joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x10065e9d
cmp eax, 1
jne 0x10065fc8
cmp dword [esi + 4], 0
je 0x10065f1c
mov eax, dword [esi + 8]
cmp eax, 2
je 0x10065fc8
add esi, 0xc
test eax, eax
je 0x10065f8a
mov edi, dword [esi]
mov eax, dword [edi]
test eax, eax
je 0x10065fa3
mov ecx, dword [edi + 4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x10065fa3
mov edi, dword [edi]
cmp dword [eax + 8], 9
jae 0x10065f93
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065f9b
cmp dword [esi + 0xb0], 2
je 0x10065fc8
lea ecx, [esi + 8]
cmp dword [ecx], 3
je 0x10065eb7
call fcn.10065fd0
lea ecx, [esi + 0x88]
call fcn.10066080
mov eax, dword [esi + 0xa4]
test eax, eax
je 0x10065edc
lock dec dword [eax]
jne 0x10065edc
lea ecx, [esi + 0xa4]
call fcn.10061d70
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x10065ef6
lock dec dword [eax]
jne 0x10065ef6
lea ecx, [esi + 0xa8]
call fcn.10116ed0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x10065fc8
lock dec dword [eax]
jne 0x10065fc8
add esi, 0xd4
mov ecx, esi
pop esi
pop edi
jmp fcn.10116ed0
mov edi, dword [esi + 8]
cmp dword [edi], 3
je 0x10065fb7
mov ecx, edi
call fcn.10066240
mov eax, dword [edi + 0x1c0]
test eax, eax
je 0x10065f49
lock dec dword [eax]
jne 0x10065f49
lea ecx, [edi + 0x1c0]
call fcn.10061d70
lea ecx, [edi + 0x1c4]
call fcn.10066080
mov eax, dword [edi + 0x1e0]
test eax, eax
je 0x10065fb7
mov ecx, dword [edi + 0x1e4]
push eax
call dword [ecx]
add esp, 4
mov eax, dword [edi + 0x1e4]
cmp dword [eax + 4], 0
je 0x10065fb7
mov edi, dword [edi + 0x1e0]
cmp dword [eax + 8], 9
jae 0x10065fa7
call sub.KERNEL32.dll_GetProcessHeap
push edi
jmp 0x10065faf
mov ecx, esi
pop esi
pop edi
jmp fcn.1005fbd0
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi]
jmp 0x10065fba
call sub.KERNEL32.dll_GetProcessHeap
push dword [edi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov esi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
ret
Function at 0x1006f2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
cmp eax, 1
je 0x1006f2e9
test eax, eax
jne 0x1006f38c
cmp dword [esi + 0x10], 3
je 0x1006f38c
add esi, 4
mov ecx, esi
pop esi
pop edi
jmp fcn.1005fbd0
cmp dword [esi + 4], 0
je 0x1006f38c
mov edi, dword [esi + 8]
test edi, edi
je 0x1006f38c
mov eax, dword [0x10551f24]
test eax, eax
jne 0x1006f325
mov ecx, 0x103a03b9
mov edx, 0x17
call fcn.100f2fc0
test eax, eax
mov eax, 0x100f3390
cmovne eax, edx
mov dword [0x10551f24], eax
cmp eax, 0x100f3390
jne 0x1006f346
mov edi, dword [edi]
test edi, edi
je 0x1006f346
push edi
call sub.KERNEL32.dll_DeleteCriticalSection
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x14]
push dword [esi + 0x10]
call dword [eax]
add esp, 4
mov eax, dword [esi + 0x14]
cmp dword [eax + 4], 0
je 0x1006f38c
mov esi, dword [esi + 0x10]
cmp dword [eax + 8], 9
jae 0x1006f37c
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x1006f384
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
ret
Function at 0x10070f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
cmp eax, 1
je 0x10070f37
test eax, eax
jne 0x10070fda
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
add eax, 0xfffffffd
adc ecx, 0xffffffff
cmp eax, 2
sbb ecx, 0
jb 0x10070fda
add esi, 8
mov ecx, esi
pop esi
pop edi
jmp fcn.10065b00
cmp dword [esi + 4], 0
je 0x10070fda
mov edi, dword [esi + 8]
test edi, edi
je 0x10070fda
mov eax, dword [0x10551f24]
test eax, eax
jne 0x10070f73
mov ecx, 0x103a03b9
mov edx, 0x17
call fcn.100f2fc0
test eax, eax
mov eax, 0x100f3390
cmovne eax, edx
mov dword [0x10551f24], eax
cmp eax, 0x100f3390
jne 0x10070f94
mov edi, dword [edi]
test edi, edi
je 0x10070f94
push edi
call sub.KERNEL32.dll_DeleteCriticalSection
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov edi, dword [esi + 8]
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x14]
push dword [esi + 0x10]
call dword [eax]
add esp, 4
mov eax, dword [esi + 0x14]
cmp dword [eax + 4], 0
je 0x10070fda
mov esi, dword [esi + 0x10]
cmp dword [eax + 8], 9
jae 0x10070fca
call sub.KERNEL32.dll_GetProcessHeap
push esi
jmp 0x10070fd2
call sub.KERNEL32.dll_GetProcessHeap
push dword [esi - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
pop esi
pop edi
ret
Function at 0x100cd0d0
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 0x28]
cmp edx, ecx
jb 0x100cd2fb
mov eax, dword [edi + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 4
lea ecx, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, esp
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], eax
lea eax, [edi + 0x4c]
push 0
push 0
push ecx
push eax
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x100cd240
cmp eax, 0x80090318
je 0x100cd2d1
test eax, eax
jne 0x100cd2c2
mov ecx, dword [esp + 0x14]
mov ebp, dword [edi + 0x20]
mov ebx, dword [esp + 0xc]
mov edx, dword [edi + 0x28]
mov dword [edi + 0x10], 0
sub ecx, ebp
mov eax, ecx
add eax, ebx
jb 0x100cd32a
cmp edx, eax
jb 0x100cd33b
lea eax, [edi + 8]
add ebp, ecx
mov edx, ebx
mov ecx, eax
call fcn.10116f60
mov eax, dword [edi + 8]
add eax, dword [edi + 0x10]
push ebx
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0x10], ebx
mov dword [edi + 4], 0
mov dword [edi], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0x18]
jne 0x100cd1f1
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cd30a
test ebx, ebx
je 0x100cd22a
mov edx, dword [edi + 0x28]
mov ebp, edx
sub ebp, ecx
jb 0x100cd323
mov dword [edi + 0x28], 0
je 0x100cd22a
test ecx, ecx
je 0x100cd227
mov eax, dword [edi + 0x20]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x28], ebp
xor eax, eax
test ebx, ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], 0
sete al
jmp 0x100cd2e1
cmp eax, 0x90317
je 0x100cd2ee
cmp eax, 0x90321
jne 0x100cd2c2
mov dword [edi + 0x9c], 0x10000
mov byte [edi + 0xa0], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0x18]
jne 0x100cd273
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cd30a
test ebx, ebx
je 0x100cd2ac
mov edx, dword [edi + 0x28]
mov ebp, edx
sub ebp, ecx
jb 0x100cd323
mov dword [edi + 0x28], 0
je 0x100cd2ac
test ecx, ecx
je 0x100cd2a9
mov eax, dword [edi + 0x20]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x28], ebp
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], 0
mov dword [edi + 0xb4], 0
jmp 0x100cd2e7
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov byte [esi], 1
jmp 0x100cd2f3
cmp dword [esp + 0x10], 4
mov eax, 1
jne 0x100cd2e1
mov eax, dword [esp + 0xc]
mov dword [edi + 0xb4], eax
mov word [esi], 0
jmp 0x100cd2f3
mov word [esi], 0x100
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x103c9be4
call fcn.10008b80
add esp, 4
ud2
mov ecx, str.assertion_failed:_size___nread
mov edx, 0x1f
push 0x103c9c24
call fcn.1004d820
add esp, 4
ud2
push 0x103c9c34
jmp 0x100cd300
mov edx, eax
push 0x103c9bf4
call fcn.10009f50
add esp, 4
ud2
mov ecx, eax
push 0x103c9bf4
jmp 0x100cd300
Function at 0x100ced20
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xf8]
mov edx, dword [edx + 0x108]
cmp edx, ecx
jb 0x100cefa1
mov eax, dword [edi + 0x100]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 4
lea ecx, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, esp
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], eax
lea eax, [edi + 0x12c]
push 0
push 0
push ecx
push eax
call sub.Secur32.dll_DecryptMessage
cmp eax, 0x90316
jg 0x100ceecd
cmp eax, 0x80090318
je 0x100cef77
test eax, eax
jne 0x100cef68
mov ecx, dword [esp + 0x14]
mov ebp, dword [edi + 0x100]
mov ebx, dword [esp + 0xc]
mov edx, dword [edi + 0x108]
mov dword [edi + 0xf0], 0
sub ecx, ebp
mov eax, ecx
add eax, ebx
jb 0x100cefd0
cmp edx, eax
jb 0x100cefe1
lea eax, [edi + 0xe8]
add ebp, ecx
mov edx, ebx
mov ecx, eax
call fcn.10116f60
mov eax, dword [edi + 0xe8]
add eax, dword [edi + 0xf0]
push ebx
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [edi + 0xf0], ebx
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0xf8]
jne 0x100cee6c
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cefb0
test ebx, ebx
je 0x100ceeb1
mov edx, dword [edi + 0x108]
mov ebp, edx
sub ebp, ecx
jb 0x100cefc9
mov dword [edi + 0x108], 0
je 0x100ceeb1
test ecx, ecx
je 0x100ceeab
mov eax, dword [edi + 0x100]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x108], ebp
xor eax, eax
test ebx, ebx
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], 0
sete al
jmp 0x100cef87
cmp eax, 0x90317
je 0x100cef94
cmp eax, 0x90321
jne 0x100cef68
mov dword [edi + 0x150], 0x10000
mov byte [edi + 0x154], 0
xor ebx, ebx
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0xf8]
jne 0x100cef07
mov ebx, dword [esp + 0x24]
sub ecx, ebx
jb 0x100cefb0
test ebx, ebx
je 0x100cef4c
mov edx, dword [edi + 0x108]
mov ebp, edx
sub ebp, ecx
jb 0x100cefc9
mov dword [edi + 0x108], 0
je 0x100cef4c
test ecx, ecx
je 0x100cef46
mov eax, dword [edi + 0x100]
add ecx, eax
push ebp
push ecx
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [edi + 0x108], ebp
mov dword [edi + 0xf8], ebx
mov dword [edi + 0xfc], 0
mov dword [edi + 0x168], 0
jmp 0x100cef8d
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov byte [esi], 1
jmp 0x100cef99
cmp dword [esp + 0x10], 4
mov eax, 1
jne 0x100cef87
mov eax, dword [esp + 0xc]
mov dword [edi + 0x168], eax
mov word [esi], 0
jmp 0x100cef99
mov word [esi], 0x100
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x103c9be4
call fcn.10008b80
add esp, 4
ud2
mov ecx, str.assertion_failed:_size___nread
mov edx, 0x1f
push 0x103c9c24
call fcn.1004d820
add esp, 4
ud2
push 0x103c9c34
jmp 0x100cefa6
mov edx, eax
push 0x103c9bf4
call fcn.10009f50
add esp, 4
ud2
mov ecx, eax
push 0x103c9bf4
jmp 0x100cefa6
Function at 0x100d50b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
movzx eax, byte [ecx + 0x3c]
mov esi, ecx
cmp eax, 4
je 0x100d50cb
cmp eax, 3
je 0x100d50e2
test eax, eax
jne 0x100d5128
push dword [esi + 0x18]
jmp 0x100d50db
movzx eax, byte [esi + 0x74]
cmp eax, 3
je 0x100d50f9
test eax, eax
jne 0x100d5128
push dword [esi + 0x40]
call sub.WS2_32.dll_closesocket
jmp 0x100d5128
movzx eax, byte [esi + 0x74]
cmp eax, 3
je 0x100d5105
test eax, eax
jne 0x100d510d
push dword [esi + 0x40]
call sub.WS2_32.dll_closesocket
jmp 0x100d510d
add esi, 0x48
mov ecx, esi
pop esi
pop edi
jmp fcn.100c8eb0
lea ecx, [esi + 0x48]
call fcn.100c8eb0
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.10109370
mov eax, dword [esi + 0x78]
lock dec dword [eax]
jne 0x100d5128
mov ecx, edi
pop esi
pop edi
jmp fcn.1006e030
pop esi
pop edi
ret
Function at 0x100f27a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x100f27b4
test eax, eax
jne 0x100f28ce
mov edi, dword [0x10551f20]
test edi, edi
je 0x100f28ce
xor ebx, ebx
jmp 0x100f27d7
mov edi, dword [edi + 8]
test edi, edi
je 0x100f27f9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f27d0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f27d0
test bl, 1
je 0x100f28ce
mov edi, dword [0x10551f20]
test edi, edi
je 0x100f28ce
xor ebx, ebx
jmp 0x100f2827
mov edi, dword [edi + 8]
test edi, edi
je 0x100f2849
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f2820
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f2820
test bl, 1
je 0x100f28ce
mov edi, dword [0x10551f20]
test edi, edi
je 0x100f28ce
xor ebx, ebx
jmp 0x100f2867
mov edi, dword [edi + 8]
test edi, edi
je 0x100f2889
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f2860
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f2860
test bl, 1
je 0x100f28ce
mov edi, dword [0x10551f20]
test edi, edi
je 0x100f28ce
xor ebx, ebx
jmp 0x100f28a7
mov edi, dword [edi + 8]
test edi, edi
je 0x100f28c9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f28a0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x100f28a0
test bl, 1
jne 0x100f28d9
mov al, byte [0x103e4c40]
pop esi
pop edi
pop ebx
ret 0xc
mov edi, dword [0x10551f20]
jmp 0x100f28e4
mov edi, dword [edi + 8]
test edi, edi
je 0x100f28ce
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f28e1
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
jmp 0x100f28e1
Function at 0x100f2930
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, ecx
mov ecx, 0x10551f80
call fcn.100f4af0
mov esi, dword [edi]
test esi, esi
jne 0x100f29a9
mov ebx, dword [edi + 4]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x100f2a26
mov esi, eax
test ebx, ebx
je 0x100f299d
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f2a6f
mov dword [eax], ebx
mov dword [eax + 4], esi
mov dword [eax + 8], 0
mov ecx, eax
mov eax, dword [0x10551f20]
nop dword [eax]
mov dword [ecx + 8], eax
lock cmpxchg dword [0x10551f20], ecx
jne 0x100f2990
mov eax, esi
test esi, esi
xchg dword [edi], eax
je 0x100f2a3f
mov eax, dword [0x10551f24]
test eax, eax
je 0x100f29ca
cmp eax, 0x100f3390
jne 0x100f29ef
mov eax, dword [0x10551f80]
mov byte [eax + 0x18], 0
push eax
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x100f2a1d
mov ecx, 0x103a03b9
mov edx, 0x17
call fcn.100f2fc0
test eax, eax
mov eax, 0x100f3390
cmovne eax, edx
mov dword [0x10551f24], eax
cmp eax, 0x100f3390
je 0x100f29b9
mov eax, dword [0x10551f3c]
test eax, eax
jne 0x100f2a16
mov ecx, str.ReleaseSRWLockExclusive
mov edx, 0x17
call fcn.100f2fc0
test eax, eax
mov eax, 0x100f51d0
cmovne eax, edx
mov dword [0x10551f3c], eax
push 0x10551f80
call eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov ecx, 0x103a1275
mov edx, 0x2e
push 0x103a12a4
call fcn.100f33b0
add esp, 4
ud2
mov ecx, esp
mov dword [esp], str.assertion_failed:_key___0library_std_src_syswindows_thread_local_key.rs
mov dword [esp + 4], 1
mov dword [esp + 8], 0
mov dword [esp + 0x10], str.formatter_errorfailed_to_write_whole_buffer
mov dword [esp + 0x14], 0
call fcn.100f3b40
ud2
mov ecx, 0xc
mov edx, 4
call fcn.100067d0
ud2

Function at 0x100f2a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0xc
mov eax, dword [0x10411900]
test eax, eax
jne 0x100f2a98
mov ecx, 0x10411900
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100f2aad
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x100f2b29
jmp 0x100f2ae9
call sub.KERNEL32.dll_GetProcessHeap
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f2b31
mov dword [eax], 0
mov dword [eax + 0xc], 0x10411900
mov esi, eax
mov eax, dword [0x10411900]
test eax, eax
jne 0x100f2ae2
mov ecx, 0x10411900
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
je 0x100f2b29
test eax, eax
je 0x100f2b29
lock dec dword [eax]
jne 0x100f2b29
lea ecx, [esp + 8]
call fcn.100f2f00
mov eax, edi
add esp, 0xc
pop esi
pop edi
ret
mov ecx, 0x10
mov edx, 4
call fcn.100067d0
ud2
Function at 0x100f39c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x1041190c]
test eax, eax
jne 0x100f39d4
mov ecx, 0x1041190c
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100f39e6
cmp dword [eax], 1
mov esi, eax
je 0x100f3a53
mov eax, dword [0x1041190c]
test eax, eax
jne 0x100f39f9
mov ecx, 0x1041190c
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x100f3a58
mov esi, eax
test eax, eax
jne 0x100f3a46
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100f3a5e
mov dword [eax], 0
mov dword [eax + 8], 0x1041190c
mov esi, eax
mov eax, dword [0x1041190c]
test eax, eax
jne 0x100f3a3f
mov ecx, 0x1041190c
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi + 4], 0
mov dword [esi], 1
add esi, 4
jmp 0x100f3a5a
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.100067d0
ud2
Function at 0x100fb770
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [esp + 0x18], edx
mov esi, ecx
lea edi, [esp + 2]
mov ebx, esp
mov ebp, dword [ecx]
mov ecx, 2
test ebp, ebp
je 0x100fb890
cmp ebp, 3
je 0x100fb915
cmp ebp, 1
je 0x100fb936
mov eax, ebp
and eax, 3
cmp eax, 2
je 0x100fb7ce
jmp 0x100fb947
mov eax, ebp
and eax, 3
cmp eax, 2
jne 0x100fb880
mov eax, dword [0x10411900]
test eax, eax
jne 0x100fb7e1
mov ecx, 0x10411900
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fb800
cmp dword [eax], 1
jne 0x100fb800
add eax, 4
jmp 0x100fb80d
call fcn.100f2a80
test eax, eax
je 0x100fb91d
mov ecx, eax
call fcn.100f2b50
mov ecx, ebp
mov dword [esp], eax
mov byte [esp + 8], 0
mov eax, ebp
and ecx, 0xfffffffc
mov dword [esp + 4], ecx
lock cmpxchg dword [esi], edi
je 0x100fb855
mov ebp, eax
mov eax, dword [esp]
test eax, eax
je 0x100fb7c0
lock dec dword [eax]
jne 0x100fb7c0
mov ecx, ebx
call fcn.100f2f00
jmp 0x100fb7c0
call fcn.100fa770
movzx eax, byte [esp + 8]
test al, al
je 0x100fb850
mov eax, dword [esp]
test eax, eax
je 0x100fb880
lock dec dword [eax]
jne 0x100fb880
mov ecx, ebx
call fcn.100f2f00
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ebp, dword [esi]
mov ecx, 2
jmp 0x100fb78a
xor eax, eax
lock cmpxchg dword [esi], ecx
mov ebp, eax
jne 0x100fb78a
mov byte [esp + 4], 0
mov dword [esp], 3
push ebx
push dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
call dword [eax + 0xc]
add esp, 8
mov eax, dword [esp]
xchg dword [esi], eax
mov ecx, eax
and ecx, 3
cmp ecx, 2
mov dword [esp + 0x1c], ecx
jne 0x100fb979
and eax, 0xfffffffc
je 0x100fb915
mov esi, esp
jmp 0x100fb8e6
test edi, edi
mov eax, edi
je 0x100fb915
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov dword [eax], 0
test ecx, ecx
je 0x100fb960
mov dword [esp], ecx
mov byte [eax + 8], 1
mov ebx, dword [esp]
lea ecx, [ebx + 0x18]
call fcn.100fb9e0
lock dec dword [ebx]
jne 0x100fb8e0
mov ecx, esi
call fcn.100f2f00
jmp 0x100fb8e0
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x103a02cf
mov edx, 0x5e
push 0x103a0330
call fcn.1000a9c0
add esp, 4
ud2
mov ecx, 0x103a169a
mov edx, 0x2a
push 0x103a16c4
jmp 0x100fb956
mov ecx, str.assertion_failed:_state_and_queue__STATE_MASK__RUNNING
mov edx, 0x39
push 0x103a1710
call fcn.100f33b0
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__valueC:UsersAdministrator.cargo_registry_srcgithub.com_1ecc6299db9ec823url_2.2.0_srclib.rs__file
mov edx, 0x2b
push 0x103a174c
call fcn.10008540
add esp, 4
ud2
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
lea eax, [esp + 0x1c]
mov dword [esp], str.assertion_failed:___left__right___n__left:__queue_is_not_full__tail____head__X_:
mov dword [esp + 4], 3
mov dword [esp + 8], 0
mov dword [esp + 0x24], 0x103a1350
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], 0x100b9ba0
mov dword [esp + 0x30], edx
mov edx, 0x103a173c
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], 0x100b9ba0
mov dword [esp + 0x10], ecx
mov ecx, esp
mov dword [esp + 0x14], 2
call fcn.100f94f0
ud2
Function at 0x100fe290
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
cmp edx, 1
mov eax, 0x17
mov ebp, 2
mov esi, ecx
cmove ebp, eax
push 0x81
push 0
push 0
push 0
push ebx
push ebp
call sub.WS2_32.dll_WSASocketW
mov edi, eax
cmp eax, 0xffffffff
je 0x100fe2ce
mov dword [esi + 4], edi
mov dword [esi], 0
jmp 0x100fe337
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2739
je 0x100fe2e1
cmp eax, 0x2726
jne 0x100fe327
push 1
push 0
push 0
push 0
push ebx
push ebp
call sub.WS2_32.dll_WSASocketW
cmp eax, 0xffffffff
je 0x100fe322
mov edi, eax
push 0
push 1
push eax
call sub.KERNEL32.dll_SetHandleInformation
test eax, eax
jne 0x100fe2c3
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
push edi
call sub.WS2_32.dll_closesocket
jmp 0x100fe337
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100fea20
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x10411900]
mov esi, ecx
test eax, eax
jne 0x100fea3a
mov ecx, 0x10411900
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fea4f
cmp dword [eax], 1
jne 0x100fea4f
add eax, 4
jmp 0x100fea5c
call fcn.100f2a80
test eax, eax
je 0x100feb23
mov ecx, dword [eax]
inc ecx
test ecx, ecx
jle 0x100feacc
cmp dword [eax + 4], 0
jne 0x100feae4
mov dword [esp + 4], esi
mov eax, dword [0x10411900]
test eax, eax
jne 0x100fea80
mov ecx, 0x10411900
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fea97
cmp dword [eax], 1
mov edi, eax
jne 0x100fea97
add edi, 4
jmp 0x100feaa2
call fcn.100f2a80
mov edi, eax
test eax, eax
je 0x100feb15
cmp dword [edi], 0
jne 0x100feafd
mov dword [edi], 0xffffffff
mov eax, dword [edi + 4]
test eax, eax
je 0x100feac1
lock dec dword [eax]
jne 0x100feac1
lea ecx, [edi + 4]
call fcn.100f2f00
mov dword [edi + 4], esi
inc dword [edi]
add esp, 8
pop esi
pop edi
ret
mov eax, esp
mov ecx, 0x103a3495
mov edx, 0x18
push 0x103a1cdc
push 0x103a0340
jmp 0x100feb39
mov ecx, 0x103a1cec
mov edx, 0x26
push 0x103a1d14
call fcn.100f33b0
add esp, 4
ud2
mov eax, esp
mov ecx, str.already_borrowed
mov edx, 0x10
push 0x103a1d24
push 0x103a0360
jmp 0x100feb39
lock dec dword [esi]
jne 0x100feb23
lea ecx, [esp + 4]
call fcn.100f2f00
mov eax, esp
mov ecx, 0x103c9a77
mov edx, 0x46
push 0x103a041c
push 0x103a040c
push eax
call fcn.1000aa20
add esp, 0xc
ud2