joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004100
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x100041ea
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1000417d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.100038c0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10004143
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x100042b3
call fcn.1000418f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1000424a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.10003ce0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100041fb
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x100042b3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.10003ce0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100042ae
jmp 0x100042b3
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100048b0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x100048d0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x10008720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000873e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x10008780
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000879e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x100087e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10008802
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x10008860
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10008882
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x100088e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000890a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x10008970
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000899a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x10008a00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x10008a5f

Function at 0x10008a6e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10008a50
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x10008ae0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x10008b3f

Function at 0x10008b4e
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10008b30
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x1000b1c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x1000b6e0
test edx, edx
je 0x1000b6e0
call fcn.1000b1d7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x1000b720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.1000b1c0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x1000b791
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x1000b756
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x1000c0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x1000c124
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x1000c0fc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x1000c104
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.1000c129
Function at 0x1004f0d0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x102c6944], 2
push esi
push edi
mov edi, 1
je 0x1004f127
mov edx, 0x102c6944
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x1004f101
cmp eax, 1
je 0x1004f0e5
cmp dword [0x102c6944], 2
jne 0x1004f141
jmp 0x1004f127
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x1004f010
push 0
push 0
mov dword [0x102c6940], eax
call fcn.10056060
add esp, 0xc
mov dword [0x102c6944], 2
push 0x97
push str.crypto_threads_win.c
push 0x34
call fcn.10050320
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1004f146
pop edi
xor eax, eax
pop esi
ret
push ebx
push ebp
call fcn.10056530
mov dword [esi + 0x20], eax
call fcn.10056270
mov dword [esi + 0x28], eax
call fcn.10056270
mov dword [esi + 0x30], eax
lea ebp, [esi + 0x24]
call fcn.10056530
mov dword [ebp], eax
lea ebx, [esi + 0x2c]
call fcn.10056530
cmp dword [esp + 0x14], edi
push 0x85
cmovge edi, dword [esp + 0x18]
inc edi
mov dword [ebx], eax
push str.crypto_threads_win.c
lea eax, [edi*8]
push eax
call fcn.10050320
add esp, 0xc
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
lea edi, [esi + 0x20]
test eax, eax
je 0x1004f1c2
cmp dword [esi + 0x28], 0
je 0x1004f1c2
cmp dword [esi + 0x30], 0
je 0x1004f1c2
cmp dword [edi], 0
je 0x1004f1c2
cmp dword [ebp], 0
je 0x1004f1c2
cmp dword [ebx], 0
jne 0x1004f20b
push 0xa8
push str.crypto_threads_win.c
push eax
call fcn.10050120
lea eax, [esi + 0x28]
push eax
call fcn.10056210
lea eax, [esi + 0x30]
push eax
call fcn.10056210
push ebp
call fcn.100564f0
push ebx
call fcn.100564f0
push edi
call fcn.100564f0
push 0xae
push str.crypto_threads_win.c
push esi
call fcn.10050120
add esp, 0x2c
xor esi, esi
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x1004f220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x10
call fcn.101fe2f0
push ebx
push ebp
or ebp, 0xffffffff
push esi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x102c6940]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1004f29b
push 0xdd
push str.crypto_threads_win.c
push 0x78
call fcn.10050320
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x1004f28e
push 0xde
push str.crypto_threads_win.c
push str.assertion_failed:_data___NULL
call fcn.10055680
add esp, 0xc
push ebx
push dword [0x102c6940]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x20]
xor ecx, ecx
mov eax, ebx
cmp dword [eax], 0
jne 0x1004f2b2
cmp ebp, 0xffffffff
cmove ebp, ecx
mov dword [esp + 0x10], ebp
cmp dword [eax + 8], edx
je 0x1004f381
inc ecx
add eax, 0xc
cmp ecx, 0xa
jl 0x1004f2a3
lea ebx, [edx + 0x14]
mov dword [esp + 0xc], ebx
push edi
nop dword [eax]
xor esi, esi
mov eax, dword [ebx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [ebx], ecx
jne 0x1004f2d4
mov ebp, dword [edx + 8]
mov dword [esp + 0x1c], eax
shl eax, 3
add ebp, eax
nop word [eax + eax]
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
add ebx, 1
mov ecx, edi
mov eax, esi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x1004f2f0
cmp edx, edi
jne 0x1004f2f0
mov edx, dword [esp + 0x10]
xor esi, esi
mov eax, dword [edx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x1004f319
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov edx, dword [esi + 8]
cmp edi, eax
je 0x1004f363
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov ebx, edi
mov esi, dword [ebp + 4]
sub ebx, 1
mov ecx, esi
mov eax, edi
sbb ecx, 0
mov edx, esi
lock cmpxchg8b qword [ebp]
cmp eax, edi
jne 0x1004f335
cmp edx, esi
jne 0x1004f335
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
jmp 0x1004f2d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
lea eax, [edx + edi*8]
mov dword [ecx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1004f390
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 8
call fcn.101fe2f0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x102c6940]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x14]
lea edx, [edi + 8]
xor ecx, ecx
cmp dword [edx], esi
je 0x1004f3d5
inc ecx
add edx, 0xc
cmp ecx, 0xa
jl 0x1004f3c2
pop edi
pop esi
add esp, 8
ret
lea eax, [ecx + ecx*2]
add dword [edi + eax*4 + 4], 0xffffffff
push ebx
lea ebx, [edi + eax*4]
jne 0x1004f454
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
push ebp
nop word [eax + eax]
mov esi, dword [eax]
mov ebp, esi
mov edi, dword [eax + 4]
sub ebp, 1
mov ecx, edi
mov dword [esp + 0x14], edi
mov edx, edi
sbb ecx, 0
mov edi, dword [esp + 0x10]
mov eax, esi
push ebx
mov ebx, ebp
lock cmpxchg8b qword [edi]
mov ebp, ebx
pop ebx
mov edi, dword [esp + 0x14]
cmp eax, esi
mov eax, dword [esp + 0x10]
jne 0x1004f3f0
cmp edx, edi
jne 0x1004f3f0
test ecx, ecx
jg 0x1004f446
jl 0x1004f42f
test ebp, ebp
jae 0x1004f446
push 0x10b
push str.crypto_threads_win.c
push str.assertion_failed:_ret___0
call fcn.10055680
add esp, 0xc
mov dword [ebx], 0
mov dword [ebx + 8], 0
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret

Function at 0x10050420
Capabilities:
Initialize winsock library

Disassembly:
cmp dword [0x102c6948], 0
jne 0x100504b9
push 0x190
push 0
push 0x102c6950
mov dword [0x102c6948], 1
call fcn.101ff800
add esp, 0xc
push 0x102c6950
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100504b9
call fcn.10050630
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.10050730
add esp, 0xc
push str.calling_wsastartup__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10050840
call fcn.10050630
push str.BIO_sock_init
push 0x98
push str.crypto_bio_bio_sock.c
call fcn.10050730
push 0
push 0x7a
push 0x20
call fcn.10050840
add esp, 0x24
or eax, 0xffffffff
ret
mov eax, 1
ret

Function at 0x100504c0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x10050515
call fcn.10050630
push str.BIO_socket_ioctl
push 0xf4
push str.crypto_bio_bio_sock.c
call fcn.10050730
add esp, 0xc
push str.calling_ioctlsocket__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10050840
add esp, 0xc
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x10050520
Capabilities:
Get socket status

Disassembly:
mov eax, 0x110
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
mov ebx, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x11c]
cmp edi, 0xffffffff
jne 0x10050566
or eax, edi
pop edi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x110
ret
push esi
mov esi, dword [esp + 0x128]
test esi, esi
jne 0x1005058d
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x110
ret
push 0
call fcn.1020366d
add esp, 4
cmp esi, eax
jge 0x100505b5
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x110
ret
sub esi, eax
mov dword [esp + 0x18], edi
xor ecx, ecx
mov dword [esp + 0x14], 1
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0
push eax
test ebx, ebx
mov dword [esp + 0x10], esi
push 0
lea eax, [esp + 0x1c]
cmovne eax, ecx
test ebx, ebx
push eax
lea eax, [esp + 0x20]
cmove eax, ecx
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [esp + 0x118]
pop esi
pop edi
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0x110
ret
Function at 0x100527c0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x230
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x102c6c08], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x100521c0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x10052570
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x10052170
jne 0x10052926
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1005291c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.10203bd4
push str.ws2_32
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.10203c2e
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x40]
add esp, 0x18
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x1005288f
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x100528d6
push edi
call ebp
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.10203bd4
push str.wship6
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.10203c2e
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call esi
mov edi, eax
test edi, edi
je 0x10052918
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x10052915
xor esi, esi
lea eax, [esp + 0x10]
nop dword [eax]
push dword [eax + esi*8]
push edi
call ebx
mov dword [esp + esi*8 + 0x14], eax
test eax, eax
je 0x10052915
inc esi
lea eax, [esp + 0x10]
cmp esi, 3
jl 0x100528e0
mov eax, dword [esp + 0x14]
mov dword [0x102c12c0], eax
mov eax, dword [esp + 0x1c]
mov dword [0x102c12c8], eax
mov eax, dword [esp + 0x24]
mov dword [0x102c12d0], eax
jmp 0x10052918
push edi
call ebp
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x102c6c08], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
mov eax, dword [eax*8 + 0x102c12c0]
call fcn.101fdd0b
add esp, 0x230
ret 4