joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov edi, dword [esp + 0x78]
mov esi, dword [ebp + 0x6c]
test esi, esi
je 0x419319
mov ecx, dword [ebp + 0x3c]
xor eax, eax
mov dword [esp + 0x2c], ebp
jmp 0x4191c1
add eax, 1
cmp eax, 0x20
je 0x419270
mov ebx, dword [esi + eax*4]
test ebx, ebx
je 0x4191b5
mov edx, dword [ebx]
cmp dword [edx + 0x4c], ecx
jne 0x4191b5
cmp dword [edx + 0x50], edi
jne 0x4191b5
mov ebp, dword [esp + 0x7c]
cmp dword [edx + 0x54], ebp
jne 0x4191b5
mov dword [esi + eax*4], 0
mov eax, dword [ebx + 0x60]
sub dword [esi + 0x80], 1
mov dword [eax], edi
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x74]
mov dword [ebx + 0x44], ecx
or eax, 1
mov dword [ebx + 0x58], eax
mov ecx, dword [edx]
mov dword [edx + 0x40], 1
mov dword [ebx + 4], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 8], ecx
mov ecx, dword [edx + 8]
mov dword [ebx + 0xc], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebx + 0x10], ecx
mov ecx, dword [edx + 0x10]
mov dword [ebx + 0x14], ecx
mov ecx, dword [edx + 0x14]
mov dword [ebx + 0x18], ecx
mov ecx, dword [edx + 0x18]
mov dword [ebx + 0x1c], ecx
mov ecx, dword [edx + 0x1c]
mov dword [ebx + 0x20], ecx
lea ecx, [edx + 0x20]
mov edx, dword [edx + 0x20]
mov dword [ebx + 0x24], edx
mov edx, dword [ecx + 4]
mov dword [ebx + 0x28], edx
mov edx, dword [ecx + 8]
mov dword [ebx + 0x2c], edx
mov edx, dword [ecx + 0xc]
mov dword [ebx + 0x30], edx
mov edx, dword [ecx + 0x10]
mov dword [ebx + 0x34], edx
mov edx, dword [ecx + 0x14]
mov dword [ebx + 0x38], edx
mov edx, dword [ecx + 0x18]
mov dword [ebx + 0x3c], edx
mov edx, dword [ecx + 0x1c]
mov dword [ebx + 0x40], edx
jmp 0x41930f
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x7c]
lea edx, [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 4], edx
mov dword [esp], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
call fcn.00aaa0d0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x2c], eax
js 0x41930f
mov eax, dword [ebp + 0x3c]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0xc], edi
mov dword [esp + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 8], ebp
call fcn.00414800
test eax, eax
mov ebx, eax
je 0x419332
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebx]
mov dword [eax + 0x44], esi
mov dword [eax + 0x48], 0
add esp, 0x5c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x84
call fcn.00aa0290
mov ecx, dword [ebp + 0x3c]
mov esi, eax
mov dword [ebp + 0x6c], eax
jmp 0x419274
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.00aa0240
jmp 0x41930f
Function at 0x474a40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
mov dword [esp + 4], esi
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [esp], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], edi
mov eax, dword [esp + 0x10]
mov edi, dword [esi + 0x3c]
mov esi, dword [esi + 0x38]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 8]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 4]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp]
add esp, 0xc
jmp fcn.00469190

Function at 0x479640
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x1320864]
test eax, eax
je 0x479675
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.DLL_WSAStartup
sub esp, 8
test eax, eax
sete al
add esp, 0x1ac
movzx eax, al
ret
mov dword [esp + 8], str.Using_network_protocols_without_global_network_initialization._Please_use_avformat_network_init____this_will_become_mandatory_later._n
mov dword [esp + 4], 0x18
mov dword [esp], 0
call fcn.00aa0010
jmp 0x47964f
Function at 0x47cb20
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x34], edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x38], ebp
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x30], esi
mov dword [esp], str.ws2_32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.getaddrinfo
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x47cb95
mov edx, dword [esp + 0x44]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp], ebp
mov dword [esp + 4], edx
call eax
sub esp, 0x10
mov esi, eax
mov eax, esi
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov dword [edi], 0
mov esi, 0x2afb
mov dword [esp], 0x10
call fcn.00aa0290
test eax, eax
mov edx, eax
je 0x47cb7f
test ebp, ebp
mov word [eax], 2
je 0x47ccf3
lea eax, [eax + 4]
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.0047ca50
mov edx, dword [esp + 0x18]
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x47cc18
test ebx, ebx
je 0x47cbef
test byte [ebx], 4
jne 0x47ccd0
mov dword [esp + 0x18], edx
mov dword [esp], ebp
call sub.WS2_32.DLL_gethostbyname
sub esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
je 0x47cd51
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [edx + 4], eax
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x47cc46
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x18], edx
mov dword [esp], ecx
call sub.msvcrt.dll_atoi
movzx eax, ax
mov dword [esp], eax
call sub.WS2_32.DLL_htons
sub esp, 4
mov edx, dword [esp + 0x18]
mov word [edx + 2], ax
mov dword [esp + 0x18], edx
mov dword [esp], 0x20
call fcn.00aa0290
mov edx, dword [esp + 0x18]
test eax, eax
mov esi, eax
je 0x47cd40
test ebx, ebx
mov dword [edi], eax
mov dword [eax + 4], 2
je 0x47cd34
mov eax, dword [ebx + 8]
cmp eax, 1
mov dword [esi + 8], eax
je 0x47cd10
cmp eax, 2
je 0x47cce0
test ebx, ebx
mov dword [esi + 0xc], 0
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], 0x10
je 0x47ccbe
test byte [ebx], 2
je 0x47ccbe
mov edx, dword [esp + 0x1c]
xor eax, eax
test edx, edx
je 0x47ccbb
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov dword [esp], eax
call fcn.00aa0350
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], 0
xor esi, esi
jmp 0x47cb7f
mov dword [esp], edx
call fcn.00aa0240
jmp 0x47cb7f
mov dword [esi + 0xc], 0x11
mov dword [esi + 0x18], edx
mov dword [esi + 0x10], 0x10
jmp 0x47cc9e
test ebx, ebx
je 0x47cd20
test byte [ebx], 1
je 0x47cd20
mov dword [eax + 4], 0
mov dword [esp + 0x1c], 0
jmp 0x47cc18
mov dword [esi + 0xc], 6
jmp 0x47cce7
mov dword [edx + 4], 0x7f000001
mov dword [esp + 0x1c], 0
jmp 0x47cc18
mov dword [eax + 8], 0
jmp 0x47cc89
mov dword [esp], edx
mov si, 0x2afb
call fcn.00aa0240
jmp 0x47cb7f
mov dword [esp], edx
mov esi, 0x2afb
call fcn.00aa0240
jmp 0x47cb7f
Function at 0x8a2b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], 0x20
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], 1
jmp fcn.008a1230

Function at 0x8a2b50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 4], 0x20
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp fcn.008a1230
Function at 0x911770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x68]
mov edx, dword [eax + 0x205c]
mov ebp, dword [eax + 0x2068]
mov dword [esp + 0x50], esi
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0x2134]
mov ecx, ebp
and ecx, 1
lea esi, [ecx + ecx]
add ecx, 1
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0x2084]
sar edi, cl
add esi, 1
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0x2088]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x64]
sar edx, cl
mov ecx, dword [eax + ebx*4 + 0x147c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + ebx*4 + 0x1478]
mov dword [esp + 8], ebx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x68]
and ecx, esi
and esi, dword [esp + 0x64]
mov dword [esp + 4], ecx
mov ecx, edi
mov dword [esp], esi
call fcn.008fe170
mov ecx, dword [esp + 0x7c]
test ecx, ecx
je 0x911852
test ebx, ebx
jle 0x911866
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x64]
sub edx, dword [esp + 0x38]
movzx ecx, byte [ebx + edx]
mov edx, dword [esp + 0x68]
sub edx, dword [esp + 0x3c]
movzx edx, byte [ebx + edx]
add edx, ecx
imul edx, dword [esp + 0x34]
add eax, edx
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
mov ebx, dword [esp + 0x68]
or ebx, dword [esp + 0x64]
jne 0x91182d
jmp 0x911852
Function at 0xaa3c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
xor ecx, ecx
mov dword [esp + 0x64], edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x68], ebp
mov ebp, dword [esp + 0x74]
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], esi
mov eax, edi
mov edx, ebp
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00aa21f0
xor ecx, ecx
test eax, eax
mov ebx, eax
je 0xaa3c60
mov ecx, dword [eax + 0x2c]
mov edx, dword [esp + 0x78]
mov eax, edi
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00aa21f0
test eax, eax
mov esi, eax
je 0xaa3ca5
test ebx, ebx
je 0xaa3ca5
xor ebx, ebx
cmp dword [eax + 0xc], 0x80
je 0xaa3cb0
mov eax, ebx
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x5c]
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
add esp, 0x6c
ret
xor ebx, ebx
jmp 0xaa3c8f
lea eax, [esp + 0x4c]
xor ecx, ecx
mov dword [esp + 4], eax
fld1
mov edx, ebp
mov eax, edi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0
fstp qword [esp + 0x40]
mov dword [esp + 0x48], 1
mov dword [esp], 0
call fcn.00aa21f0
test eax, eax
je 0xaa3c8f
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0xaa3c8f
add ecx, dword [eax + 8]
lea edx, [eax + 0x10]
mov eax, dword [eax + 0xc]
lea edi, [esp + 0x38]
mov dword [esp + 8], edi
lea edi, [esp + 0x48]
mov dword [esp + 4], edi
lea edi, [esp + 0x40]
mov dword [esp], edi
call fcn.00aa20f0
test eax, eax
js 0xaa3c8f
fld qword [esp + 0x40]
fild qword [esp + 0x38]
fnstcw word [esp + 0x26]
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fmulp st(1)
movzx eax, word [esp + 0x26]
mov ah, 0xc
fild dword [esp + 0x48]
mov word [esp + 0x24], ax
fdivp st(1)
fldcw word [esp + 0x24]
fistp qword [esp + 0x18]
fldcw word [esp + 0x26]
mov eax, dword [esp + 0x18]
fld qword [esi + 0x10]
fldcw word [esp + 0x24]
fistp dword [esp + 0x20]
fldcw word [esp + 0x26]
mov ebx, dword [esp + 0x20]
and ebx, eax
jmp 0xaa3c8f
Function at 0xaa5c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x68
fld qword [esp + 0x70]
fld st(0)
fxam
wait
fnstsw ax
fstp st(0)
and eax, 0x4500
cmp eax, 0x100
je 0xaa5d36
fst qword [esp]
fstp qword [esp + 0x20]
call fcn.00de4370
cmp eax, 0x500
fld qword [esp + 0x20]
je 0xaa5d20
fld st(0)
fabs
fld xword [0x1135ed0]
faddp st(1)
fstp qword [esp]
fstp qword [esp + 0x20]
call sub.msvcrt.dll_log
mov edx, 0
mov ecx, 0x3d
fldln2
fdivp st(1)
fnstcw word [esp + 0x46]
movzx eax, word [esp + 0x46]
mov ah, 0xc
mov word [esp + 0x44], ax
fldcw word [esp + 0x44]
fistp dword [esp + 0x40]
fldcw word [esp + 0x46]
mov eax, dword [esp + 0x40]
test eax, eax
cmovs eax, edx
xor edx, edx
sub ecx, eax
xor eax, eax
test cl, 0x20
sete al
setne dl
shl edx, cl
shl eax, cl
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
fild qword [esp + 0x38]
mov ebx, ecx
mov dword [esp + 0x10], eax
sar ebx, 0x1f
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
lea eax, [esp + 0x58]
fld qword [esp + 0x20]
fmulp st(1)
mov dword [esp + 0x14], edx
lea edx, [esp + 0x5c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 4], edx
fadd dword [0x1135edc]
mov dword [esp + 0x18], ecx
mov dword [esp], eax
fldcw word [esp + 0x44]
fistp qword [esp + 8]
fldcw word [esp + 0x46]
call fcn.00aa5440
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
add esp, 0x68
pop ebx
ret
fldz
xor eax, eax
fucompi st(1)
fstp st(0)
setbe al
add esp, 0x68
lea eax, [eax + eax - 1]
xor edx, edx
pop ebx
ret
fstp st(0)
add esp, 0x68
xor ax, ax
xor edx, edx
pop ebx
ret
Function at 0xaac840
Capabilities:
Encode data using base64

Disassembly:
push ebp
xor ecx, ecx
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
cmp esi, 0x3ffffffe
ja 0xaac909
lea edi, [esi + 2]
mov edx, 0x55555556
mov eax, edi
imul edx
sar edi, 0x1f
sub edx, edi
shl edx, 2
cmp edx, dword [esp + 0x20]
jge 0xaac909
test esi, esi
mov eax, dword [esp + 0x1c]
je 0xaac902
mov edx, esi
xor edi, edi
jmp 0xaac897
mov edx, dword [esp]
test edx, edx
je 0xaac8e4
movzx esi, byte [ebx]
shl edi, 8
add ebx, 1
add ecx, 8
add edi, esi
mov esi, edi
shl esi, 6
sub edx, 1
sete byte [esp + 7]
mov dword [esp], edx
mov ebp, esi
shr ebp, cl
sub ecx, 6
and ebp, 0x3f
movzx ebp, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edx, ebp
mov byte [eax], dl
add eax, 1
cmp ecx, 6
jg 0xaac8b5
test ecx, ecx
jle 0xaac890
cmp byte [esp + 7], 0
jne 0xaac8b5
mov edx, dword [esp]
test edx, edx
jne 0xaac897
mov edx, eax
sub edx, dword [esp + 0x1c]
and edx, 3
je 0xaac902
mov ecx, dword [esp + 0x1c]
mov byte [eax], 0x3d
add eax, 1
mov edx, eax
sub edx, ecx
and edx, 3
jne 0xaac8f3
mov ecx, dword [esp + 0x1c]
mov byte [eax], 0
add esp, 8
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xc13f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
cmp edi, dword [0x1765a64]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
je 0xc14040
call fcn.00c140a0
test eax, eax
mov ebx, eax
je 0xc13fc0
test edi, edi
nop
je 0xc13fad
test ebx, ebx
je 0xc13f90
mov eax, dword [edi + 4]
test eax, eax
je 0xc13f90
mov eax, dword [ebp + 0xc]
test eax, eax
je 0xc13f90
lea esi, [edi + 8]
mov dword [esp], esi
call fcn.00c13b40
test eax, eax
jne 0xc13f87
lea eax, [ebx + 0x28]
mov dword [ebp - 0x14], eax
mov dword [esp], eax
call fcn.00c13b40
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0xc13f77
jmp 0xc13fc7
mov eax, dword [eax + 8]
test eax, eax
je 0xc13fc7
cmp dword [eax + 4], edi
jne 0xc13f70
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00c14250
mov dword [esp], esi
call fcn.00c14250
nop
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
mov edx, 0xb
sub esp, 8
test eax, eax
je 0xc13faf
xor edx, edx
mov ebx, dword [ebp - 0xc]
mov eax, edx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, 2
jmp 0xc13faf
mov dword [esp + 4], 0x18
mov dword [esp], 1
call sub.msvcrt.dll_calloc
test eax, eax
je 0xc1401d
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 0x14], 0
mov edx, dword [edi + 0xc]
test edx, edx
mov dword [eax + 0xc], edx
je 0xc13ff8
mov dword [edx + 0x14], eax
mov dword [edi + 0xc], eax
mov dword [eax + 0x10], 0
mov edx, dword [ebx + 0x84]
test edx, edx
mov dword [eax + 8], edx
je 0xc14012
mov dword [edx + 0x10], eax
mov dword [ebx + 0x84], eax
jmp 0xc13f7c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00c14250
mov dword [esp], esi
call fcn.00c14250
mov edx, 0xc
jmp 0xc13faf
test edi, edi
jne 0xc14059
mov eax, dword [ebp + 0xc]
test eax, eax
je 0xc13fc0
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
jmp 0xc13f2d
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
mov eax, dword [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov dword [esp], esi
call sub.WS2_32.DLL_WSASetLastError
mov eax, dword [ebp - 0x10]
sub esp, 4
test eax, eax
je 0xc14044
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 8]
jmp 0xc13f32
Function at 0xc140a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], edi
mov edi, dword [0x1765a64]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], 0
test edi, edi
mov dword [ebp - 0x1c], 0
je 0xc14125
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
mov eax, dword [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov edi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_SetLastError
sub esp, 4
mov dword [esp], esi
call sub.WS2_32.DLL_WSASetLastError
sub esp, 4
test edi, edi
je 0xc14125
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x18], eax
mov edi, dword [edi + 8]
mov ecx, dword [ebp - 0x18]
mov eax, edi
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00c13590
test eax, eax
mov edi, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], edx
je 0xc14107
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
or byte [edi + 0x80], 1
mov dword [edi + 0x24], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [edi], eax
call sub.KERNEL32.dll_GetCurrentProcess
mov esi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcess
lea edx, [edi + 4]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
jne 0xc14210
mov dword [esp], 0x17e1820
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov esi, dword [edi + 8]
sub esp, 4
mov dword [esp + 8], 0x8c
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [edi + 0xc], ebx
add dword [edi + 0xc], 1
mov dword [edi + 8], esi
mov dword [edi + 0x10], 1
mov eax, dword [0xe66ed4]
cmp eax, 1
je 0xc1423a
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], 0x17e1820
mov dword [0xe66ed4], edx
call sub.KERNEL32.dll_LeaveCriticalSection
xor eax, eax
xor ecx, ecx
sub esp, 4
jmp 0xc1410c
mov eax, dword [edi + 4]
mov dword [esp], eax
call sub.KERNEL32.dll_GetThreadPriority
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp + 4], eax
mov eax, dword [0x1765a64]
mov dword [esp], eax
call fcn.00c13f00
jmp 0xc14107
mov eax, dword [ebp - 0x28]
mov dword [0xe66ed0], eax
jmp 0xc141ee
Function at 0xc16280
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov eax, 1
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [0x1765a60]
test edx, edx
je 0xc162a0
mov ebx, dword [ebp - 4]
leave
ret
mov dword [0x1765a60], 1
mov dword [esp + 4], 0x10
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test ebx, ebx
je 0xc16316
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx], eax
add eax, 1
je 0xc1630c
mov dword [0x1765a64], ebx
mov dword [esp + 4], 0x10
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebx, eax
test ebx, ebx
je 0xc1638e
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx], eax
add eax, 1
je 0xc16384
mov dword [0x1765a68], ebx
jmp 0xc16320
mov dword [esp], ebx
call fcn.00ded778
xor eax, eax
mov dword [0x1765a64], eax
call fcn.00c16190
mov dword [esp], 0x17e1820
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], 0x17e1800
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], 0x17e17a0
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], 0x17e17c0
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], 0x17e17e0
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], 0x17e1780
call sub.KERNEL32.dll_InitializeCriticalSection
mov eax, dword [0x1765a60]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
mov dword [esp], ebx
call fcn.00ded778
xor eax, eax
mov dword [0x1765a68], eax
jmp 0xc1631b
Function at 0xc17600
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
test eax, eax
mov dword [edx + 4], 0
mov dword [ebp - 0x20], 0
je 0xc17634
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
call fcn.00c13590
test eax, eax
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
je 0xc17790
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0xc17792
mov dword [eax + 4], esi
mov dword [eax], ebx
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0x14]
mov dword [edi + 0xc], eax
mov ecx, dword [ebp - 0x20]
xor eax, eax
test ecx, ecx
je 0xc176ac
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xc]
mov ebx, dword [edx + 8]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
mov edx, dword [edx + 0x14]
mov eax, ebx
test edx, edx
je 0xc177a0
mov edx, dword [ebp - 0x24]
mov esi, 0xb
mov dword [edx + 0x14], 0
mov dword [edx + 0x84], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0xc192c0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.msvcrt.dll__beginthreadex
mov ebx, eax
mov eax, dword [ebp - 0x24]
test ebx, ebx
mov dword [eax + 4], ebx
jne 0xc17730
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00c17320
test edi, edi
je 0xc17723
mov dword [esp], edi
call fcn.00ded778
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x20]
test eax, eax
je 0xc177b2
mov edx, dword [ebp - 0x14]
xor si, si
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00c14f10
mov dword [esp], ebx
call sub.KERNEL32.dll_ResumeThread
sub esp, 4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
mov esi, 0xb
jmp 0xc176f9
call fcn.00c140a0
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, ebx
jmp 0xc176ac
mov dword [esp], ebx
xor esi, esi
call sub.KERNEL32.dll_ResumeThread
sub esp, 4
jmp 0xc17772