dword [esp + 0x28]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x100e78a1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x100e78a3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edx, ecx
sub ebp, edx
js 0x100e78af
inc eax
xor bl, 1
cmp eax, edi
jb 0x100e7881
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x100e9f00
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x100e9f5c
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x100e9f36
push ebp
or ebp, 0xffffffff
mov eax, ebp
lock xadd dword [esi + 4], eax
jne 0x100e9f35
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebp
dec ebp
jne 0x100e9f35
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop ebp
mov ecx, dword [ebx + 0x5c]
add ebx, 0x38
test ecx, ecx
je 0x100e9f55
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100e9f9f
push dword [0x101acae4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100e9f8f
mov edx, dword [eax + 4]
test edx, edx
je 0x100e9f8f
xor eax, eax
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x100e9fa3
inc eax
cmp eax, 2
jl 0x100e9f80
push esi
call fcn.1013569c
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 0x80]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
Function at 0x100e9fc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x100e9ff1
mov ecx, dword [eax + 0x44]
lea esi, [eax + 0x20]
test ecx, ecx
je 0x100e9fea
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100ea030
push dword [0x101acae4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100ea020
mov edx, dword [eax + 4]
test edx, edx
je 0x100ea020
xor eax, eax
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x100ea033
inc eax
cmp eax, 2
jl 0x100ea011
push esi
call fcn.1013569c
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x50]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x100ea050
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x100ea081
mov ecx, dword [eax + 0x4c]
lea esi, [eax + 0x28]
test ecx, ecx
je 0x100ea07a
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100ea0c0
push dword [0x101acae4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100ea0b0
mov edx, dword [eax + 4]
test edx, edx
je 0x100ea0b0
xor eax, eax
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x100ea0c3
inc eax
cmp eax, 2
jl 0x100ea0a1
push esi
call fcn.1013569c
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x58]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x100ea0e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x100ea0fa
add ecx, 8
call fcn.100dd0b0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100ea13f
push dword [0x101acae4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100ea12f
mov edx, dword [eax + 4]
test edx, edx
je 0x100ea12f
mov eax, 4
nop dword [eax]
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x100ea142
inc eax
cmp eax, 6
jl 0x100ea120
push esi
call fcn.1013569c
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x98]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x100ea160
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101587c0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101a7680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x100ea1d3
lea ecx, [esi + 0x128]
cmp dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
je 0x100ea1ab
mov eax, dword [ecx + 0xc]
push ecx
mov eax, dword [eax]
call eax
add esp, 4
lea ecx, [esi + 0xb0]
call fcn.100dd0b0
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x100ea1cc
or eax, 0xffffffff
lock xadd dword [ecx + 8], eax
jne 0x100ea1cc
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100ea212
push dword [0x101acae4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100ea202
mov edx, dword [eax + 4]
test edx, edx
je 0x100ea202
xor eax, eax
cmp dword [edx + eax*4], 0
lea ecx, [edx + eax*4]
je 0x100ea223
inc eax
cmp eax, 2
jl 0x100ea1f3
push esi
call fcn.1013569c
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, byte [esi + 0x148]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x100ea20b

Function at 0x100eb200
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [esp + 0x18], 0
je 0x100eb227
mov ecx, dword [edi + 4]
push 0
push 0
push dword [esp + 0x24]
call fcn.100e9180
pop edi
ret 0x18
mov eax, dword [esp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x100eb249
mov ecx, dword [edi + 4]
push 0
push 0x2719
push dword [esp + 0x24]
call fcn.100e9180
pop edi
ret 0x18
push ebx
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push esi
push 0
push ebx
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0
push ecx
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x100eb2a6
cmp eax, 0x3e5
je 0x100eb2a6
push dword [esp + 0x20]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.100e9180
pop esi
pop ebx
pop edi
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.100e9410
pop esi
pop ebx
pop edi
ret 0x18