joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10116420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f1014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10116520
movzx ebx, word [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test bx, bx
je 0x101164ad
mov esi, dword [edi + 0xa24]
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.10115850
cmp eax, 0xffffffff
je 0x10116598
cmp word [ebp - 0x14], bx
ja 0x10116598
cmp word [ebp - 0x12], bx
jb 0x10116598
test esi, esi
je 0x10116588
cmp esi, 1
jne 0x10116598
lea eax, [ebx - 0x302]
cmp ax, 3
jae 0x10116598
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x101164c7
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x101164db
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
test bx, bx
je 0x1011654f
cmp word [edi + 0x26], bx
jbe 0x1011654f
cmp dword [0x101f4f80], 0
je 0x10116630
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10116607
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x10116558
cmp dword [0x101f4f80], 0
je 0x1011661c
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101165e0
mov dword [eax + 0x28], 0xffffe891
jmp 0x101165c1
mov word [edi + 0x714], bx
xor esi, esi
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10116572
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x101165cc
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
jmp 0x101165cc
lea eax, [ebx - 0x300]
cmp ax, 5
jb 0x101164ad
cmp dword [0x101f4f80], 0
je 0x10116626
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101165f5
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10116546
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101165ba
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1011650c
call fcn.1001b2e0
jmp 0x1011652d
call fcn.1001b2e0
jmp 0x101165a5
call fcn.1001b2e0
jmp 0x101164f3
Function at 0x10116640
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10116673
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x1011669c
add eax, 0x1c
jmp 0x101166cb
cmp dword [0x101f4f80], 0
je 0x101166f8
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x101166d0
mov dword [ecx + 0x28], 0xffffe891
jmp 0x101166c3
cmp dword [0x101f4f80], 0
je 0x10116702
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x101166e4
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov ecx, eax
jmp 0x10116693
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov ecx, eax
jmp 0x101166bc
call fcn.1001b2e0
jmp 0x1011667c
call fcn.1001b2e0
jmp 0x101166a5

Function at 0x10116710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov edi, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [esp + 0x88], eax
mov eax, dword [edi]
mov esi, dword [eax + 8]
xorps xmm0, xmm0
lea ebx, [esp + 0x10]
movaps xmmword [ebx + 0x60], xmm0
movaps xmmword [ebx + 0x50], xmm0
movaps xmmword [ebx + 0x40], xmm0
movaps xmmword [ebx + 0x30], xmm0
movaps xmmword [ebx + 0x20], xmm0
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x64]
call dword [section..00cfg]
mov dword [esp + 4], ebx
mov dword [esp], esi
call ecx
xor esi, esi
dec esi
test eax, eax
js 0x10116805
mov dword [edi + 0x4c], 1
movzx eax, word [esp + 0x10]
cmp eax, 0x17
je 0x101167bc
cmp eax, 2
jne 0x101167d8
mov eax, dword [esp + 0x14]
xor esi, esi
mov dword [edi + 0xb4], esi
mov dword [edi + 0xb0], esi
mov dword [edi + 0xb8], 0xffff0000
mov dword [edi + 0xbc], eax
movzx eax, word [esp + 0x12]
mov word [edi + 0xc0], ax
jmp 0x10116805
movups xmm0, xmmword [esp + 0x18]
movups xmmword [edi + 0xb0], xmm0
movzx eax, word [esp + 0x12]
mov word [edi + 0xc0], ax
xor esi, esi
jmp 0x10116805
cmp dword [0x101f4f80], 0
je 0x1011682f
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011681d
mov dword [eax + 0x28], 0xffffe89f
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101167f6
call fcn.1001b2e0
jmp 0x101167e1
Function at 0x10116840
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011689f
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
mov eax, dword [edi + 0xd0]
test eax, eax
je 0x10116886
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
mov dword [edi + 0xd0], 0
test esi, esi
je 0x101168d1
mov dword [esp], esi
call sym.nss3.dll_PORT_Strdup_Util
mov dword [edi + 0xd0], eax
test eax, eax
sete al
jmp 0x101168d3
cmp dword [0x101f4f80], 0
je 0x101168f8
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101168e6
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
jmp 0x101168df
mov al, 1
test esi, esi
setne cl
and cl, al
movzx eax, cl
neg eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101168bd
call fcn.1001b2e0
jmp 0x101168a8

Function at 0x10116960
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
test esi, esi
je 0x10116994
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10116994
mov dword [esp], 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
test eax, eax
je 0x101169c5
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 1
jmp 0x101169c7
cmp dword [0x101f4f80], 0
je 0x101169e2
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x101169ce
mov dword [ecx + 0x28], 0xffffe89d
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
jmp 0x101169c7
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov ecx, eax
jmp 0x101169b4
call fcn.1001b2e0
jmp 0x1011699d
Function at 0x10116a30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10116a91
cmp dword [ebp + 0xc], 0
je 0x10116a91
cmp dword [ebp + 0x10], 0
je 0x10116a91
mov dword [esp], 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
xor esi, esi
test eax, eax
je 0x10116abe
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov dword [edi + 8], 1
mov dword [esp], 0x10
call sym.nss3.dll_PORT_ZAlloc_Util
test eax, eax
je 0x10116ac8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], ebx
mov dword [eax + 0xc], edi
mov esi, eax
jmp 0x10116abe
cmp dword [0x101f4f80], 0
je 0x10116b04
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10116af2
mov dword [eax + 0x28], 0xffffe89d
xor esi, esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, edi
add eax, 8
lock dec dword [eax]
jne 0x10116abe
mov eax, dword [edi]
mov dword [esp], eax
call sym.nss3.dll_SECKEY_DestroyPrivateKey
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym.nss3.dll_SECKEY_DestroyPublicKey
mov dword [esp], edi
call dword [sym.imp.mozglue.dll_free]
jmp 0x10116abe
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10116aaf
call fcn.1001b2e0
jmp 0x10116a9a
Function at 0x10119980
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [ecx], 4
jne 0x10119a36
mov ecx, dword [eax + 0x14]
cmp ecx, dword [0x101f5fc8]
jne 0x10119a36
mov ecx, dword [ebp + 0x18]
mov edi, dword [eax + 4]
mov dword [edi], eax
mov ebx, dword [edi + 0x160]
test ebx, ebx
je 0x101199e8
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x10119a82
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], esi
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [edi + 0x154], ecx
test byte [edi + 0x1d], 1
jne 0x10119a00
mov dword [edi + 0x150], ecx
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x1c]
call dword [section..00cfg]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call ecx
mov esi, eax
mov eax, dword [edi + 0x160]
test eax, eax
je 0x10119a66
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
jmp 0x10119a66
cmp dword [0x101f4f80], 0
je 0x10119a99
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10119a70
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10119a54
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x101199d3
call fcn.1001b2e0
jmp 0x10119a3f
Function at 0x1011f9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
je 0x1011fa08
mov edi, dword [ebp + 0x48]
mov eax, dword [ebp + 0x1c]
test eax, eax
lea ebx, [ebp - 0x28]
cmovne ebx, eax
mov edx, dword [ebp + 0x18]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c], ebx
je 0x1011fa14
cmp ebx, edx
je 0x1011fa50
push dword [ebp + 0x20]
push edx
push dword [ebp - 0x6c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1011fa50
push 0
push 0xffffe005
jmp 0x1011fab7
mov esi, dword [ebp + 0x28]
push dword [ebp + 0x20]
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test esi, esi
je 0x1011fa50
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
sub ecx, esi
add ecx, dword [ebp - 0x6c]
xor edx, edx
mov bl, byte [eax + edx]
xor byte [ecx + edx], bl
inc edx
cmp esi, edx
jne 0x1011fa45
mov edx, edi
mov eax, edi
mov ecx, dword [ebp + 0x40]
sub eax, ecx
mov edi, dword [ebp + 0x44]
lea ecx, [edi + eax]
mov esi, dword [ebp + 0xc]
test esi, esi
lea ebx, [ebp - 0x68]
cmovne ebx, ecx
cmove eax, edx
push eax
push edi
push dword [ebp + 0x40]
push ebx
mov eax, dword [ebp + 0x3c]
push eax
mov edi, dword [ebp + 0x38]
push edi
mov eax, dword [ebp + 0x34]
push eax
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp - 0x6c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.nss3.dll_PK11_AEADOp
add esp, 0x38
mov esi, eax
or eax, dword [ebp + 0xc]
jne 0x1011fada
mov eax, dword [edi]
mov edx, dword [ebp + 0x40]
lea ecx, [eax + edx]
cmp ecx, dword [ebp + 0x3c]
jbe 0x1011fac4
push 0
push 0xffffe003
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1011fada
mov ecx, edx
mov edx, dword [ebp + 0x34]
add edx, eax
push ecx
push ebx
push edx
mov ebx, ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1012a360
Capabilities:
Get thread local storage value
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1012a419
mov ecx, dword [eax + 0xe0]
mov edx, ecx
and edx, 0x1002
cmp edx, 2
je 0x1012a434
cmp dword [eax + 0xf4], 0
jne 0x1012a446
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x1012a45a
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [0x101f4f6c]
cmp dword [eax + 4], 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
jge 0x1012a45e
mov eax, dword [edi + 4]
mov edi, dword [eax + 0x18]
xor ebx, ebx
push 0
push ecx
push edx
push edi
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x1012a47f
add ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0
je 0x1012a4a8
add esi, ebx
xor eax, eax
dec eax
test ebx, ebx
cmovs esi, eax
mov eax, dword [0x101f4f6c]
cmp dword [eax + 4], 4
jge 0x1012a4cf
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x1012a37d
and ecx, 0xfffffffd
mov dword [eax + 0xe0], ecx
push 0
push 0xffffe897
jmp 0x1012a44d
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x1012a40f
xor esi, esi
jmp 0x1012a400
mov eax, dword [edi + 4]
push ecx
push edx
push dword [eax + 0x18]
push edi
push str.send:_fd_p_osfd_ld_buf_p_amount_d
call sym.nss3.dll_PR_LogPrint
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add esp, 0x14
jmp 0x1012a3c9
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1012a497
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
je 0x1012a4ad
push eax
call fcn.101a77e0
add esp, 4
xor esi, esi
dec esi
jmp 0x1012a400
cmp dword [ebp - 0x10], ebx
jle 0x1012a4e2
mov ecx, edi
mov edx, 2
push dword [ebp + 0x18]
call fcn.101a0dc0
add esp, 4
test eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jns 0x1012a3d1
jmp 0x1012a4a0
push esi
push str.send_____d
call sym.nss3.dll_PR_LogPrint
add esp, 8
jmp 0x1012a40f
test ebx, ebx
js 0x1012a4a0
add esi, ebx
mov edx, dword [ebp - 0x14]
add edx, ebx
mov ecx, dword [ebp - 0x10]
sub ecx, ebx
mov edi, dword [ebp + 8]
jg 0x1012a3b4
jmp 0x1012a400
Function at 0x10155620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101f4f80], 0
je 0x1015565b
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10155649
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10155644
call fcn.1001b2f0
jmp 0x1015562f

Function at 0x10155ed0
Capabilities:
Get thread local storage value
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
cmp ecx, 0x10075330
jne 0x10155f92
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10155fa1
mov ecx, dword [eax + 0xe0]
mov edx, ecx
and edx, 0x1002
cmp edx, 2
je 0x10155fbc
cmp dword [eax + 0xf4], 0
jne 0x10155fce
mov eax, dword [0x101f4f6c]
cmp dword [eax + 4], 4
jge 0x10155fe2
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x18]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edi
call sub.wsock32.dll_recv
mov esi, eax
cmp eax, 0xffffffff
jne 0x10155f7d
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x10155f74
mov ecx, dword [ebx + 4]
cmp dword [ecx + 4], 0
je 0x10156024
push eax
call fcn.10129ef0
add esp, 4
mov eax, dword [0x101f4f6c]
cmp dword [eax + 4], 4
jge 0x10156003
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [section..00cfg]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp ecx
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x10155f0d
and ecx, 0xfffffffd
mov dword [eax + 0xe0], ecx
push 0
push 0xffffe897
jmp 0x10155fd5
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x10155f88
mov eax, dword [ebx + 4]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [eax + 0x18]
push ebx
push str.recv:_fd_p_osfd_ld_buf_p_amount_d_flags_d
call sym.nss3.dll_PR_LogPrint
add esp, 0x18
jmp 0x10155f40
call sym.nss3.dll_PR_GetOSError
mov edi, eax
call sym.nss3.dll_PR_GetError
push edi
push eax
push esi
push str.recv_____d__error___d__os_error___d
call sym.nss3.dll_PR_LogPrint
add esp, 0x10
jmp 0x10155f88
xor edx, edx
inc edx
mov ecx, edi
push 0xffffffffffffffff
call fcn.101a0dc0
add esp, 4
test eax, eax
jns 0x10155f46
jmp 0x10155f7d

Function at 0x10156040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10156060
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1015605b
Function at 0x10156080
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
cmp dword [0x101f4f80], 0
je 0x101560d2
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101560c0
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101560ac
call fcn.1001b2f0
jmp 0x10156091

Function at 0x101560e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101f4f80], 0
je 0x1015611e
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1015610c
mov eax, dword [eax + 0x28]
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10156104
call fcn.1001b2f0
jmp 0x101560ef

Function at 0x10156130
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x1015616b
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x10156152

Function at 0x10156180
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
cmp dword [0x101f4f80], 0
je 0x101561d3
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101561c1
mov edx, dword [eax + 0x24]
xor ecx, ecx
test edx, edx
je 0x101561b9
mov esi, dword [ebp + 8]
cmp dword [eax + 0x20], esi
jbe 0x101561b9
mov ecx, dword [edx + esi*4]
mov eax, ecx
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101561a5
call fcn.1001b2f0
jmp 0x10156190
Function at 0x10156490
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x101564dc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x10], eax
xor edi, edi
push 0
mov ebx, ecx
push ecx
mov esi, edx
push edx
push dword [ebp - 0x10]
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x101564e0
add edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0
je 0x10156515
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x101564d4
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1015653f
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x1015653f
mov ecx, dword [ebp - 0x10]
mov edx, 2
push dword [ebp + 0x18]
call fcn.101a0dc0
add esp, 4
test eax, eax
mov ecx, ebx
mov edx, esi
jns 0x101564af
jmp 0x10156548
cmp edi, ebx
jge 0x101564d2
mov ecx, dword [ebp - 0x10]
mov edx, 2
push dword [ebp + 0x18]
call fcn.101a0dc0
add esp, 4
mov ecx, eax
xor eax, eax
dec eax
test ecx, ecx
mov ecx, ebx
mov edx, esi
jns 0x101564af
jmp 0x101564d4
push eax
call fcn.101a77e0
add esp, 4
xor eax, eax
dec eax
jmp 0x101564d4

Function at 0x10157813
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10157822
pop dword [ebp - 0x3c]
mov eax, 0x1d7d3f26
add eax, 0xf29838fc
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xdd3087e
add dword [ebp - 0x4c], 0x407f3ccd
mov dword [ebp - 0x48], 0xe336aef4
add dword [ebp - 0x48], 0x4efc9d51
mov dword [ebp - 0x44], 0xb05cfed4
sub dword [ebp - 0x44], 0x6410baa6
mov dword [ebp - 0x40], 0x92e31d8b
sub dword [ebp - 0x40], 0x92e31d8b
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x42fbc916
add eax, 0xcd23271a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x30d821cf
sub dword [ebp - 0x4c], 0xbc65b879
mov dword [ebp - 0x48], 0xfdca5197
sub dword [ebp - 0x48], 0xbc5df022
mov dword [ebp - 0x44], 0xf4b28cff
sub dword [ebp - 0x44], 0x91432093
mov dword [ebp - 0x40], 0xc399d3ef
sub dword [ebp - 0x40], 0xc399d3ef
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x1deb72db
add eax, 0xf2337d5d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x380a0
push 0
call eax
mov ecx, 0x7a648a5e
add ecx, 0x859bc3a2
mov esi, eax
mov edx, 0x39660eef
sub edx, 0x294568ef
add edx, dword [ebp - 0x3c]
mov edi, 0x67272691
mov ebx, dword [edx]
add dword [ebp - 0x34], 0x8a88b921
xor ebx, edi
xor dword [ebp - 0x2c], 0x1b64bf0e
mov dword [esi], ebx
add esi, 4
add edx, 0xe59323a3
sub edx, 0xe593239f
loop 0x1015793e
add eax, 0xdd898f97
add eax, 0x22779b3c
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x10159c80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10159c90