joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021aa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227f12
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push dword [0x102ad738]
mov esi, dword [eax + 0x2c]
lea ecx, [eax + 0x2c]
mov dword [ebp - 0x20], ecx
mov ebx, dword [eax + 0x28]
lea edi, [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10021aff
nop dword [eax]
cmp dword [eax], esi
je 0x10021bb0
mov eax, dword [eax + 8]
test eax, eax
jne 0x10021af0
push edi
push 0x50
mov dword [ebp - 0x30], edi
call fcn.10023580
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
add esp, 4
mov dword [ebp - 4], 2
mov ecx, eax
push edi
call fcn.1001ea30
mov esi, eax
mov byte [ebp - 4], 1
mov ecx, ebx
mov edi, dword [ebp - 0x20]
push esi
push edi
call fcn.10022bf0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
test al, al
je 0x10021bf6
mov eax, dword [edi]
xorps xmm0, xmm0
push dword [0x102ad738]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x102ad738]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
push 0x102a8ad8
push 0x1003c720
push 0x102a8ae0
mov byte [ebp - 4], 5
call fcn.101d1ed1
add esp, 0xc
test eax, eax
je 0x10021c1a
jmp 0x10021bcd
cmp dword [eax + 4], 0
je 0x10021aff
push edi
push edi
mov dword [ebp - 4], 0
call fcn.1001fee0
add esp, 8
jmp 0x10021bfe
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebx + 0x18]
call fcn.1001ecc0
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.10022b80
push dword [ebp - 0x14]
push dword [0x102ad738]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.1001ec30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
call fcn.101f7e31
int3
Function at 0x10021c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227f58
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
test byte [edi + 8], 1
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], eax
jne 0x10021c8d
mov eax, dword [edi]
push dword [0x102ad720]
mov esi, dword [eax + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call ebx
test eax, eax
je 0x10021c8d
cmp dword [eax], esi
je 0x10021cc7
mov eax, dword [eax + 8]
test eax, eax
jne 0x10021c82
push dword [0x102ad720]
lea eax, [edi + 4]
mov dword [ebp - 0x88], eax
call ebx
test eax, eax
je 0x10021d29
mov eax, dword [eax + 4]
test eax, eax
je 0x10021d29
mov esi, dword [eax]
test esi, esi
je 0x10021d29
mov dword [eax], 0
mov al, byte [esi]
cmp al, 0x20
jb 0x10021d20
mov byte [esi + 0x80], al
jmp 0x10021d3f
cmp dword [eax + 4], 0
je 0x10021c8d
push 0x58
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.101ee530
add esp, 0xc
lea ecx, [ebp - 0x74]
push dword [ebp - 0x78]
call fcn.10021500
mov dword [ebp - 4], 0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 2
push eax
push eax
call fcn.10021a10
add esp, 8
lea ecx, [ebp - 0x64]
call fcn.100151d0
jmp 0x10021dbd
push esi
call fcn.100df630
add esp, 4
push 0x81
call fcn.101d507c
mov esi, eax
add esp, 4
mov byte [esi + 0x80], 0x20
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x80], 0
push dword [ebp - 0x78]
mov dword [ebp - 4], 4
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x10021f20
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.10021500
push ecx
mov ecx, dword [edi]
push esi
mov ecx, dword [ecx + 8]
call fcn.100324a0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
call fcn.10021e20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4

Function at 0x10021e20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x10021e3a
add ecx, 0x30
call fcn.100151d0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x10021e81
push dword [0x102ad720]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10021e71
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10021e71
cmp dword [ecx], 0
jne 0x10021e71
mov al, byte [esi + 0x80]
mov byte [esi], al
mov dword [ecx], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.100df630
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x10021e90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x10021eb2
lea ecx, [esi + 0x48]
call fcn.100151d0
lea ecx, [esi + 0xc]
call fcn.10019b90
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x10021efb
push dword [0x102ad720]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10021eeb
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10021eeb
cmp dword [ecx + 8], 0
jne 0x10021eeb
mov al, byte [esi + 0x98]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.100df630
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x100220c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10228015
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
test byte [ebx + 8], 1
mov edi, dword [ebp + 8]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], edi
jne 0x1002212b
mov eax, dword [ebx]
push dword [0x102ad720]
mov esi, dword [eax + 8]
lea eax, [esi + 0x14]
neg esi
sbb esi, esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1002212b
nop dword [eax]
cmp dword [eax], esi
je 0x10022172
mov eax, dword [eax + 8]
test eax, eax
jne 0x10022120
push dword [0x102ad720]
lea eax, [ebx + 4]
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10022251
mov eax, dword [eax + 4]
test eax, eax
je 0x10022251
mov edi, dword [eax]
test edi, edi
je 0x10022251
mov dword [eax], 0
mov al, byte [edi]
cmp al, 0x1e
jb 0x10022248
mov byte [edi + 0x78], al
jmp 0x10022261
cmp dword [eax + 4], 0
je 0x1002212b
push 0x50
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.101ee530
mov eax, dword [edi]
lea ecx, [ebp - 0x64]
add esp, 0xc
mov dword [ebp - 0x6c], eax
lea eax, [edi + 8]
push eax
call fcn.10017a20
mov eax, dword [edi + 0x48]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x4c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 2
push eax
push eax
call fcn.1001f640
add esp, 8
mov dword [ebp - 4], 3
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x100221ec
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x100221ec
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x100221ec
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea ecx, [ebp - 0x64]
call fcn.100151d0
jmp 0x100222f3
push edi
call fcn.100df630
add esp, 4
push 0x79
call fcn.101d507c
mov edi, eax
add esp, 4
mov byte [edi + 0x78], 0x1e
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], 0
mov ecx, dword [ebp - 0x70]
lea esi, [edi + 0x20]
mov dword [ebp - 4], 7
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x100226d0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov eax, dword [ecx]
mov dword [esi], eax
lea eax, [ecx + 8]
push eax
lea ecx, [esi + 8]
mov dword [ebp - 0x74], esi
call fcn.10017a20
mov ecx, dword [ebp - 0x70]
push ecx
push edi
mov eax, dword [ecx + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x4c]
mov dword [esi + 0x4c], eax
mov ecx, dword [ebx]
mov ecx, dword [ecx + 8]
call fcn.100324a0
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
call fcn.10022330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 4
Function at 0x10022330
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102259a0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1029912c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x100223a3
lea esi, [eax + 0x28]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x10022394
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x10022394
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10022394
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
call fcn.100151d0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100223df
push dword [0x102ad720]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100223cf
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100223cf
cmp dword [ecx], 0
jne 0x100223cf
mov al, byte [esi + 0x78]
mov byte [esi], al
mov dword [ecx], esi
jmp 0x100223d8
push esi
call fcn.100df630
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022400
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10228062
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push dword [0x102ad738]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov esi, dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10022453
cmp dword [eax], esi
je 0x1002246b
mov eax, dword [eax + 8]
test eax, eax
jne 0x10022448
mov esi, dword [edi + 0x78]
mov dword [ebp - 0x30], edi
cmp byte [esi + 0x400], 0
jne 0x10022487
mov byte [esi + 0x400], 1
jmp 0x10022496
cmp dword [eax + 4], 0
je 0x10022453
push edi
push edi
mov dword [ebp - 4], 0
call fcn.100228e0
add esp, 8
jmp 0x1002259e
push 0xf8
call fcn.101d507c
add esp, 4
mov esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
lea ecx, [esi + 0x20]
push edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], fcn.100225e0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.10022820
mov byte [ebp - 4], 1
mov ecx, ebx
mov edi, dword [ebp - 0x20]
push esi
push edi
call fcn.10022bf0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
test al, al
je 0x10022596
mov eax, dword [edi]
xorps xmm0, xmm0
push dword [0x102ad738]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x102ad738]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
push 0x102a8ad8
push 0x1003c720
push 0x102a8ae0
mov byte [ebp - 4], 5
call fcn.101d1ed1
add esp, 0xc
test eax, eax
je 0x100225bc
push 0
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebx + 0x18]
call fcn.100225e0
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.10022b80
push dword [ebp - 0x14]
push dword [0x102ad738]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea ecx, [ebp - 0x30]
call fcn.100227c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 8
call fcn.101f7e31
int3
Function at 0x10022900
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
push 0
je 0x1002294d
mov ecx, dword [edi + 4]
push 0
push ebx
call fcn.10022d00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x10022975
mov ecx, dword [edi + 4]
push 0x2719
push ebx
call fcn.10022d00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
push ebx
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x100229cf
cmp eax, 0x3e5
je 0x100229cf
push dword [ebp - 8]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.10022d00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.10022dd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10022a80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [esi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
push 0
je 0x10022acd
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.10022d00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
jne 0x10022af5
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.10022d00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x10022b2a
mov eax, 0x2746
jmp 0x10022b37
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x10022b62
cmp eax, 0x3e5
je 0x10022b62
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.10022d00
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.10022dd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10022bf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x18]
push edi
push dword [0x102ad720]
mov edi, dword [ebp + 8]
lea eax, [ebx + 0x14]
neg ebx
sbb ebx, ebx
and ebx, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10022c2b
nop
cmp dword [eax], ebx
je 0x10022c60
mov eax, dword [eax + 8]
test eax, eax
jne 0x10022c20
xor ebx, ebx
mov eax, dword [edi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ebx, ebx
je 0x10022c65
mov eax, dword [edi]
cmp byte [eax + 0x38], 0
jne 0x10022c65
mov byte [eax + 0x38], 1
mov eax, dword [edi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [eax + 4]
jmp 0x10022c2d
mov eax, dword [edi]
cmp byte [eax + 0x38], 0
je 0x10022cb5
mov dword [esi + 0x14], 0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x10022c98
mov dword [ecx + 0x14], esi
mov dword [eax + 0x40], esi
mov eax, dword [edi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [eax + 0x3c], esi
mov dword [eax + 0x40], esi
mov eax, dword [edi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [eax + 0x38], 1
mov eax, dword [edi]
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [edi]
add eax, 0x44
mov dword [esi + 0x14], 0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10022cdd
mov dword [ecx + 0x14], esi
jmp 0x10022cdf
mov dword [eax], esi
push ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 4], esi
push dword [edi]
mov ecx, dword [ecx + 0x18]
call fcn.100324a0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10023530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x102ad720]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10023548
mov edx, dword [eax + 4]
jmp 0x1002354a
xor edx, edx
mov eax, dword [ebp + 0xc]
cmp eax, 0x3fc
ja 0x10023569
test edx, edx
je 0x10023569
cmp dword [edx], 0
jne 0x10023569
mov ecx, dword [ebp + 8]
mov al, byte [ecx + eax]
mov byte [ecx], al
mov dword [edx], ecx
pop ebp
ret
push dword [ebp + 8]
call fcn.100df630
add esp, 4
pop ebp
ret
Function at 0x10023580
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x102ad720]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10023598
mov ecx, dword [eax + 4]
jmp 0x1002359a
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + 3]
shr ebx, 2
test ecx, ecx
je 0x100235c7
mov eax, dword [ecx]
test eax, eax
je 0x100235c7
mov dword [ecx], 0
mov dl, byte [eax]
movzx ecx, dl
cmp ecx, ebx
jae 0x100235e5
push eax
call fcn.100df630
add esp, 4
lea eax, [ebx*4 + 1]
push eax
call fcn.101d507c
xor edx, edx
movzx ecx, bl
add esp, 4
cmp ebx, 0xff
cmovbe edx, ecx
mov byte [eax + esi], dl
pop esi
pop ebx
pop ebp
ret
Function at 0x100261a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 1
push 0
push 0
push dword [ebp + 8]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
mov ecx, esi
cmp edi, 0xffffffff
sete dl
call fcn.10034890
cmp edi, 0xffffffff
jne 0x100261f0
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
cmp ebx, 0x17
jne 0x1002620d
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret
Function at 0x10030840
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1029912c]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100308dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [0x102a7d90]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x102a8ac0]
cmp ecx, dword [edx + 4]
jle 0x100308cc
push 0x102a8ac0
call fcn.101d529a
add esp, 4
cmp dword [0x102a8ac0], esi
jne 0x100308cc
push 0x10232180
mov dword [0x102a8ac8], 0x102a8ac4
mov dword [0x102a8ac4], 0x1026b454
call fcn.101d56bf
add esp, 4
push 0x102a8ac0
call fcn.101d5250
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x102a8ac4
test edi, edi
jne 0x100308ef
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov edx, 0x10269258
lea ecx, [esp + 0xc]
call fcn.1003c190
int3

Function at 0x100316b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1029912c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x14], esi
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x100317bd
cmp byte [ebp + 8], 0
je 0x1003171d
test byte [esi], 8
je 0x1003171d
xor eax, eax
lea ecx, [ebp - 0x10]
xorps xmm0, xmm0
mov dword [ebp - 8], eax
movlpd qword [ebp - 0x10], xmm0
call fcn.1003c770
or byte [esi], 8
lea eax, [ebp - 8]
push 4
push eax
push 0x80
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x10]
setne dl
call fcn.10034890
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.10034890
test esi, esi
je 0x100317aa
mov edx, 0x2733
lea ecx, [ebp - 0x10]
call fcn.100353b0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jne 0x10031757
cmp dword [edi], edx
je 0x10031778
mov edx, 0x4d5
lea ecx, [ebp - 0x10]
call fcn.100353b0
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, dword [ecx + 4]
jne 0x100317aa
cmp dword [edi], edx
jne 0x100317aa
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x14]
push ebx
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.10034890
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d506b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d506b
mov esp, ebp
pop ebp
ret