joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012c230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f177b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10285124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::asio::detail::select_reactor.0
mov eax, dword [eax + 8]
mov dword [edi + 0x14], eax
call fcn.10127a50
mov esi, eax
call fcn.101dfef0
mov dword [ebp - 0x18], eax
mov ecx, fcn.100a5110
xor eax, eax
mov dword [ebp - 0x1c], esi
test esi, esi
cmove ecx, eax
test ecx, ecx
je 0x1012c2bc
mov edx, str.mutex
lea ecx, [ebp - 0x1c]
call fcn.10127780
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.1012bb00
push 0x1012c430
push 0x10139080
push 4
push 0x1c
lea eax, [edi + 0x38]
mov byte [ebp - 4], 2
push eax
call fcn.101b54d5
push 0x100d3d70
push 0x1012b8c0
push 3
push 0xc
lea eax, [edi + 0xa8]
mov byte [ebp - 4], 3
push eax
call fcn.101b54d5
mov byte [ebp - 4], 4
mov dword [edi + 0xcc], 0
push 0xc
mov byte [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov byte [edi + 0xd8], 0
call fcn.101b4ab7
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov byte [ebp - 4], 5
push 0x14
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.101b4ab7
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, esi
mov dword [eax], vtable.boost::asio::detail::win_thread::func_class_boost::asio::detail::binder1_void____cdecl___class_boost::asio::detail::select_reactor____class_boost::asio::detail::select_reactor___.0
push 0
push eax
mov dword [eax + 0xc], 0x1012ca10
mov dword [eax + 0x10], edi
call fcn.10127d70
mov dword [edi + 0xd4], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1012d0b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
push 0
je 0x1012d0df
mov ecx, dword [edi + 4]
push 0
push dword [ebp + 0x1c]
call fcn.10128800
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x1012d101
mov ecx, dword [edi + 4]
push 0x2719
push dword [ebp + 0x1c]
call fcn.10128800
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp + 0x18]
push ebx
push dword [ebp + 0x14]
mov dword [ebp + 0x18], 0
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x1012d155
cmp eax, 0x3e5
je 0x1012d155
push dword [ebp + 0x18]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.10128800
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.10128790
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x1012d170
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
push 0
je 0x1012d19f
mov ecx, dword [esi + 4]
push 0
push dword [ebp + 0x1c]
call fcn.10128800
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x1012d1c1
mov ecx, dword [esi + 4]
push 0x2719
push dword [ebp + 0x1c]
call fcn.10128800
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x1c]
push edi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1012d1fb
mov eax, 0x2746
jmp 0x1012d208
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x1012d228
cmp eax, 0x3e5
je 0x1012d228
push dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.10128800
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.10128790
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18

Function at 0x1012e160
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f1ab7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10285124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14], 1
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x334]
shr esi, 3
add esi, dword [ebp + 8]
mov ecx, esi
lea eax, [edx + 1]
shl ecx, 6
mov dword [edi + 0x334], eax
add ecx, edx
mov eax, esi
shr eax, 2
add eax, 0x9e3779b9
add eax, ecx
xor esi, eax
mov eax, 0x15390949
mul esi
shr edx, 4
imul eax, edx, 0xffffff3f
add esi, eax
cmp dword [edi + esi*4 + 0x30], 0
lea edi, [edi + esi*4]
jne 0x1012e234
push 0x4c
call fcn.101b4ab7
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1012de50
mov esi, dword [edi + 0x30]
mov ebx, eax
test esi, esi
je 0x1012e231
lea ecx, [esi + 0x44]
call fcn.10139500
lea ecx, [esi + 0x3c]
call fcn.10139500
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x4c
push esi
call fcn.101b4aea
add esp, 8
mov dword [edi + 0x30], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x30]
push dword [ebp - 0x18]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1012e260
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [0x102a8158]
mov esi, dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1012e28b
nop dword [eax + eax]
cmp dword [eax], esi
je 0x1012e2c1
mov eax, dword [eax + 8]
test eax, eax
jne 0x1012e280
xor edi, edi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x1012e2c6
mov eax, dword [esi]
cmp byte [eax + 0x38], 0
jne 0x1012e2c6
mov byte [eax + 0x38], 1
mov eax, dword [esi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 8
mov edi, dword [eax + 4]
jmp 0x1012e28d
mov eax, dword [esi]
cmp byte [eax + 0x38], 0
je 0x1012e315
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x14], 0
mov edx, dword [eax + 0x40]
test edx, edx
je 0x1012e2fa
mov dword [edx + 0x14], ecx
mov dword [eax + 0x40], ecx
mov eax, dword [esi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov eax, dword [esi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [eax + 0x38], 1
mov eax, dword [esi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
add eax, 0x44
mov dword [ecx + 0x14], 0
mov edx, dword [eax + 4]
test edx, edx
je 0x1012e340
mov dword [edx + 0x14], ecx
jmp 0x1012e342
mov dword [eax], ecx
push ecx
mov dword [eax + 4], ecx
push dword [esi]
mov ecx, dword [ebx + 0x14]
call fcn.10127fc0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
Function at 0x10133330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
push edi
mov edi, ebx
shr edi, 2
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edi
movd xmm0, ecx
pshufd xmm1, xmm0, 0
test edi, edi
je 0x101333f6
cmp edi, 8
jb 0x101333cd
mov ecx, dword [ebp - 4]
lea eax, [esi - 4]
lea eax, [eax + edi*4]
cmp ecx, eax
ja 0x10133382
lea eax, [ecx - 4]
lea eax, [eax + edi*4]
cmp eax, esi
jae 0x101333cb
mov eax, edi
mov ebx, esi
and eax, 0xfffffff8
sub ebx, ecx
mov dword [ebp - 0xc], eax
lea eax, [ecx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
nop dword [eax]
movups xmm0, xmmword [esi + edx*4]
add edx, 8
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [edi + eax - 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edx, ecx
jb 0x101333a0
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
jmp 0x101333cd
mov eax, ecx
cmp edx, edi
jae 0x101333f6
mov ebx, esi
lea ecx, [eax + edx*4]
sub ebx, eax
sub edi, edx
mov edx, dword [ebp - 0x14]
nop dword [eax]
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, edx
mov dword [ecx - 4], eax
sub edi, 1
jne 0x101333e0
mov edi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
lea ecx, [edi*4]
cmp ecx, ebx
jae 0x10133427
mov eax, dword [ebp - 4]
sub esi, eax
mov edi, dword [ebp + 0xc]
lea edx, [ecx + eax]
nop dword [eax]
mov eax, ecx
lea edx, [edx + 1]
and eax, 3
inc ecx
mov al, byte [eax + edi]
xor al, byte [edx + esi - 1]
mov byte [edx - 1], al
cmp ecx, ebx
jb 0x10133410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10133430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
shr esi, 2
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edi
lea ecx, [esi*4]
mov dword [ebp - 0x18], esi
sub ebx, ecx
mov dword [ebp - 8], ebx
test esi, esi
je 0x10133503
cmp esi, 8
jb 0x101334dd
add eax, 0xfffffffc
add eax, ecx
mov dword [ebp - 0x10], eax
lea eax, [edi - 4]
add eax, ecx
mov ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x10133483
cmp dword [ebp - 0x10], edi
jae 0x101334db
movd xmm0, dword [ebp + 0xc]
mov eax, esi
and eax, 0xfffffff8
pshufd xmm1, xmm0, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
sub ebx, ecx
lea eax, [ecx + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
nop dword [eax + eax]
movups xmm0, xmmword [edi + edx*4]
add edx, 8
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [esi + eax - 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
cmp edx, ecx
jb 0x101334b0
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
jmp 0x101334dd
mov eax, ecx
cmp edx, esi
jae 0x10133503
mov ebx, edi
lea ecx, [eax + edx*4]
sub ebx, eax
sub esi, edx
mov edx, dword [ebp + 0xc]
nop dword [eax]
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, edx
mov dword [ecx - 4], eax
sub esi, 1
jne 0x101334f0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
xor eax, eax
sub ecx, ebx
mov dword [ebp + 8], ecx
test ebx, ebx
je 0x101335d3
mov esi, dword [ebp - 4]
cmp ebx, 0x20
jb 0x101335b6
lea edx, [ecx + esi]
dec ecx
add ecx, ebx
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + ebx + 0xb]
cmp edx, ecx
ja 0x10133542
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0xc]
add ecx, esi
cmp ecx, dword [ebp - 0x18]
jae 0x101335b3
mov ecx, dword [ebp + 8]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
add ecx, edi
cmp edx, ecx
ja 0x10133560
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
add ecx, esi
cmp ecx, dword [ebp - 0x10]
jae 0x101335b3
mov ecx, ebx
mov ebx, edi
mov edi, dword [ebp - 0x10]
and ecx, 0xffffffe0
sub ebx, esi
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
nop word [eax + eax]
movups xmm1, xmmword [edx + esi]
lea edx, [edx + 0x20]
movups xmm0, xmmword [ebp + eax + 0xc]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax + 0x1c]
movups xmmword [edx - 0x20], xmm1
movups xmm1, xmmword [edi + eax + 0x10]
add eax, 0x20
pxor xmm1, xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, ecx
jb 0x10133580
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp eax, ebx
jae 0x101335d3
lea edx, [eax + ecx]
add edx, esi
sub edi, esi
mov cl, byte [edx + edi]
lea edx, [edx + 1]
xor cl, byte [ebp + eax + 0xc]
inc eax
mov byte [edx - 1], cl
cmp eax, ebx
jb 0x101335c1
mov eax, dword [ebp + 0xc]
lea ecx, [ebx*8]
pop edi
pop esi
ror eax, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10135db0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f26ac
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10285124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0
cmp dword [edx + 0x14], 0x10
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
jb 0x10135e20
mov edx, dword [edx]
push eax
lea ecx, [ebp - 0x78]
call fcn.10135b90
add esp, 4
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x78]
call fcn.10135c60
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x10135e5d
mov eax, dword [esi]
jmp 0x10135e5f
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x7c], 1
cmp ecx, 0x10
jb 0x10135e95
mov dword [esi + 0x10], 0x10
cmp dword [esi + 0x14], 0x10
jb 0x10135e8d
mov eax, dword [esi]
mov byte [eax + 0x10], 0
jmp 0x10135ea6
mov eax, esi
mov byte [eax + 0x10], 0
jmp 0x10135ea6
mov eax, 0x10
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.100a5d10
cmp dword [esi + 0x14], 0x10
jb 0x10135eb0
mov eax, dword [esi]
jmp 0x10135eb2
mov eax, esi
push 0x10
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.101b6810
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101b451c
mov esp, ebp
pop ebp
ret
Function at 0x10136170
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x10285124]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, edx
mov dword [ebp - 0x18], 0x67452301
push esi
mov edx, ecx
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x14], 0xefcdab89
mov dword [ebp - 0x10], 0x98badcfe
mov dword [ebp - 0xc], 0x10325476
mov dword [ebp - 8], 0xc3d2e1f0
push edi
cmp eax, 0x40
jb 0x10136243
lea ebx, [eax - 0x40]
mov dword [ebp - 0x164], ebx
lea edi, [esi + 0x40]
cmp esi, edi
jae 0x10136225
mov ebx, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
nop word [eax + eax]
movzx ecx, byte [ebx + esi]
lea edx, [edx + 4]
movzx eax, byte [ebx + esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + esi + 3]
shl ecx, 8
add esi, 4
or ecx, eax
mov dword [edx - 4], ecx
cmp esi, edi
jb 0x101361f0
mov ebx, dword [ebp - 0x164]
lea edx, [ebp - 0x158]
lea ecx, [ebp - 0x18]
call fcn.10135ee0
cmp esi, ebx
jbe 0x101361d2
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x160]
mov ebx, eax
mov eax, 0xf
sub ebx, esi
nop dword [eax]
mov dword [ebp + eax*4 - 0x158], 0
sub eax, 1
jns 0x10136250
xor edi, edi
lea ecx, [edi + 3]
test ebx, ebx
je 0x1013629a
add esi, edx
nop dword [eax + eax]
mov eax, edi
lea edx, [ebp - 0x158]
shr eax, 2
lea edx, [edx + eax*4]
mov eax, edi
and eax, 3
sub ecx, eax
movzx eax, byte [esi + edi]
shl ecx, 3
inc edi
shl eax, cl
mov ecx, 3
or dword [edx], eax
cmp edi, ebx
jb 0x10136270
mov eax, edi
lea edx, [ebp - 0x158]
shr eax, 2
and edi, 3
lea edx, [edx + eax*4]
sub ecx, edi
shl ecx, 3
mov eax, 0x80
shl eax, cl
or dword [edx], eax
cmp ebx, 0x38
jb 0x101362f0
lea edx, [ebp - 0x158]
lea ecx, [ebp - 0x18]
call fcn.10135ee0
mov eax, 0xf
nop dword [eax]
nop word [eax + eax]
mov dword [ebp + eax*4 - 0x158], 0
sub eax, 1
jns 0x101362e0
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x158]
shl eax, 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x11c], eax
call fcn.10135ee0
mov esi, dword [ebp - 0x168]
mov edx, 0x13
mov eax, edx
mov ecx, edx
sar eax, 2
not ecx
and ecx, 3
shl ecx, 3
mov eax, dword [ebp + eax*4 - 0x18]
shr eax, cl
mov byte [esi + edx], al
sub edx, 1
jns 0x10136318
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101b451c
mov esp, ebp
pop ebp
ret
Function at 0x10138080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f2c98
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10285124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 2
push edi
call fcn.1019c9d1
lea esi, [edi + 0x30]
mov dword [ebp - 4], 0
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.101b4ab7
add esp, 0xc
mov dword [esi], eax
test eax, eax
je 0x10138100
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [esi]
mov dword [eax], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101396d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x10285124]
xor eax, esp
mov dword [esp + 0x19c], eax
push esi
push edi
mov esi, ecx
mov eax, 1
lock xadd dword [0x102a8028], eax
inc eax
mov edi, 0x102a802c
cmp eax, 1
jne 0x10139715
lea eax, [esp + 0x10]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [edi], eax
cmp byte [ebp + 8], 0
je 0x10139725
xor eax, eax
lock xadd dword [edi], eax
test eax, eax
jne 0x1013973d
mov ecx, dword [esp + 0x1a4]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.101b451c
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 8], eax
call fcn.101dfef0
mov edx, str.winsock
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
call fcn.10127780
int3
Function at 0x10161340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f6e93
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10285124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.100eae70
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebx], vtable.boost::asio::basic_streambuf_class_std::allocator_char__.0
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov esi, eax
mov byte [ebp - 4], 1
mov eax, 0x80
mov ecx, 1
cmp esi, eax
cmova esi, eax
cmp esi, ecx
mov eax, esi
cmovb eax, ecx
lea ecx, [ebx + 0x3c]
push eax
call fcn.10106270
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x20]
lea edx, [ecx + esi]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x30]
mov dword [eax], edx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101730d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f8cc1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10285124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
push dword [0x102a8164]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1017311b
cmp dword [eax], esi
je 0x10173157
mov eax, dword [eax + 8]
test eax, eax
jne 0x10173110
mov esi, dword [ebp + 0xc]
push esi
push 0x88
mov dword [ebp - 0x38], esi
call fcn.10127980
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10173191
push esi
mov ecx, eax
call fcn.10176770
mov edi, eax
jmp 0x10173193
cmp dword [eax + 4], 0
je 0x1017311b
push ecx
lea ecx, [ebp + 0xb]
call fcn.10128040
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push eax
call fcn.10187a70
add esp, 8
xchg dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
mov ecx, dword [ebp - 0x10]
push edi
push ebx
mov byte [ebp - 4], 1
call fcn.1012e260
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
test al, al
je 0x10173225
mov eax, dword [ebx]
push dword [0x102a8164]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push dword [0x102a8164]
mov dword [ebp - 0x28], eax
call esi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x18], 0
call fcn.101dfef0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 0
push eax
mov eax, dword [ebp - 0x10]
push edi
push dword [eax + 0x14]
call fcn.10176680
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.1012dee0
push dword [ebp - 0x24]
push dword [0x102a8164]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10178070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f6b5b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10285124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
lea edi, [ecx + 4]
mov dword [ebp + 8], edi
mov eax, dword [ebx]
lea esi, [ebx + 4]
mov dword [ecx], eax
mov ecx, edi
push esi
call fcn.101615d0
mov al, byte [esi + 0xc]
mov byte [edi + 0xc], al
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [edi]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x18]
sub eax, dword [esi]
and eax, 0xfffffff8
add dword [edi + 0x18], eax
mov dword [ebp - 4], 0
lea edi, [ebx + 0x40]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp - 0x10]
push edi
mov dword [ecx + 0x24], eax
mov eax, dword [ebx + 0x28]
mov dword [ecx + 0x28], eax
add ecx, 0x30
mov eax, dword [ebx + 0x30]
mov dword [ebp + 8], ecx
mov dword [ecx], eax
mov eax, dword [ebx + 0x34]
mov dword [ecx + 4], eax
add ecx, 8
mov eax, dword [ebx + 0x38]
mov dword [ebp + 8], ecx
lea esi, [ecx + 8]
mov dword [ecx], eax
mov ecx, esi
mov dword [ebp + 8], esi
call fcn.10146c70
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4