joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a2e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10343c80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edi
push 0
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x103447d0]
mov edi, eax
mov ecx, dword [0x103447d4]
cmp edx, 0x257edfd1
jne 0x1005a338
cmp ecx, 0xb2ab117a
je 0x1005a348
cmp edx, 0x257edfd0
jne 0x1005a34f
cmp ecx, 0xb2ab117a
jne 0x1005a34f
test edi, edi
setne al
jmp 0x1005a35f
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push edi
mov eax, dword [eax + 0x18]
call eax
movzx ecx, al
mov dword [esi], edi
mov dword [esi + 4], 0x103447c8
mov dword [ebp - 0xc], 0x1ffff7
lea eax, [ecx + 2]
mov dword [esi + 8], eax
cmp ecx, 0xffffffff
je 0x1005a386
mov eax, edi
mov edx, 0x103447c8
jmp 0x1005a39b
xor edx, edx
mov eax, 0x103447c8
div dword [ebp - 0xc]
imul eax, edx, 0x3e8
mov edx, dword [esi + 4]
add eax, edi
cmp eax, 0x40
jne 0x1005a3f2
mov ecx, dword [0x103447d0]
mov eax, dword [0x103447d4]
cmp ecx, 0x257edfd1
jne 0x1005a3ba
cmp eax, 0xb2ab117a
je 0x1005a3c9
cmp ecx, 0x257edfd0
jne 0x1005a3d6
cmp eax, 0xb2ab117a
jne 0x1005a3d6
mov al, 1
mov dword [esi], 0x2746
jmp 0x1005a459
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push 0x2746
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x2746
jmp 0x1005a459
cmp ecx, 0xffffffff
jne 0x1005a40a
mov eax, edx
mov ecx, 0x1ffff7
xor edx, edx
div ecx
imul eax, edx, 0x3e8
add edi, eax
cmp edi, 0x4d2
jne 0x1005a469
mov ecx, dword [0x103447d0]
mov eax, dword [0x103447d4]
cmp ecx, 0x257edfd1
jne 0x1005a42c
cmp eax, 0xb2ab117a
je 0x1005a43b
cmp ecx, 0x257edfd0
jne 0x1005a43f
cmp eax, 0xb2ab117a
jne 0x1005a43f
mov al, 1
jmp 0x1005a453
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push 0x274d
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 0x274d
movzx eax, al
add eax, 2
mov dword [esi + 4], 0x103447c8
mov dword [esi + 8], eax
test ebx, ebx
je 0x1005a481
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
mov eax, dword [ebp - 8]
xor ecx, ebp
movq qword [esi], xmm0
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
call fcn.1026af9a
mov esp, ebp
pop ebp
ret
Function at 0x1005b670
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10297cb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10343c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.boost::asio::detail::win_iocp_io_context.0
je 0x1005b730
call fcn.1005bcc0
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x10349c3c
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
push 0
push ecx
test eax, eax
je 0x1005b6fc
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1005b712
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x1005b729
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.1026afa8
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.10063850
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1005b74c
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x1005b763
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.1026afa8
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1005b76d
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.boost::asio::execution_context::service.0
je 0x1005b784
push 0x64
push esi
call fcn.1026afa8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
jne 0x1005d829
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
cmp edi, 4
jb 0x1005d809
mov ecx, eax
sub ecx, ebx
add ecx, 2
mov dword [ebp - 4], ecx
nop dword [eax + eax]
movzx esi, byte [ecx + ebx]
movzx ecx, byte [eax + 3]
movzx edx, byte [ebx + 3]
shl ecx, 8
or esi, ecx
shl edx, 8
movzx ecx, byte [eax]
shl esi, 0x10
or esi, ecx
movzx ecx, byte [eax + 1]
and ecx, 0xffdfdfdf
and esi, 0xdfdfdfdf
shl ecx, 8
or esi, ecx
movzx ecx, byte [ebx + 2]
or edx, ecx
movzx ecx, byte [ebx]
shl edx, 0x10
or edx, ecx
movzx ecx, byte [ebx + 1]
and ecx, 0xffdfdfdf
and edx, 0xdfdfdfdf
shl ecx, 8
or edx, ecx
cmp edx, esi
jne 0x1005d829
mov ecx, dword [ebp - 4]
sub edi, 4
add eax, 4
add ebx, 4
cmp edi, 4
jae 0x1005d7a0
test edi, edi
je 0x1005d820
sub ebx, eax
nop
mov cl, byte [ebx + eax]
xor cl, byte [eax]
test cl, 0xdf
jne 0x1005d829
inc eax
sub edi, 1
jne 0x1005d810
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10062fa0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10343c80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x34], 0
je 0x1006305f
cmp dword [ebp + 8], 0
jne 0x1006306f
mov ecx, dword [esi + 0x30]
push edi
call fcn.1005bcc0
mov edi, dword [esi + 0x34]
push 0xffffffffffffffff
push 0
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x10349c3c
lock xadd dword [ecx], eax
mov ecx, dword [edi + 4]
push 0
push ecx
test eax, eax
je 0x10063015
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1006302b
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esi + 0x34]
test edi, edi
je 0x10063046
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push edi
call fcn.1026afa8
add esp, 8
pop edi
mov dword [esi + 0x34], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp + 8], 0
je 0x1006306f
mov eax, dword [esi + 0x30]
xor ecx, ecx
add eax, 0x1c
xchg dword [eax], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1026af9a
mov esp, ebp
pop ebp
ret 4

Function at 0x10063550
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 1
lock xadd dword [0x1034d044], eax
inc eax
mov ebx, 0x1034d048
cmp eax, 1
jne 0x10063596
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
cmp byte [ebp + 8], 0
je 0x10063621
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
je 0x10063621
mov ecx, dword [0x103447d0]
mov eax, dword [0x103447d4]
cmp ecx, 0x257edfd1
jne 0x100635c4
cmp eax, 0xb2ab117a
je 0x100635d3
cmp ecx, 0x257edfd0
jne 0x100635d7
cmp eax, 0xb2ab117a
jne 0x100635d7
mov al, 1
jmp 0x100635e7
mov eax, dword [0x103447c8]
mov ecx, 0x103447c8
push esi
mov eax, dword [eax + 0x18]
call eax
movzx eax, al
add eax, 2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x103447c8
mov dword [esp + 0xc], str.C:_vcpkginstalledx86_windows_staticinclude_boost_asiodetailimplwinsock_init.ipp
mov dword [esp + 0x10], str.throw_on_error
mov dword [esp + 0x14], 0x48
mov dword [esp + 0x18], 0x1a
test al, 1
jne 0x1006363a
mov ecx, dword [esp + 0x1bc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1026af9a
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0xc]
mov edx, str.winsock
push eax
lea ecx, [esp + 0x20]
call fcn.10058f70
int3
Function at 0x10066d10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10298528
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10343c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.boost::exception_detail::clone_base.0
mov ebx, dword [ebp + 8]
lea eax, [edi + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi + 4], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 8]
push eax
call fcn.1026c917
mov dword [edi + 4], vtable.boost::system::system_error.0
add esp, 8
movq xmm0, qword [ebx + 0x10]
movq qword [edi + 0x10], xmm0
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
lea esi, [edi + 0x1c]
mov byte [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x20]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x10066d9f
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x24]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x14], eax
mov eax, edi
mov dword [edi], vtable.boost::wrapexcept_class_boost::system::system_error_.2.0
mov dword [edi + 4], vtable.boost::wrapexcept_class_boost::system::system_error_.1.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::system::system_error_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1008ddb0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10299baf
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10343c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea esi, [eax + 0x18]
mov dword [ebp - 4], 0
lea eax, [ecx + 0x18]
push esi
mov ecx, eax
mov dword [ebp - 0x18], eax
call fcn.10053790
push 0x10
mov byte [ebp - 4], 1
call fcn.1026afd9
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 2
mov esi, dword [esi + 0x18]
push 0x48
call fcn.1026afd9
add esp, 8
mov dword [edi + 4], eax
mov byte [ebp - 4], 3
mov ecx, edi
push esi
mov dword [edi + 0xc], 0
call fcn.100916a0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x100e7b90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
lea edx, [esp]
mov ecx, dword [esp + 0x10]
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, dword [eax]
push edx
push dword [eax + 8]
push dword [eax + 4]
push ecx
call fcn.100e75f0
add esp, 0x10
test eax, eax
jne 0x100e7bdc
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1026af9a
add esp, 0xc
ret
mov cl, byte [edi]
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [esp + 8]
xor cl, byte [edi]
mov byte [edi], cl
and cl, 3
add cl, 1
je 0x100e7c10
lea edx, [esp + 9]
movzx ecx, cl
sub edx, esi
mov al, byte [esi + edx]
lea esi, [esi + 1]
xor byte [esi - 1], al
sub ecx, 1
jne 0x100e7c02
mov ecx, dword [esp + 0x10]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1026af9a
add esp, 0xc
ret

Function at 0x100e7c30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
lea edx, [esp]
mov ecx, dword [esp + 0x10]
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, dword [eax]
push edx
push dword [eax + 8]
push dword [eax + 4]
push ecx
call fcn.100e75f0
add esp, 0x10
test eax, eax
jne 0x100e7c7c
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1026af9a
add esp, 0xc
ret
mov al, byte [edi]
and al, 3
add al, 1
je 0x100e7c9e
lea edx, [esp + 9]
movzx ecx, al
sub edx, esi
nop dword [eax]
mov al, byte [esi + edx]
lea esi, [esi + 1]
xor byte [esi - 1], al
sub ecx, 1
jne 0x100e7c90
mov cl, byte [edi]
mov eax, 1
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [esp + 8]
xor byte [edi], cl
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor ecx, esp
call fcn.1026af9a
add esp, 0xc
ret
Function at 0x100edb70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x9c
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [ecx]
mov ebx, dword [esp + 0xa8]
push ebp
push edi
movzx ebp, byte [eax]
mov eax, dword [esp + 0xb8]
mov edi, dword [esp + 0xac]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], ecx
cmp eax, 3
ja case.0x100edbc4.2
jmp dword [eax*4 + 0x100eecf8]
mov dword [esp + 0x20], 0
jmp 0x100edbe7
mov dword [esp + 0x20], 1
jmp 0x100edbe7
mov dword [esp + 0x20], 2
cmp dword [ebx + 4], 0
jne 0x100edc2e
push str.depack_process_frames
push 0x425
push str.sslquicquic_rx_depack.c
push 0
push str.empty_packet_payload
push 0
push 0
push 0
push 0xa
push edi
call fcn.100d3ee0
add esp, 0x28
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.1026af9a
add esp, 0x9c
ret
push esi
nop
cmp dword [edi + 0x2d4], 0
xorps xmm0, xmm0
mov dword [esp + 0x38], 0
movlpd qword [esp + 0x3c], xmm0
je 0x100edc50
mov eax, dword [ebx]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.100ed590
add esp, 0xc
test eax, eax
je 0x100eecb5
cmp dword [esp + 0x44], 0
je 0x100eec95
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
test ebx, ebx
ja 0x100edc97
jb 0x100edc89
cmp esi, 0x1d
ja 0x100edc97
movzx eax, byte [esi + 0x100eed10]
jmp dword [eax*4 + 0x100eed08]
mov eax, dword [esp + 0x34]
or dword [eax + 0x10], 4
jmp 0x100edca5
test ebx, ebx
ja 0x100eec77
jb 0x100edcb8
cmp esi, 0x1e
ja 0x100eec77
jmp dword [esi*4 + 0x100eed30]
push str.depack_process_frames
push 0x567
push str.sslquicquic_rx_depack.c
push 0
push str.Unknown_frame_type_received
push ebx
push esi
push 0
push 7
jmp 0x100eecd3
push str.depack_process_frames
push 0x43e
push str.sslquicquic_rx_depack.c
push 0
push str.non_minimal_frame_type_encoding
push dword [esp + 0x44]
push dword [esp + 0x44]
jmp 0x100eeccf
push str.depack_process_frames
push 0x436
push str.sslquicquic_rx_depack.c
push 0
push str.malformed_frame_header
push 0
push 0
push 0
push 0xa
push edi
call fcn.100d3ee0
add esp, 0x28
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1026af9a
add esp, 0x9c
ret
Function at 0x100f2420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x294
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
mov ebx, dword [esp + 0x2a4]
push ebp
push esi
mov esi, dword [esp + 0x2a4]
push edi
mov edi, dword [esp + 0x2ac]
push 0
mov eax, dword [edi + 4]
mov ebp, dword [edi]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.100ed590
add esp, 0xc
test eax, eax
je 0x100f2d06
cmp dword [esp + 0x1c], 0
ja 0x100f2cae
mov eax, dword [esp + 0x18]
jb 0x100f248c
cmp eax, 0x1e
ja 0x100f2cae
movzx eax, byte [eax + 0x100f2d70]
jmp dword [eax*4 + 0x100f2d20]
push str.unknown
push str.frame_type
push esi
call fcn.100e9df0
push dword [esp + 0x28]
push dword [esp + 0x28]
push str.frame_type_value
push esi
call fcn.100e9e50
push 0x102ac264
push esi
call fcn.100e9450
push dword [esp + 0x44]
push ebp
push str.data
push esi
call fcn.100e9120
push esi
call fcn.100e9480
mov eax, dword [edi + 4]
add esp, 0x38
add dword [edi], eax
mov dword [edi + 4], 0
mov eax, 1
mov ecx, dword [esp + 0x2a0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1026af9a
add esp, 0x294
ret
Function at 0x100fd3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x168
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x170]
push ebp
mov ebp, dword [esp + 0x17c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x174]
test ebp, ebp
je 0x100fd5e9
push ebx
mov ebx, edi
mov eax, edi
push esi
shr ebx, 0x17
mov esi, 2
test edi, edi
push 0x100fcc90
cmovs ebx, esi
shr eax, 0x17
push 0x1034793c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], eax
call fcn.101002c0
add esp, 8
neg eax
sbb eax, eax
test dword [0x10347948], eax
je 0x100fd4a6
mov eax, dword [esp + 0x10]
test edi, edi
push dword [0x10347940]
cmovs eax, esi
movzx eax, al
shl eax, 0x17
mov dword [esp + 0x30], eax
call fcn.101002b0
add esp, 4
test eax, eax
je 0x100fd4a6
lea eax, [esp + 0x2c]
push eax
push dword [0x10347944]
call fcn.10105870
push dword [0x10347940]
mov esi, eax
call fcn.10100330
add esp, 0xc
test esi, esi
je 0x100fd4a6
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x100fd4c3
push ebx
push str.lib__lu_
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.10123160
lea eax, [esp + 0x44]
add esp, 0x10
mov dword [esp + 0x14], eax
mov esi, edi
test edi, edi
jns 0x100fd4f1
push 0x100
lea eax, [esp + 0x78]
and esi, 0x7fffffff
push eax
push esi
call fcn.10101140
add esp, 0xc
lea ecx, [esp + 0x74]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x100fd575
push 0x100fcc90
push 0x1034793c
and esi, 0x7fffff
call fcn.101002c0
add esp, 8
neg eax
sbb eax, eax
test dword [0x10347948], eax
je 0x100fd579
mov eax, dword [esp + 0x10]
push dword [0x10347940]
movzx eax, al
shl eax, 0x17
or eax, esi
mov dword [esp + 0x28], eax
call fcn.101002b0
add esp, 4
test eax, eax
je 0x100fd55b
lea eax, [esp + 0x24]
push eax
push dword [0x10347944]
call fcn.10105870
push dword [0x10347940]
mov ebx, eax
call fcn.10100330
add esp, 0xc
test ebx, ebx
jne 0x100fd572
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
push eax
call fcn.100fd260
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100fd579
mov eax, dword [ebx + 4]
test eax, eax
jne 0x100fd59c
mov eax, esi
and eax, 0xff83ffff
push eax
push str.reason__lu_
lea eax, [esp + 0x7c]
push 0x100
push eax
call fcn.10123160
add esp, 0x10
lea eax, [esp + 0x74]
mov ebx, dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push str.error:_08lX:_s:_s:_s
push ebp
push ebx
call fcn.10123160
mov ecx, ebx
add esp, 0x1c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100fd5c0
sub ecx, edx
lea eax, [ebp - 1]
cmp ecx, eax
jne 0x100fd5e7
push esi
push 0
push dword [esp + 0x28]
push edi
push str.err:_lx:_lx:_lx:_lx
push ebp
push ebx
call fcn.10123160
add esp, 0x1c
pop esi
pop ebx
mov ecx, dword [esp + 0x16c]
pop edi
pop ebp
xor ecx, esp
call fcn.1026af9a
add esp, 0x168
ret
Function at 0x101004c0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x10347a54], 2
push esi
push edi
mov edi, 1
je 0x10100517
mov edx, 0x10347a54
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x101004f1
cmp eax, 1
je 0x101004d5
cmp dword [0x10347a54], 2
jne 0x10100531
jmp 0x10100517
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x10100410
push 0
push 0
mov dword [0x10347a50], eax
call fcn.1014b7f0
add esp, 0xc
mov dword [0x10347a54], 2
push 0x97
push str.crypto_threads_win.c
push 0x34
call fcn.10101f20
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10100536
pop edi
xor eax, eax
pop esi
ret
push ebx
push ebp
lea ebx, [esi + 0x20]
call fcn.10131de0
mov dword [ebx], eax
call fcn.10131b20
mov dword [esi + 0x28], eax
call fcn.10131b20
mov dword [esi + 0x30], eax
call fcn.10131de0
mov dword [esi + 0x24], eax
lea ebp, [esi + 0x2c]
call fcn.10131de0
mov dword [ebp], eax
call fcn.10131de0
cmp dword [esp + 0x14], edi
push 0x85
cmovge edi, dword [esp + 0x18]
inc edi
mov dword [ebx], eax
push str.crypto_threads_win.c
lea eax, [edi*8]
push eax
call fcn.10101f20
add esp, 0xc
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
lea edi, [esi + 0x24]
test eax, eax
je 0x101005b9
cmp dword [esi + 0x28], 0
je 0x101005b9
cmp dword [esi + 0x30], 0
je 0x101005b9
cmp dword [ebx], 0
je 0x101005b9
cmp dword [edi], 0
je 0x101005b9
cmp dword [ebp], 0
jne 0x10100602
push 0xa9
push str.crypto_threads_win.c
push eax
call fcn.10101d20
lea eax, [esi + 0x28]
push eax
call fcn.10131ac0
lea eax, [esi + 0x30]
push eax
call fcn.10131ac0
push edi
call fcn.10131da0
push ebp
call fcn.10131da0
push ebx
call fcn.10131da0
push 0xaf
push str.crypto_threads_win.c
push esi
call fcn.10101d20
add esp, 0x2c
xor esi, esi
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x10100610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x10
call fcn.1026b810
push ebx
push ebp
or ebp, 0xffffffff
push esi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x10347a50]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1010068b
push 0xde
push str.crypto_threads_win.c
push 0x78
call fcn.10101f20
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x1010067e
push 0xdf
push str.crypto_threads_win.c
push str.assertion_failed:_data___NULL
call fcn.1014bd40
add esp, 0xc
push ebx
push dword [0x10347a50]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x20]
xor ecx, ecx
mov eax, ebx
cmp dword [eax], 0
jne 0x101006a2
cmp ebp, 0xffffffff
cmove ebp, ecx
mov dword [esp + 0x10], ebp
cmp dword [eax + 8], edx
je 0x10100771
inc ecx
add eax, 0xc
cmp ecx, 0xa
jl 0x10100693
lea ebx, [edx + 0x14]
mov dword [esp + 0xc], ebx
push edi
nop dword [eax]
xor esi, esi
mov eax, dword [ebx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [ebx], ecx
jne 0x101006c4
mov ebp, dword [edx + 8]
mov dword [esp + 0x1c], eax
shl eax, 3
add ebp, eax
nop word [eax + eax]
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
add ebx, 1
mov ecx, edi
mov eax, esi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x101006e0
cmp edx, edi
jne 0x101006e0
mov edx, dword [esp + 0x10]
xor esi, esi
mov eax, dword [edx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x10100709
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov edx, dword [esi + 8]
cmp edi, eax
je 0x10100753
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov ebx, edi
mov esi, dword [ebp + 4]
sub ebx, 1
mov ecx, esi
mov eax, edi
sbb ecx, 0
mov edx, esi
lock cmpxchg8b qword [ebp]
cmp eax, edi
jne 0x10100725
cmp edx, esi
jne 0x10100725
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
jmp 0x101006c0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
lea eax, [edx + edi*8]
mov dword [ecx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret