joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a9c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x452bb0]
cmp dword [eax + 0x30], 0
je 0x44aa72
cmp dword [ebx + 0x94], 0
jne 0x44aa6c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44a958
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44aa6c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44aa32
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44aa6c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413ce0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44aa41
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44b5d4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44b609
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404580
jmp 0x44b616
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044e4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44c680
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44c6c1
mov eax, esi
call fcn.00432fd0
test al, al
je 0x44c6c1
mov eax, dword [ebx + 0x84]
call fcn.00432d70
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44c6c1
push 0
mov eax, dword [ebx + 0x84]
call fcn.00432d70
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x44dd1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x44dd54]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44dd32
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44dd41
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x44dd50
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x44f064
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x450fc8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f08a
push 0
mov eax, dword [0x450fc8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0xcb41b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cb4140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cb4140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cb4140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cb4140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcb4bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcb4c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcc687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcb4c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcb4c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100011e6
mov eax, dword [esi + 0xe0]
mov ecx, eax
and ecx, 0x1002
cmp ecx, 2
je 0x10001203
cmp dword [esi + 0xf4], 0
jne 0x10001224
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp dword [eax + 0x14], 0
jne 0x1000123b
mov ebx, dword [ebp + 0x10]
xor esi, esi
test ebx, ebx
jg 0x100011b3
mov eax, dword [0x101f2f3c]
cmp dword [eax + 4], 4
jge 0x1000125f
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
xor esi, esi
push ebx
mov dword [ebp - 0x10], ecx
push ecx
push edi
call fcn.10001280
add esp, 0xc
test eax, eax
js 0x10001272
add esi, eax
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
jne 0x1000119a
mov ecx, dword [ebp - 0x10]
add ecx, eax
sub ebx, eax
test ebx, ebx
jg 0x100011b8
jmp 0x1000119a
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1000115d
and eax, 0xfffffffd
mov dword [esi + 0xe0], eax
push 0
push 0xffffe897
call sym.nss3.dll_PR_SetError
add esp, 8
cmp dword [esi + 0xf4], 0
je 0x10001233
push 0
push 0xffffe89b
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x100011a9
mov eax, dword [edi]
mov ecx, dword [eax + 0x20]
call dword [section..00cfg]
xor eax, eax
push 2
push eax
push eax
push edi
call ecx
add esp, 0x10
and edx, eax
cmp edx, 0xffffffff
jne 0x10001191
jmp 0x10001233
push esi
push str.write_____d
call sym.nss3.dll_PR_LogPrint
add esp, 8
jmp 0x100011a9
xor esi, esi
dec esi
jmp 0x1000119a

Function at 0x10001280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov esi, dword [0x101ef014]
xor esi, ebp
mov dword [ebp - 8], esi
mov edx, dword [edx + 4]
lea esi, [ebp - 0xc]
push 0
push esi
push ecx
push eax
push dword [edx + 0x18]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x100012c8
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10128810
add esp, 4
xor esi, esi
dec esi
jmp 0x100012b6
Function at 0x10001cb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov edi, dword [ebp + 8]
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [esp + 0x98], eax
cmp dword [0x101f2f50], 0
je 0x10001d68
test edi, edi
je 0x10001d1f
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10001d1f
cmp byte [edi], 0
je 0x10001d1f
push 0x25
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x10001d72
mov ecx, edi
mov edx, esi
call fcn.10001e80
mov esi, eax
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [0x101f2f50], 0
je 0x10001e6d
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10001d50
mov dword [eax + 0x28], 0xffffe89d
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x10001d07
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x10001d3c
call fcn.100029e0
jmp 0x10001cdd
push 0x100717f0
push 0x101f23ec
call sym.nss3.dll_PR_CallOnce
add esp, 8
test eax, eax
jne 0x10001cfc
test byte [0x101f23f8], 1
je 0x10001cfc
xorps xmm0, xmm0
lea ebx, [esp + 4]
movups xmmword [ebx + 0xc], xmm0
xor eax, eax
mov dword [ebx + 0x1c], eax
mov dword [ebx], 4
mov dword [ebx + 4], eax
mov dword [ebx + 8], 1
mov ecx, dword [0x101f25ec]
call dword [section..00cfg]
lea eax, [esp + 0x24]
push eax
push ebx
xor eax, eax
push eax
push edi
call ecx
test eax, eax
je 0x10001df2
mov edi, eax
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], 0xffffe89d
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], 0
jmp 0x10001d4b
mov edi, dword [esp + 0x24]
mov ebx, dword [edi + 0x18]
lea eax, [esp + 0x28]
push dword [edi + 0x10]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, word [ebx]
cmp eax, 2
je 0x10001e2e
cmp eax, 0x17
jne 0x10001e50
mov word [esi], 0x17
movups xmm0, xmmword [esp + 0x30]
movups xmmword [esi + 8], xmm0
mov eax, dword [esp + 0x40]
mov dword [esi + 0x18], eax
jmp 0x10001e3a
mov word [esi], 2
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], eax
xor esi, esi
mov ecx, dword [0x101f25f0]
call dword [section..00cfg]
push edi
call ecx
jmp 0x10001d07
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], 0xffffe89d
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov edi, dword [esp + 0x24]
jmp 0x10001e3c
call fcn.100029e0
jmp 0x10001d2c
Function at 0x100028b0
Capabilities:
Get socket status
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10128e30

Function at 0x10002db0
Capabilities:
Get thread local storage value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
cmp dword [0x101f2f50], 0
je 0x10002e40
mov ebx, dword [0x101f25b0]
test ebx, ebx
je 0x10002e1f
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x10002e2c
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], esi
mov ebx, dword [0x101f25b0]
mov dword [esp], edi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
test ebx, ebx
je 0x10002e15
mov dword [esp], ebx
call sym.nss3.dll_PR_Unlock
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov esi, eax
jmp 0x10002de6
call fcn.100029e0
jmp 0x10002dc5

Function at 0x10002ea0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 8], eax
mov esi, dword [0x101f25a0]
test esi, esi
jne 0x10002ee8
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov esi, dword [esi + 4]
mov dword [0x101f25a0], esi
lea eax, [esi - 1]
bsr eax, eax
xor eax, 0xffffffe0
add eax, 0x21
xor ecx, ecx
cmp esi, 2
cmovae ecx, eax
mov dword [0x101f259c], ecx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x10003080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
inc eax
mov dword [ebp - 0x1c], ecx
shl eax, cl
mov dword [ebp - 0x18], eax
dec eax
mov dword [ebp - 0x14], eax
shl eax, 4
add eax, 0x14
push eax
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x10003252
mov esi, eax
mov ebx, 0xc
xor edi, edi
call sym.nss3.dll_PR_NewMonitor
mov dword [esi + ebx], eax
test eax, eax
je 0x10003190
add ebx, 0x10
dec edi
mov eax, dword [ebp - 0x18]
add eax, edi
jne 0x100030bb
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
lea eax, [esi + 4]
mov ecx, eax
test edi, edi
mov ebx, dword [ebp - 0x1c]
je 0x100030fa
lea ecx, [esi + 0x14]
mov dword [ecx - 0x10], ecx
add ecx, 0x10
dec edi
jne 0x100030ee
add ecx, 0xfffffff0
mov edx, dword [0x101f2fa0]
mov dword [ecx], edx
mov dword [0x101f2fa0], eax
mov eax, dword [ebp - 0x10]
add dword [0x101f2fa4], eax
mov eax, dword [0x101f2fa8]
mov dword [esi], eax
mov dword [0x101f2fa8], esi
mov eax, 4
mov ecx, ebx
shl eax, cl
push eax
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x100031c3
mov ecx, dword [ebp - 0x14]
mov dword [0x101f2fb0], ecx
mov ecx, dword [0x101f2fac]
mov edx, dword [0x101f2fb4]
test edx, edx
jne 0x100031df
mov dword [0x101f2fac], eax
mov esi, dword [ebp - 0x18]
mov dword [0x101f2fb4], esi
mov dword [0x101f2fb8], ebx
push ecx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov eax, dword [0x101f2f70]
xor edi, edi
cmp dword [eax + 4], 4
jge 0x1000322f
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x18]
add eax, edi
je 0x100030d6
test edi, edi
je 0x10003248
mov eax, edi
neg eax
mov dword [ebp - 0x10], eax
add ebx, 0xfffffff8
push ebx
push esi
call sym.nss3.dll_PR_Realloc
add esp, 8
test eax, eax
cmovne esi, eax
not edi
jmp 0x100030df
mov eax, dword [0x101f2f70]
cmp dword [eax + 4], 3
jl 0x100031db
push str.unable_to_grow_monitor_cache_hash_buckets
call sym.nss3.dll_PR_LogPrint
add esp, 4
xor edi, edi
jmp 0x10003186
mov dword [ebp - 0x10], 0
mov esi, dword [ebp - 0x10]
mov edi, dword [ecx + esi*4]
test edi, edi
je 0x10003219
mov esi, dword [edi]
mov dword [ebp - 0x14], esi
mov esi, dword [edi + 4]
mov ebx, esi
shr ebx, 2
shr esi, 0xa
xor esi, ebx
and esi, dword [0x101f2fb0]
mov ebx, dword [eax + esi*4]
mov dword [edi], ebx
mov dword [eax + esi*4], edi
mov esi, dword [ebp - 0x14]
mov edi, esi
test esi, esi
jne 0x100031f0
mov edi, dword [ebp - 0x10]
inc edi
mov esi, edi
mov dword [ebp - 0x10], edi
cmp edi, edx
mov ebx, dword [ebp - 0x1c]
je 0x10003157
jmp 0x100031e6
push esi
push dword [0x101f2fa4]
push str.expanded_monitor_cache_to__d__buckets__d_
call sym.nss3.dll_PR_LogPrint
add esp, 0xc
jmp 0x10003186
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
xor edi, edi
dec edi
jmp 0x10003186
Function at 0x100033b0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x194
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.NSPR_FD_CACHE_SIZE_LOW
call sym.nss3.dll_PR_GetEnv
add esp, 4
mov ebx, eax
push str.NSPR_FD_CACHE_SIZE_HIGH
call sym.nss3.dll_PR_GetEnv
add esp, 4
xor edi, edi
mov dword [0x101f23dc], edi
mov dword [0x101f23e0], edi
mov esi, 0
test ebx, ebx
jne 0x10003534
test eax, eax
jne 0x1000354f
test esi, esi
js 0x10003565
cmp esi, 0x41
jae 0x10003569
cmp edi, 0x40
jg 0x10003579
cmp edi, esi
jl 0x1000357e
call sym.nss3.dll_PR_NewLock
mov dword [0x101f23cc], eax
call sym.nss3.dll_PR_NewLock
mov dword [0x101f23e4], eax
push eax
call sym.nss3.dll_PR_NewCondVar
add esp, 4
mov dword [0x101f23e8], eax
push 0xfffffffffffffff6
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, eax
call fcn.100024c0
mov esi, eax
test eax, eax
je 0x10003589
mov dword [esi], 0x101f118c
mov eax, dword [esi + 4]
mov dword [eax], 0xaaaaaaaa
mov eax, dword [esi + 4]
mov dword [eax + 0x18], edi
mov dword [0x101f2f2c], esi
push 0xfffffffffffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, eax
call fcn.100024c0
mov esi, eax
test eax, eax
je 0x1000359d
mov dword [esi], 0x101f118c
mov eax, dword [esi + 4]
mov dword [eax], 0xaaaaaaaa
mov eax, dword [esi + 4]
mov dword [eax + 0x18], edi
mov dword [0x101f2f30], esi
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov edi, eax
call fcn.100024c0
mov esi, eax
test eax, eax
je 0x100035b1
mov dword [esi], 0x101f118c
mov eax, dword [esi + 4]
mov dword [eax], 0xaaaaaaaa
mov eax, dword [esi + 4]
mov dword [eax + 0x18], edi
mov dword [0x101f2f6c], esi
mov eax, dword [0x101f2f2c]
mov eax, dword [eax + 4]
xor ecx, ecx
dec ecx
mov dword [eax + 8], ecx
mov eax, dword [0x101f2f30]
mov eax, dword [eax + 4]
mov dword [eax + 8], ecx
mov eax, dword [esi + 4]
mov dword [eax + 8], ecx
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
call fcn.100036c0
call fcn.100035d0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
add esp, 0x194
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov esi, eax
mov eax, ebx
mov dword [0x101f23dc], esi
jmp 0x100033fd
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov edi, eax
mov dword [0x101f23e0], eax
jmp 0x10003405
xor esi, esi
jmp 0x1000356e
mov esi, 0x40
mov dword [0x101f23dc], esi
jmp 0x10003416
mov esi, 0x40
mov dword [0x101f23e0], esi
jmp 0x10003427
push 0
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x10003477
push 0
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x100034ab
push 0
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x100034df
Function at 0x100035d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x98
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 8], eax
lea esi, [ebp - 0x98]
push 0x90
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi - 4], 0x94
lea esi, [ebp - 0x9c]
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [esi + 4], 5
jne 0x1000361d
cmp dword [ebp - 0x94], 1
je 0x10003630
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10156ff0
add esp, 0x98
pop esi
pop ebp
ret
mov byte [0x101f23c8], 1
jmp 0x1000361d
Function at 0x10003ec0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x18]
call sub.wsock32.dll_getsockname
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x10003ee1
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.101a57c0
add esp, 4
xor eax, eax
dec eax
jmp 0x10003edf

Function at 0x100042f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [0x101f2f50], 0
je 0x1000440d
mov ebx, dword [ebp + 8]
mov edi, dword [0x101f25e0]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100043e1
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
mov edi, dword [ebx + 8]
mov eax, dword [0x101f25e0]
mov esi, dword [ebx]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
test esi, esi
je 0x10004366
xor esi, esi
test edi, edi
jne 0x10004417
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
inc eax
xchg dword [ebx + 4], eax
test eax, eax
jne 0x10004432
mov ecx, dword [ebp + 0xc]
call dword [section..00cfg]
call ecx
mov esi, eax
mov eax, dword [0x101f25e0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100043f8
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov dword [ebx + 8], esi
mov dword [ebx], 1
mov eax, dword [0x101f25e4]
mov dword [esp], eax
call sym.nss3.dll_PR_NotifyAllCondVar
mov eax, dword [0x101f25e0]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
jmp 0x1000435c
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov esi, eax
jmp 0x1000432a
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov dword [ebp - 0x10], eax
jmp 0x100043a1
call fcn.100029e0
jmp 0x10004306
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], 0xffffe8db
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov esi, edi
jmp 0x1000435c
mov eax, dword [0x101f25e0]
mov dword [esp], eax
call sym.nss3.dll_PR_Lock
cmp dword [ebx], 0
jne 0x1000445b
mov eax, dword [0x101f25e4]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call sym.nss3.dll_PR_WaitCondVar
jmp 0x1000443f
mov esi, dword [ebx + 8]
mov eax, dword [0x101f25e0]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
test esi, esi
je 0x10004488
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], 0xffffe8db
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1000435c
xor esi, esi
jmp 0x1000435c
Function at 0x10004490
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100044d0
mov ecx, dword [esi]
cmp dword [ecx + 8], eax
jne 0x100044e2
add ecx, 0x1c
add esi, 0x74
mov dword [esp + 4], ecx
mov dword [esp], esi
call sym.nss3.dll__PR_MD_NOTIFYALL_CV
xor eax, eax
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x100044af
xor eax, eax
dec eax
jmp 0x100044ca

Function at 0x100046f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x18]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call sub.wsock32.dll_setsockopt
sub esp, 0x14
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x10004720
add esp, 0x14
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
mov dword [esp], eax
call fcn.101a4a30
xor eax, eax
dec eax
jmp 0x1000471b

Function at 0x10006aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
cmp edx, 0xb
ja case.default.0x10006aad
jmp dword [edx*4 + 0x101b6b68]
add edx, 0xfffffff8
mov dword [eax], edx
mov dword [eax + 4], 0
mov word [eax + 0x10], 4
pop esi
pop edi
pop ebp
ret
mov word [eax + 0x10], 1
jmp 0x10006ac6
movsx ecx, byte [ecx]
mov dword [eax], ecx
sar ecx, 0x1f
mov dword [eax + 4], ecx
jmp 0x10006ac0
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
bswap esi
bswap ecx
mov dword [eax + 4], esi
mov dword [eax], ecx
cmp edx, 6
je 0x10006ac0
mov edx, esi
not edx
and esi, 0xfffff
xor edi, edi
inc edi
or ecx, esi
mov ecx, 8
cmove edi, ecx
test edx, 0x7ff00000
cmovne edi, ecx
mov word [eax + 0x10], di
jmp 0x10006ac6
mov dword [eax + 8], ecx
lea ecx, [edx - 0xc]
shr ecx, 1
mov dword [eax + 0xc], ecx
and edx, 1
movzx ecx, word [edx + edx + 0x101b05f6]
mov word [eax + 0x10], cx
jmp 0x10006ac6
movsx edx, byte [ecx]
mov esi, edx
shl esi, 8
movzx ecx, byte [ecx + 1]
or ecx, esi
sar edx, 0x1f
mov dword [eax + 4], edx
mov dword [eax], ecx
jmp 0x10006ac0
mov edx, dword [ecx + 2]
bswap edx
movsx esi, byte [ecx]
shl esi, 8
movzx ecx, byte [ecx + 1]
or ecx, esi
mov dword [eax], edx
jmp 0x10006ada
movsx edx, byte [ecx]
mov esi, edx
shl esi, 0x10
movzx edi, byte [ecx + 1]
shl edi, 8
or edi, esi
movzx ecx, byte [ecx + 2]
or ecx, edi
jmp 0x10006b42
mov ecx, dword [ecx]
bswap ecx
jmp 0x10006ad5
mov word [eax + 0x10], 0x401
xor ecx, ecx
mov dword [eax + 0xc], ecx
mov dword [eax], ecx
jmp 0x10006ac6