joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011beb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011bee3
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x1011bf0c
add eax, 0x1c
jmp 0x1011bf3b
cmp dword [0x101de200], 0
je 0x1011bf68
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1011bf40
mov dword [ecx + 0x28], 0xffffe891
jmp 0x1011bf33
cmp dword [0x101de200], 0
je 0x1011bf72
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1011bf54
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov ecx, eax
jmp 0x1011bf03
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov ecx, eax
jmp 0x1011bf2c
call fcn.100745e0
jmp 0x1011beec
call fcn.100745e0
jmp 0x1011bf15

Function at 0x1011bf80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [esp + 0x88], eax
mov eax, dword [edi]
mov esi, dword [eax + 8]
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movaps xmmword [ebx + 0x60], xmm0
movaps xmmword [ebx + 0x50], xmm0
movaps xmmword [ebx + 0x40], xmm0
movaps xmmword [ebx + 0x30], xmm0
movaps xmmword [ebx + 0x20], xmm0
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x64]
call dword [section..00cfg]
mov dword [esp + 4], ebx
mov dword [esp], esi
call ecx
xor esi, esi
dec esi
test eax, eax
js 0x1011c077
mov dword [edi + 0x4c], 1
movzx eax, word [esp + 0x10]
cmp ax, 0x17
je 0x1011c02e
cmp ax, 2
jne 0x1011c04a
mov eax, dword [esp + 0x14]
xor esi, esi
mov dword [edi + 0xb4], esi
mov dword [edi + 0xb0], esi
mov dword [edi + 0xb8], 0xffff0000
mov dword [edi + 0xbc], eax
movzx eax, word [esp + 0x12]
mov word [edi + 0xc0], ax
jmp 0x1011c077
movups xmm0, xmmword [esp + 0x18]
movups xmmword [edi + 0xb0], xmm0
movzx eax, word [esp + 0x12]
mov word [edi + 0xc0], ax
xor esi, esi
jmp 0x1011c077
cmp dword [0x101de200], 0
je 0x1011c0a1
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011c08f
mov dword [eax + 0x28], 0xffffe89f
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011c068
call fcn.100745e0
jmp 0x1011c053
Function at 0x1011c0b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011c10f
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
mov eax, dword [edi + 0xd0]
test eax, eax
je 0x1011c0f6
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
mov dword [edi + 0xd0], 0
test esi, esi
je 0x1011c141
mov dword [esp], esi
call sym.nss3.dll_PORT_Strdup_Util
mov dword [edi + 0xd0], eax
test eax, eax
setne al
jmp 0x1011c143
cmp dword [0x101de200], 0
je 0x1011c16a
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011c158
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
jmp 0x1011c151
xor eax, eax
test esi, esi
setne cl
not al
and al, cl
movzx eax, al
neg eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011c12d
call fcn.100745e0
jmp 0x1011c118

Function at 0x1011c1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
test esi, esi
je 0x1011c214
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1011c214
mov dword [esp], 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
test eax, eax
je 0x1011c245
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 1
jmp 0x1011c247
cmp dword [0x101de200], 0
je 0x1011c262
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1011c24e
mov dword [ecx + 0x28], 0xffffe89d
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
jmp 0x1011c247
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov ecx, eax
jmp 0x1011c234
call fcn.100745e0
jmp 0x1011c21d
Function at 0x1011c2b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x1011c311
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1011c311
cmp dword [ebp + 0x10], 0
je 0x1011c311
mov dword [esp], 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
xor esi, esi
test eax, eax
je 0x1011c33e
mov edi, eax
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], 1
mov dword [esp], 0x10
call sym.nss3.dll_PORT_ZAlloc_Util
test eax, eax
je 0x1011c348
mov dword [eax], eax
mov dword [eax + 4], eax
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov esi, eax
jmp 0x1011c33e
cmp dword [0x101de200], 0
je 0x1011c380
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011c36e
mov dword [eax + 0x28], 0xffffe89d
xor esi, esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lock dec dword [edi + 8]
jne 0x1011c33e
mov eax, dword [edi]
mov dword [esp], eax
call sym.nss3.dll_SECKEY_DestroyPrivateKey
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym.nss3.dll_SECKEY_DestroyPublicKey
mov dword [esp], edi
call dword [sym.imp.mozglue.dll_free]
jmp 0x1011c33e
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011c32f
call fcn.100745e0
jmp 0x1011c31a
Function at 0x1011f060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 4
jne 0x1011f116
mov ecx, dword [eax + 0x14]
cmp ecx, dword [0x101dfbd0]
jne 0x1011f116
mov ecx, dword [ebp + 0x18]
mov edi, dword [eax + 4]
mov dword [edi], eax
mov ebx, dword [edi + 0x160]
test ebx, ebx
je 0x1011f0c8
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x1011f162
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], esi
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [edi + 0x154], ecx
test byte [edi + 0x1d], 1
jne 0x1011f0e0
mov dword [edi + 0x150], ecx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call ecx
mov esi, eax
mov eax, dword [edi + 0x160]
test eax, eax
je 0x1011f146
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
jmp 0x1011f146
cmp dword [0x101de200], 0
je 0x1011f179
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011f150
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011f134
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov esi, eax
jmp 0x1011f0b3
call fcn.100745e0
jmp 0x1011f11f
Function at 0x1011fbc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0xc4]
push ebx
push eax
call fcn.10128020
add esp, 8
xor edi, edi
dec edi
test eax, eax
jne 0x1011fcf2
mov dword [ebp - 0x10], esi
xor edi, edi
test ebx, ebx
jne 0x1011fcf2
xor edi, edi
mov ebx, 0xcb
mov esi, dword [ebp + 8]
mov eax, dword [esi + ebx*4]
test eax, eax
je 0x1011fc21
push eax
push esi
call fcn.1011fad0
add esp, 8
test eax, eax
jne 0x1011fcef
inc edi
cmp edi, dword [esi + 0x3a8]
ja 0x1011fc2a
inc ebx
cmp ebx, 0xea
jne 0x1011fbff
lea eax, [esi + 0xd4]
cmp dword [esi + 0xd4], eax
je 0x1011fc74
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 4], 0
je 0x1011fd86
movzx eax, word [ecx + 0x4a]
cmp eax, 0x304
jb 0x1011fd86
add ecx, 0x118
push ecx
push esi
call fcn.10114370
add esp, 8
test eax, eax
je 0x1011fc85
mov dword [esi + 0x6f8], 1
jmp 0x1011fc92
push 0
push 0xffffd017
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x1011fcef
cmp dword [esi + 0x6f8], 0
je 0x1011fd86
mov edx, dword [esi + 0xc4]
mov ecx, esi
call fcn.1011fe50
test eax, eax
je 0x1011fcfc
xor edi, edi
mov ebx, 0xffffe001
push edi
push ebx
call sym.nss3.dll_PR_SetError
add esp, 8
push 0x50
push 2
push esi
call fcn.100fa900
add esp, 0xc
push edi
push ebx
call sym.nss3.dll_PR_SetError
add esp, 8
lock inc dword [0x101df628]
push esi
call fcn.101141d0
add esp, 4
push dword [esi + 0xc4]
call fcn.10113020
add esp, 4
mov dword [esi + 0xc4], edi
xor edi, edi
dec edi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xc4]
movzx eax, word [eax + 0x9a]
mov word [esi + 0x490], ax
push 0
push esi
call fcn.100ffbe0
add esp, 8
test eax, eax
je 0x1011fd86
cmp dword [0x101de200], 0
je 0x1011fe38
push dword [0x101de1f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1011fe02
push 0
push dword [eax + 0x28]
call sym.nss3.dll_PR_SetError
add esp, 8
cmp dword [0x101de200], 0
je 0x1011fe42
push dword [0x101de1f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1011fe1d
mov edi, dword [eax + 0x28]
push 0x50
push 2
push esi
call fcn.100fa900
add esp, 0xc
push 0
push edi
jmp 0x1011fc7b
lea ecx, [esi + 0x650]
mov eax, dword [esi + 0x650]
xor edi, edi
cmp eax, ecx
je 0x1011fcf2
cmp dword [esi + 0x6f8], 0
jne 0x1011fdbb
cmp dword [eax + 0x10], 2
jne 0x1011fdbb
movzx eax, word [eax + 0x24]
test ax, ax
je 0x1011fdbb
mov word [esi + 0x490], ax
mov ecx, esi
call fcn.10120030
test eax, eax
mov eax, 0xffffffff
je 0x1011fcf2
xor edi, edi
mov ebx, 0xffffe001
push edi
push ebx
mov esi, eax
call sym.nss3.dll_PR_SetError
add esp, 8
push 0x50
push 2
push dword [ebp + 8]
call fcn.100fa900
add esp, 0xc
push edi
push ebx
call sym.nss3.dll_PR_SetError
add esp, 8
mov edi, esi
jmp 0x1011fcf2
sub esp, 0x10
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
add esp, 0x10
jmp 0x1011fd40
sub esp, 0x10
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
add esp, 0x10
jmp 0x1011fd6e
call fcn.100745e0
jmp 0x1011fd2c
call fcn.100745e0
jmp 0x1011fd5a
Function at 0x101200e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, edx
mov dword [ebp - 0x44], ecx
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x3c]
mov dword [esi + 0x1c], 0x3f16bb09
push 8
push 0x800
push str.security
push esi
call sym.nss3.dll_PL_InitArenaPool
add esp, 0x10
push 0xac
push esi
call sym.nss3.dll_PORT_ArenaAlloc_Util
add esp, 8
test eax, eax
je 0x10120223
mov edi, eax
add eax, 4
xor esi, esi
push 0xa8
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
mov dword [edi], eax
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 8]
cmp ecx, 2
je 0x10120183
cmp ecx, 4
lea esi, [ebp - 0x3c]
jne 0x10120223
push eax
push dword [ebx + 0x14]
push dword [ebx + 0x10]
push edi
call fcn.1010aca0
xor ecx, ecx
add esp, 0x10
mov ebx, eax
mov eax, 0x1050
jmp 0x1012021f
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
lea edx, [ebp - 0x1c]
mov dword [edx], 0
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov dword [ebp - 0x40], esi
lea ebx, [esi + 0x14]
push edx
push ebx
call fcn.1011a520
add esp, 8
test eax, eax
lea esi, [ebp - 0x3c]
je 0x10120205
mov dword [edi + 4], 4
lea eax, [edi + 0x14]
push ebx
push eax
push dword [edi]
call sym.nss3.dll_SECITEM_CopyItem_Util
add esp, 0xc
xor ebx, ebx
dec ebx
test eax, eax
jne 0x10120217
mov ecx, dword [ebp - 0x40]
add ecx, 0x20
lea eax, [edi + 0x20]
push ecx
push eax
push dword [edi]
call sym.nss3.dll_SECITEM_CopyItem_Util
add esp, 0xc
test eax, eax
jne 0x10120217
mov eax, edi
add eax, 0x2c
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [edi]
call sym.nss3.dll_SECITEM_CopyItem_Util
add esp, 0xc
neg eax
sbb ebx, ebx
jmp 0x10120217
push 0
push 0xffffd08d
call sym.nss3.dll_PR_SetError
add esp, 8
xor ebx, ebx
dec ebx
mov ecx, dword [edi + 0x34]
mov eax, 0x21
test ebx, ebx
je 0x1012027d
push esi
call sym.nss3.dll_PORT_DestroyCheapArena
add esp, 4
cmp dword [0x101de200], 0
je 0x101202e1
push dword [0x101de1f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101202c6
mov esi, dword [eax + 0x28]
push 0x2f
push 2
push dword [ebp - 0x44]
call fcn.100fa900
add esp, 0xc
push 0
push esi
call sym.nss3.dll_PR_SetError
add esp, 8
xor ebx, ebx
dec ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014dc80
mov eax, ebx
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
push ebx
push ebx
push 1
push ecx
push 0x10c
push 0x402a
push eax
push ebx
push ebx
push ebx
push edi
mov eax, dword [ebp + 8]
push dword [eax]
call sym.nss3.dll_PK11_PubDeriveWithKDF
add esp, 0x30
test eax, eax
je 0x101202b4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call sym.nss3.dll_PORT_DestroyCheapArena
add esp, 4
jmp 0x10120269
push 0xffffd090
call fcn.10111ec0
add esp, 4
jmp 0x10120223
sub esp, 0x10
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
add esp, 0x10
jmp 0x10120249
call fcn.100745e0
jmp 0x10120239
Function at 0x10125010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x10125058
mov edi, dword [ebp + 0x48]
mov eax, dword [ebp + 0x1c]
test eax, eax
lea ebx, [ebp - 0x28]
cmovne ebx, eax
mov edx, dword [ebp + 0x18]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c], ebx
je 0x10125064
cmp ebx, edx
je 0x101250a0
push dword [ebp + 0x20]
push edx
push dword [ebp - 0x6c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x101250a0
push 0
push 0xffffe005
jmp 0x10125107
mov esi, dword [ebp + 0x28]
push dword [ebp + 0x20]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test esi, esi
je 0x101250a0
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
sub ecx, esi
add ecx, dword [ebp - 0x6c]
xor edx, edx
mov bl, byte [eax + edx]
xor byte [ecx + edx], bl
inc edx
cmp esi, edx
jne 0x10125095
mov edx, edi
mov eax, edi
mov ecx, dword [ebp + 0x40]
sub eax, ecx
mov edi, dword [ebp + 0x44]
lea ecx, [edi + eax]
mov esi, dword [ebp + 0xc]
test esi, esi
lea ebx, [ebp - 0x68]
cmovne ebx, ecx
cmove eax, edx
push eax
push edi
push dword [ebp + 0x40]
push ebx
mov eax, dword [ebp + 0x3c]
push eax
mov edi, dword [ebp + 0x38]
push edi
mov eax, dword [ebp + 0x34]
push eax
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x6c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.nss3.dll_PK11_AEADOp
add esp, 0x38
mov esi, eax
or eax, dword [ebp + 0xc]
jne 0x1012512a
mov eax, dword [edi]
mov edx, dword [ebp + 0x40]
lea ecx, [eax + edx]
cmp ecx, dword [ebp + 0x3c]
jbe 0x10125114
push 0
push 0xffffe003
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1012512a
mov ecx, edx
mov edx, dword [ebp + 0x34]
add edx, eax
push ecx
push ebx
push edx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1012e650
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
cmp dword [0x101de200], 0
je 0x1012e6a2
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1012e690
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1012e67c
call fcn.100745f0
jmp 0x1012e661
Function at 0x1012f3f0
Capabilities:
Get thread local storage value
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 0xc]
cmp ecx, 0x1018e3b0
jne 0x1012f4d1
push dword [0x101de1f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1012f4f5
mov ecx, dword [eax + 0xe0]
mov edx, ecx
and edx, 0x1002
cmp edx, 2
je 0x1012f510
cmp dword [eax + 0xf4], 0
jne 0x1012f522
mov edx, esi
xor esi, esi
test edx, edx
jle 0x1012f4b8
mov dword [ebp - 0x18], ebx
mov eax, dword [0x101de25c]
cmp dword [eax + 4], 4
mov dword [ebp - 0x10], edi
jge 0x1012f574
mov eax, dword [ebx + 4]
mov ecx, dword [eax + 0x18]
xor ebx, ebx
mov dword [ebp - 0x1c], esi
push 0
push edx
push edi
mov esi, ecx
push ecx
mov edi, edx
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x1012f536
add ebx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
cmp edi, ebx
mov edx, edi
jle 0x1012f4a3
test eax, eax
je 0x1012f5cf
test ebx, ebx
js 0x1012f5c7
mov esi, dword [ebp - 0x1c]
add esi, ebx
test eax, eax
je 0x1012f596
mov eax, dword [0x101de25c]
cmp dword [eax + 4], 4
jge 0x1012f5ab
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ecx, fcn.10002860
jne 0x1012f4e6
push esi
push edi
push ebx
call fcn.10002860
add esp, 0x1c
jmp 0x1012f4cc
call dword [section..00cfg]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
jmp ecx
sub esp, 0x10
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
add esp, 0x10
jmp 0x1012f427
and ecx, 0xfffffffd
mov dword [eax + 0xe0], ecx
push 0
push 0xffffe897
jmp 0x1012f529
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1012f4c7
mov dword [ebp - 0x14], edi
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1012f5be
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x1012f5be
mov ecx, esi
mov edx, 2
push 0xffffffffffffffff
call fcn.10077cb0
mov ecx, esi
add esp, 4
test eax, eax
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
jns 0x1012f473
jmp 0x1012f5c7
mov eax, dword [ebx + 4]
push edx
push edi
push dword [eax + 0x18]
push ebx
push str.send:_fd_p_osfd_ld_buf_p_amount_d
mov edi, edx
call sym.nss3.dll_PR_LogPrint
mov edx, edi
mov edi, dword [ebp - 0x10]
add esp, 0x14
jmp 0x1012f468
mov edi, dword [ebp - 0x10]
add edi, ebx
sub edx, ebx
mov ebx, dword [ebp - 0x18]
jg 0x1012f456
jmp 0x1012f4b8
push esi
push str.send_____d
call sym.nss3.dll_PR_LogPrint
add esp, 8
jmp 0x1012f4c7
push eax
call fcn.1018a020
add esp, 4
xor esi, esi
dec esi
jmp 0x1012f4b8
mov ecx, esi
mov dword [ebp - 0x14], edx
mov edx, 2
push 0xffffffffffffffff
call fcn.10077cb0
mov ecx, esi
mov edx, dword [ebp - 0x14]
add esp, 4
test eax, eax
jmp 0x1012f569
Function at 0x1012f840
Capabilities:
Get thread local storage value
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
cmp ecx, 0x1007e160
jne 0x1012f902
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [0x101de1f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1012f911
mov ecx, dword [eax + 0xe0]
mov edx, ecx
and edx, 0x1002
cmp edx, 2
je 0x1012f92c
cmp dword [eax + 0xf4], 0
jne 0x1012f93e
mov eax, dword [0x101de25c]
cmp dword [eax + 4], 4
jge 0x1012f952
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x18]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edi
call sub.wsock32.dll_recv
mov esi, eax
cmp eax, 0xffffffff
jne 0x1012f8ed
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1012f8e4
mov ecx, dword [ebx + 4]
cmp dword [ecx + 4], 0
je 0x1012f994
push eax
call fcn.10001070
add esp, 4
mov eax, dword [0x101de25c]
cmp dword [eax + 4], 4
jge 0x1012f973
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [section..00cfg]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp ecx
sub esp, 0x10
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
add esp, 0x10
jmp 0x1012f87d
and ecx, 0xfffffffd
mov dword [eax + 0xe0], ecx
push 0
push 0xffffe897
jmp 0x1012f945
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1012f8f8
mov eax, dword [ebx + 4]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [eax + 0x18]
push ebx
push str.recv:_fd_p_osfd_ld_buf_p_amount_d_flags_d
call sym.nss3.dll_PR_LogPrint
add esp, 0x18
jmp 0x1012f8b0
call sym.nss3.dll_PR_GetOSError
mov edi, eax
call sym.nss3.dll_PR_GetError
push edi
push eax
push esi
push str.recv_____d__error___d__os_error___d
call sym.nss3.dll_PR_LogPrint
add esp, 0x10
jmp 0x1012f8f8
xor edx, edx
inc edx
mov ecx, edi
push 0xffffffffffffffff
call fcn.10077cb0
add esp, 4
test eax, eax
jns 0x1012f8b6
jmp 0x1012f8ed
Function at 0x101445d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
movzx esi, byte [edx + 1]
cmp esi, 9
ja case.0x101445f3.0
movzx ebx, byte [edx]
and ebx, 0x3f
xor ecx, ecx
xor edi, edi
jmp dword [esi*4 + 0x101a3568]
xor edi, edi
inc edi
mov edx, eax
mov esi, dword [eax + 4]
mov ebx, dword [esi]
mov esi, dword [esi + 4]
cmp edi, ebx
mov eax, ecx
sbb eax, esi
jl 0x10144634
cmp ebx, edi
sbb esi, ecx
jl 0x1014465b
mov eax, edx
cmp word [edx + 8], 2
jb 0x1014466e
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push 1
push eax
call fcn.101446c0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movsx eax, byte [edx + 0xc]
jmp 0x1014462f
movsx edi, byte [edx + ebx]
mov ecx, edi
sar ecx, 0x1f
jmp case.0x101445f3.8
mov edi, dword [edx + ebx + 2]
bswap edi
movsx esi, byte [edx + ebx]
shl esi, 8
movzx ecx, byte [edx + ebx + 1]
or ecx, esi
jmp case.0x101445f3.8
movsx eax, byte [edx + 0xd]
jmp 0x1014462f
mov ecx, dword [edx + ebx]
mov edi, dword [edx + ebx + 4]
bswap ecx
bswap edi
jmp case.0x101445f3.8
mov ecx, eax
movsx eax, byte [eax + 0xa]
mov byte [ecx + 0xe], 1
jmp 0x1014462f
mov ecx, dword [ebp + 8]
push 0
jmp 0x10144626
movsx ecx, byte [edx + ebx]
mov esi, ecx
shl esi, 8
movzx edi, byte [edx + ebx + 1]
or edi, esi
jmp 0x10144640
mov edi, dword [edx + ebx]
bswap edi
jmp 0x1014463e
movsx ecx, byte [edx + ebx]
mov edi, ecx
shl edi, 0x10
movzx esi, byte [edx + ebx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [edx + ebx + 2]
jmp 0x1014468f