joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c570
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
mov edx, ecx
cmp edx, 0xffffffff
jne 0x1004c5a6
mov dword [ebp - 0xc], 0x2719
mov eax, dword [ebp + 0x18]
mov byte [ebp - 8], 1
movq xmm0, qword [ebp - 0xc]
pop esi
movq qword [eax], xmm0
mov dword [eax + 8], 0x1026c678
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, 0xa5100000
jne 0x1004c649
cmp eax, 2
jne 0x1004c5c6
mov dword [ebp - 0xc], 0x2726
jmp 0x1004c587
cmp eax, 1
jne 0x1004c65b
cmp dword [ebp + 0x14], 4
jne 0x1004c5bd
mov cl, byte [esi]
mov al, cl
or cl, 4
and al, 0xfb
movzx edx, cl
movzx ecx, al
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x18]
cmp dword [eax], 0
cmove edx, ecx
mov byte [esi], dl
mov esi, dword [edi + 8]
mov dword [edi], 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
cmp ecx, 0x25c5e09b
jne 0x1004c611
cmp eax, 0x8fafd21e
je 0x1004c620
cmp ecx, 0x257edf0d
jne 0x1004c630
cmp eax, 0xb2ab117a
jne 0x1004c630
xor al, al
mov dword [edi + 8], esi
mov byte [edi + 4], al
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
push 0
mov eax, dword [eax + 0x18]
call eax
mov byte [edi + 4], al
xor eax, eax
mov dword [edi + 8], esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, 0xffff
jne 0x1004c65b
cmp eax, 0x80
jne 0x1004c65b
or byte [esi], 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp + 0x18]
mov esi, eax
test esi, esi
setne dl
call fcn.1004bf30
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004dcc0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101db3bd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
cmp dword [edi], 0xffffffff
mov dword [ebp - 0x14], edi
je 0x1004dde1
xor edx, edx
add ecx, 8
xor eax, eax
lock cmpxchg dword [ecx], edx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1004dd62
mov esi, dword [edi]
lea edi, [eax + 0x18]
push edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x2c], 1
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x3e3
mov byte [ebp - 0x20], 1
movq xmm0, qword [ebp - 0x24]
push eax
push esi
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0x1026c678
call fcn.1004d960
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [ebp - 0x14]
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
je 0x1004ddfc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, ebx
test esi, esi
setne dl
call fcn.1004bf30
test esi, esi
je 0x1004ddfc
mov eax, dword [ebx]
cmp eax, 0x2733
je 0x1004dd99
cmp eax, 0x4d5
jne 0x1004ddfc
mov eax, dword [ebx + 8]
cmp dword [eax + 8], 0x25c5e09b
jne 0x1004ddfc
cmp dword [eax + 0xc], 0x8fafd21e
jne 0x1004ddfc
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 0x8004667e
push esi
mov dword [ebp - 0x14], 0
call dword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [edi + 4], 0xfc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov ecx, ebx
setne dl
call fcn.1004bf30
jmp 0x1004ddfc
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x20], 0
movq xmm0, qword [ebp - 0x24]
movq qword [ebx], xmm0
mov dword [ebx + 8], 0x1026c678
mov esi, dword [edi + 0xc]
mov dword [edi], 0xffffffff
mov byte [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
test esi, esi
je 0x1004de3c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1004de3c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x1004de3c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebp - 0x28]
movq xmm0, qword [ebx]
movq qword [eax], xmm0
mov ecx, dword [ebx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004e110
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x1004e1a4
mov edi, dword [edi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
push esi
push 2
push 0
mov dword [esi + 0x1c], 1
mov dword [esi], 0x1026c678
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1004e272
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x1004e18e
mov dword [eax + 0x14], esi
jmp 0x1004e191
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
jmp 0x1004e26c
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
jne 0x1004e1b7
mov edi, dword [edi + 4]
mov dword [esi + 8], 0x2719
jmp 0x1004e147
mov eax, dword [ebp + 0x14]
push 0
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1004e1ee
mov eax, 0x2746
jmp 0x1004e1fb
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x1004e217
cmp eax, 0x3e5
je 0x1004e217
mov edi, dword [edi + 4]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
jmp 0x1004e14e
mov edi, dword [edi + 4]
lea ecx, [esi + 0x1c]
mov ebx, 1
xor eax, eax
mov edx, ebx
lock cmpxchg dword [ecx], edx
cmp eax, ebx
jne 0x1004e272
push esi
push 2
push 0
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1004e272
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x1004e25d
mov dword [eax + 0x14], esi
jmp 0x1004e260
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
xchg dword [eax], ebx
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1004f1f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101db4d0
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ecx + 0xc], 0
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x18], eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
movups xmm0, xmmword [0x10295848]
movups xmmword [edx + 0x20], xmm0
movups xmm0, xmmword [0x10295838]
movups xmmword [edx + 0x30], xmm0
mov dword [edx + 0x40], 0
mov dword [edx + 0x50], 0
mov eax, edx
mov dword [edx + 0x54], 0xf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004fff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101db7a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
push 0x2004
mov dword [esi], 0x2000
call fcn.100f426e
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100500d0
mov dword [esi + 0xc], ecx
lea eax, [ecx + 4]
mov dword [esi + 4], 0x2000
mov dword [esi + 8], eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
movups xmm0, xmmword [0x10295848]
mov dword [ecx], 0
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [0x10295838]
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x90], 0
mov eax, esi
mov dword [esi + 0x94], 0xf
mov byte [esi + 0x98], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
call fcn.100479c0
push 0x1027ef90
lea eax, [ebp - 0x18]
push eax
call fcn.100e6522
int3

Function at 0x10052430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101db9a9
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
push 0x20
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100e430a
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x1005250f
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x44]
call fcn.10052330
push eax
mov byte [ebp - 4], 4
call fcn.1006a800
int3
Function at 0x100542d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dbd81
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::detail::shared_state_base.0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x100
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 3
push 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
call fcn.100e430a
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x48], eax
mov eax, esi
mov dword [esi + 0x50], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005f5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dd1fd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov eax, dword [esi]
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
lea eax, [esi + 0x10]
push eax
mov dword [edi + 0xc], edx
call fcn.10063bf0
mov dword [ebp - 4], 0
mov edx, esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov eax, dword [edx + 0x2c]
mov esi, dword [edx + 0x28]
mov dword [ebp - 0x18], eax
cmp esi, eax
je 0x1005f6b8
sub eax, esi
sar eax, 2
cmp eax, 0x3fffffff
ja 0x1005f714
shl eax, 2
xor ecx, ecx
mov dword [ebp - 0x10], eax
add eax, 0x10
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.100f426e
mov ecx, eax
add esp, 4
test ecx, ecx
jne 0x1005f687
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x1005f719
jmp 0x1005f693
and eax, 0xfffffff0
add eax, 0x10
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
add eax, ecx
mov dword [edi + 0x30], eax
mov ecx, dword [edi + 0x28]
mov eax, dword [esi]
add esi, 4
mov dword [ecx], eax
add ecx, 4
cmp esi, edx
jne 0x1005f6a4
mov edx, dword [ebp - 0x14]
mov dword [edi + 0x2c], ecx
mov eax, dword [edx + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [edx + 0x38]
mov dword [edi + 0x38], eax
mov al, byte [edx + 0x3c]
mov byte [edi + 0x3c], al
movups xmm0, xmmword [edx + 0x40]
movups xmmword [edi + 0x40], xmm0
movups xmm0, xmmword [edx + 0x50]
movups xmmword [edi + 0x50], xmm0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov eax, dword [edx + 0x64]
test eax, eax
je 0x1005f6f3
lock inc dword [eax + 4]
mov ecx, dword [edx + 0x60]
mov eax, edi
mov dword [edi + 0x60], ecx
mov ecx, dword [edx + 0x64]
mov dword [edi + 0x64], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.1005c830
call fcn.1005c830
int3
Function at 0x10065a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dd9e0
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x20], 0
xorps xmm0, xmm0
mov dword [ecx + 0x24], 0xf
mov eax, ecx
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov byte [ecx + 0x3c], 1
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
movups xmmword [ecx + 0x40], xmm0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0x3f800000
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10067f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ddd30
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100e430a
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100e33b9
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10081e40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dfbcd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
push dword [0x10295998]
mov esi, dword [ebx + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10081e96
cmp dword [eax], esi
je 0x10081f72
mov eax, dword [eax + 8]
test eax, eax
jne 0x10081e87
mov esi, dword [ebp + 8]
push esi
push 0x38
mov dword [ebp - 0x18], esi
call fcn.1004a2e0
mov edi, eax
add esp, 8
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x10089cf0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov eax, dword [esi]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x20], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x30], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov esi, dword [ebx + 8]
lock inc dword [esi + 0x18]
push edi
push 0
push 0
mov dword [edi + 0x1c], 1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x10081fbb
lea ebx, [esi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x14], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x10081fa4
mov dword [eax + 0x14], edi
jmp 0x10081fa7
cmp dword [eax + 4], 0
je 0x10081e96
mov eax, dword [ebp + 8]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.1008c960
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea eax, [esi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.10089b60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10081ff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dfbcd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
push dword [0x10295998]
mov esi, dword [ebx + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10082046
cmp dword [eax], esi
je 0x10082122
mov eax, dword [eax + 8]
test eax, eax
jne 0x10082037
mov esi, dword [ebp + 8]
push esi
push 0x38
mov dword [ebp - 0x18], esi
call fcn.1004a2e0
mov edi, eax
add esp, 8
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x10089be0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov eax, dword [esi]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x20], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x28], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov eax, dword [esi + 0xc]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x30], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov esi, dword [ebx + 8]
lock inc dword [esi + 0x18]
push edi
push 0
push 0
mov dword [edi + 0x1c], 1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1008216b
lea ebx, [esi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x14], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x10082154
mov dword [eax + 0x14], edi
jmp 0x10082157
cmp dword [eax + 4], 0
je 0x10082046
mov eax, dword [ebp + 8]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.1008c970
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea eax, [esi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.10089b60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100821a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dfbfd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10284f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
push dword [0x10295998]
mov esi, dword [ebx + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100821f6
cmp dword [eax], esi
je 0x100822c8
mov eax, dword [eax + 8]
test eax, eax
jne 0x100821e7
mov edi, dword [ebp + 8]
push edi
push 0x34
mov dword [ebp - 0x18], edi
call fcn.1004a2e0
mov esi, eax
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x10089960
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov eax, dword [edi]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x1008227f
lock inc dword [eax + 4]
mov eax, dword [edi + 8]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x2c], eax
mov edi, dword [ebx + 8]
lock inc dword [edi + 0x18]
push esi
push 0
push 0
mov dword [esi + 0x1c], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x10082311
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x100822fa
mov dword [eax + 0x14], esi
jmp 0x100822fd
cmp dword [eax + 4], 0
je 0x100821f6
mov eax, dword [ebp + 8]
push eax
push eax
mov dword [ebp - 4], 0
call fcn.1008c990
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.100898e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8