joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4ec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x68
mov eax, dword [0x94a72c]
test eax, eax
je 0x4a4eeb
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4a4f01
cmp dword [eax + 4], 0
je 0x4a4f01
add eax, 8
jmp 0x4a50f3
mov ecx, 0x94a72c
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x4a4edd
mov eax, dword [0x94a72c]
test eax, eax
je 0x4a50d7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4a50f1
mov esi, eax
test eax, eax
jne 0x4a4f65
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0x38
call fcn.0071ee80
test eax, eax
je 0x4a511e
mov dword [eax], 0x94a72c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x94a72c]
test eax, eax
je 0x4a50fb
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x4c], 0
mov dword [esp], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x51], 0
mov dword [esp + 0x4d], 0
mov dword [esp + 4], 0
mov ecx, esp
mov eax, dword [0x94b93c]
push ecx
call eax
mov edi, dword [esp]
mov ebp, dword [esp + 4]
lea ebx, [esp + 0x60]
mov ecx, ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], 0
mov edx, edi
push ebp
call fcn.004a42a0
add esp, 4
lea eax, [esp + 0x58]
mov dword [esp], 0x93d18c
mov dword [esp + 4], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], fcn.004a4b00
lea ecx, [esp + 0x2c]
mov edx, 0x83660c
mov dword [esp + 8], eax
mov eax, esp
mov dword [esp + 0xc], 1
push eax
call fcn.00464980
add esp, 4
add edi, 0x989680
adc ebp, 0
jo 0x4a510a
movsd xmm0, qword [esp + 0x34]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebp
movsd xmm1, qword [esp + 0x3c]
mov eax, dword [esp + 0x54]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [esp + 0x44]
mov dword [esp + 0x28], eax
movsd qword [esp + 0x10], xmm1
lea eax, [esi + 8]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [esp + 0x4c]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp], xmm0
mov dword [esi + 4], 1
mov dword [esi + 8], 0
movsd xmm0, qword [esp]
movsd xmm1, qword [esp + 8]
movsd qword [esi + 0xc], xmm0
movsd qword [esi + 0x14], xmm1
movsd xmm0, qword [esp + 0x10]
movsd qword [esi + 0x1c], xmm0
movsd xmm0, qword [esp + 0x18]
movsd qword [esi + 0x24], xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [esi + 0x2c], xmm0
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x34], ecx
jmp 0x4a50f3
mov ecx, 0x94a72c
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x4a4f1f
xor eax, eax
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x94a72c
call fcn.007d1810
jmp 0x4a4f5d
mov ecx, str.overflow_when_adding_duration_to_instantlibrary_std_src_time.rs
mov edx, 0x28
push 0x934508
call fcn.007c2000
mov ecx, 4
mov edx, 0x38
call fcn.007c1490
int3
Function at 0x4ae4e0
Capabilities:
Encode data using xor
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf00
call fcn.004ae4f4

Function at 0x4b3f70
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x210
mov esi, esp
mov dword [esi + 0x1f8], ebp
mov dword [esi + 0x1fc], esp
mov dword [esi + 0x208], 0xffffffff
mov dword [esi + 0x204], 0x75f1c0
mov dword [esi + 0x14c], ecx
lea ecx, [esi + 0x200]
call fcn.004b3fb2

Function at 0x4b59e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov edi, edx
mov ebx, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
push eax
push 0x8004667e
push edx
call dword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x4b5a8e
lea ecx, [esp + 0x18]
mov edx, edi
push 0x837dac
call fcn.00725e30
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, 2
jne 0x4b5af1
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
xor ecx, ecx
mov edx, 0xc
mov dword [esp], eax
movzx eax, byte [0x94bfc5]
call fcn.0071ee80
test eax, eax
je 0x4b5ba3
mov byte [eax + 8], 8
mov esi, eax
xor ecx, ecx
mov edx, 8
movzx eax, byte [0x94bfc5]
call fcn.0071ee80
test eax, eax
je 0x4b5bb2
mov ecx, dword [esp]
mov dword [eax], edi
mov dword [eax + 4], ecx
mov dword [esi], eax
mov dword [esi + 4], 0x835e64
jmp 0x4b5b29
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esp], eax
xor ecx, ecx
mov edx, 0xc
movzx eax, byte [0x94bfc5]
call fcn.0071ee80
test eax, eax
je 0x4b5ba3
mov byte [eax + 8], 8
mov esi, eax
xor ecx, ecx
mov edx, 8
movzx eax, byte [0x94bfc5]
call fcn.0071ee80
test eax, eax
je 0x4b5bb2
mov ecx, dword [esp]
mov dword [eax], 0
mov dword [eax + 4], ecx
mov dword [esi], eax
mov dword [esi + 4], 0x835e64
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4b5b29
movsd xmm0, qword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], edx
movsd qword [esp + 0xc], xmm0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 4]
call fcn.004b3b80
cmp dword [esp + 0x18], 2
jne 0x4b5b3a
mov esi, dword [esp + 0x1c]
mov dword [ebx + 4], esi
mov dword [ebx], 2
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 0x18]
mov ecx, 0x1a
mov edi, ebx
movaps xmm0, xmmword [0x7d4b90]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x70], 0
movups xmmword [ebx + 0x78], xmm0
mov dword [ebx + 0x88], 0x1000000
mov word [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0xa0], pe_nt_image_headers32
mov word [ebx + 0xa4], 0x200
mov byte [ebx + 0xa6], 2
jmp 0x4b5b32
mov ecx, 4
mov edx, 0xc
call fcn.007c1490
mov ecx, 4
mov edx, 8
call fcn.007c1490
int3
Function at 0x4c2ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 0x1c
mov eax, dword [0x94a900]
test eax, eax
je 0x4c2f73
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4c2eca
cmp dword [eax + 4], 0
mov esi, eax
jne 0x4c2f69
mov eax, dword [0x94a900]
test eax, eax
je 0x4c2f92
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c2fac
mov esi, eax
test eax, eax
jne 0x4c2f2e
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0x20
call fcn.0071ee80
test eax, eax
je 0x4c2fc4
mov dword [eax], 0x94a900
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x94a900]
test eax, eax
je 0x4c2fb5
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esp
call fcn.004c29d0
movsd xmm1, qword [esp + 8]
movsd xmm0, qword [esp]
cmp dword [esi + 4], 0
movsd qword [esi + 0xc], xmm1
movsd xmm1, qword [esp + 0x10]
movsd qword [esi + 0x14], xmm1
mov eax, dword [esp + 0x18]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x1c], eax
je 0x4c2f69
lock dec dword [0x94be44]
add esi, 4
mov eax, esi
add esp, 0x1c
pop esi
ret
mov ecx, 0x94a900
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x4c2ebe
jmp 0x4c2eca
mov ecx, 0x94a900
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x4c2ee8
xor esi, esi
mov eax, esi
add esp, 0x1c
pop esi
ret
mov ecx, 0x94a900
call fcn.007d1810
jmp 0x4c2f26
mov ecx, 4
mov edx, 0x20
call fcn.007c1490
int3
Function at 0x523370
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov dword [esp + 8], ecx
lea eax, [ebx - 1]
cmp eax, edx
jae 0x523500
cmp ebx, edx
jae 0x5234f8
mov ecx, dword [esp + 8]
mov eax, ebx
mov dword [esp + 0x10], edx
shl eax, 4
lea eax, [eax + ecx - 0x10]
mov dword [esp + 0xc], eax
jmp 0x5233ec
add esi, 0xfffffff0
mov ebp, esi
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ch, byte [esp + 3]
movzx edx, word [esp + 4]
mov cl, byte [esp + 6]
mov ebx, dword [esp + 0x14]
mov dword [ebp], eax
mov dword [ebp + 4], esi
mov dword [ebp + 8], edi
mov byte [ebp + 0xc], ch
mov word [ebp + 0xd], dx
mov edx, dword [esp + 0x10]
mov byte [ebp + 0xf], cl
add dword [esp + 0xc], 0x10
inc ebx
cmp ebx, edx
je 0x5234f8
mov ebp, dword [esp + 8]
mov esi, ebx
mov dword [esp + 0x14], ebx
shl esi, 4
mov edi, dword [ebp + esi + 8]
mov eax, dword [ebp + esi - 8]
mov ecx, dword [ebp + esi + 4]
mov ebx, edi
sub ebx, eax
cmovb eax, edi
push eax
push dword [ebp + esi - 0xc]
mov dword [esp + 0x20], ecx
push ecx
call fcn.007be090
add esp, 0xc
movzx ecx, byte [ebp + esi + 0xc]
test eax, eax
mov edx, dword [esp + 0x10]
cmovne ebx, eax
xor eax, eax
mov byte [esp + 3], cl
sub cl, byte [ebp + esi - 4]
cmp cl, 0xff
sete al
xor ecx, ecx
test ebx, ebx
mov ebx, dword [esp + 0x14]
sets cl
cmovne eax, ecx
cmp al, 1
jne 0x5233de
add esi, dword [esp + 8]
mov ebp, dword [esp + 0xc]
dec ebx
mov eax, dword [esi]
movzx edx, byte [esi + 0xf]
movzx ecx, word [esi + 0xd]
movsd xmm0, qword [esi - 0x10]
movsd xmm1, qword [esi - 8]
mov dword [esp + 0x1c], eax
mov byte [esp + 6], dl
mov word [esp + 4], cx
movsd qword [esi], xmm0
movsd qword [esi + 8], xmm1
je 0x5233a9
nop word [eax + eax]
mov eax, dword [ebp - 8]
mov esi, edi
sub esi, eax
cmovb eax, edi
push eax
push dword [ebp - 0xc]
push dword [esp + 0x20]
call fcn.007be090
add esp, 0xc
movzx ecx, byte [esp + 3]
test eax, eax
cmovne esi, eax
xor eax, eax
sub cl, byte [ebp - 4]
cmp cl, 0xff
sete al
xor ecx, ecx
test esi, esi
sets cl
cmove ecx, eax
cmp cl, 1
jne 0x5233ae
lea eax, [ebp - 0x10]
dec ebx
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
test ebx, ebx
movsd qword [ebp + 8], xmm1
movsd qword [ebp], xmm0
mov ebp, eax
jne 0x523490
mov ebp, dword [esp + 8]
jmp 0x5233ae
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.assertion_failed:_offset___0__offset___len
mov edx, 0x2e
push 0x9360f4
call fcn.007c1ca0
int3
Function at 0x52ad60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [0x94a914]
test eax, eax
je 0x52ad88
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x52ad9e
cmp dword [eax + 4], 0
je 0x52ad9e
add eax, 8
add esp, 0x18
pop esi
ret
mov ecx, 0x94a914
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x52ad7a
mov eax, dword [0x94a914]
test eax, eax
je 0x52ae19
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x52ae2f
mov esi, eax
test eax, eax
jne 0x52adf6
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0xc
call fcn.0071ee80
test eax, eax
je 0x52ae75
mov dword [eax], 0x94a914
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x94a914]
test eax, eax
je 0x52ae36
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, 1
lock xadd dword [0x94a910], ecx
test ecx, ecx
je 0x52ae42
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], ecx
add esp, 0x18
pop esi
ret
mov ecx, 0x94a914
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x52adb4
xor eax, eax
add esp, 0x18
pop esi
ret
mov ecx, 0x94a914
call fcn.007d1810
jmp 0x52adee
mov ecx, esp
mov edx, 0x8524f8
mov dword [esp], str.regex:_thread_ID_allocation_space_exhausted
mov dword [esp + 4], 1
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x93d1f8
mov dword [esp + 0xc], 0
call fcn.007c1b50
mov ecx, 4
mov edx, 0xc
call fcn.007c1490
int3
Function at 0x55e020
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x34]
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
cmp eax, edi
mov dword [esp], eax
mov dword [esp + 4], edi
jne 0x55e0d7
test edi, edi
je 0x55e0f4
mov ebx, edi
mov esi, edx
xor eax, eax
shl ebx, 5
cmp edi, 8
jb 0x55e090
mov eax, edi
xor edx, edx
pcmpeqd xmm0, xmm0
and eax, 0xfffffff8
movdqu xmm1, xmmword [ebp + edx*4]
movdqu xmm2, xmmword [ebp + edx*4 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [esi + edx*4], xmm1
movdqu xmmword [esi + edx*4 + 0x10], xmm2
add edx, 8
cmp eax, edx
jne 0x55e060
cmp eax, edi
je 0x55e09e
nop word [eax + eax]
mov edx, dword [ebp + eax*4]
not edx
mov dword [esi + eax*4], edx
inc eax
cmp edi, eax
jne 0x55e090
or byte [esi], 1
sub ebx, dword [ecx + 0x10]
je 0x55e0cf
mov eax, dword [esi + edi*4 - 4]
mov ecx, ebx
shl eax, cl
shr eax, cl
cmp ebx, 1
adc ebx, 0
mov dword [esi + edi*4 - 4], eax
nop word [eax + eax]
push edi
push ebp
push esi
push esi
call fcn.00772a10
add esp, 0x10
dec ebx
jne 0x55e0c0
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
lea edx, [esp + 4]
push 0x89bf6c
push eax
call fcn.007cb1c0
xor ecx, ecx
xor edx, edx
push 0x89db8c
call fcn.007c1be0
int3
Function at 0x567850
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push edi
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x567881
mov edi, dword [esp + 0x10]
push 2
push esi
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x567881
push esi
push edi
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
sete al
pop esi
pop edi
ret
xor eax, eax
pop esi
pop edi
ret

Function at 0x56bd20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
cmp dword [esp + 0x30], 0x10
mov esi, ecx
jne 0x56bdd5
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 0xf8]
mov edi, dword [esp + 0x3c]
lea ebx, [esp + 0xc]
movups xmm0, xmmword [eax]
mov ecx, dword [ecx + 4]
lea eax, [esp + 7]
movups xmmword [esp + 0xc], xmm0
push ebx
push edx
push eax
call ecx
add esp, 0xc
movzx eax, word [esp + 7]
movzx edx, byte [esp + 9]
movzx ecx, word [esp + 0xa]
cmp edi, 4
mov word [esp], ax
mov byte [esp + 2], dl
mov word [esp + 3], cx
jbe 0x56be30
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0x16
mov edi, 0x16
call fcn.0071ee80
test eax, eax
je 0x56be96
mov word [eax + 0x14], 0x676e
mov dword [eax + 0x10], 0x6f6c206f
mov dword [eax + 0xc], 0x6f742072
mov dword [eax + 8], 0x65626d75
mov dword [eax + 4], 0x6e207465
mov dword [eax], 0x6b636170
mov byte [esi], 0xc
mov dword [esi + 4], 0x16
jmp 0x56be28
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0x18
mov edi, 0x18
call fcn.0071ee80
test eax, eax
je 0x56be87
mov dword [eax + 0x14], 0x6874676e
mov dword [eax + 0x10], 0x656c2064
mov dword [eax + 0xc], 0x696c6176
mov dword [eax + 8], 0x6e692066
mov dword [eax + 4], 0x6f20656c
mov dword [eax], 0x706d6173
mov byte [esi], 0xc
mov dword [esi + 4], 0x18
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
jmp 0x56be80
mov eax, dword [esp + 0x34]
movzx ecx, byte [esp]
movzx edx, byte [eax]
mov ch, dl
not ch
shr ch, 3
or ch, 0xf
and ch, cl
xor ch, dl
test edi, edi
mov byte [eax], ch
je 0x56be7d
movzx ebx, cl
xor ecx, ecx
cmp byte [esp + 0x40], 0
mov eax, dword [esp + 0x38]
cmove ebx, ecx
dec edi
xor bl, dl
and bl, 3
movzx edx, bl
cmp edi, edx
cmovae edi, edx
inc edi
nop
movzx edx, byte [esp + ecx + 1]
xor byte [eax + ecx], dl
inc ecx
cmp edi, ecx
jne 0x56be70
mov byte [esi], 0x14
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
mov ecx, 1
mov edx, 0x18
call fcn.007c1490
mov ecx, 1
mov edx, 0x16
call fcn.007c1490
int3
Function at 0x58cd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c8
mov eax, dword [esp + 0x1e0]
mov edx, dword [esp + 0x1e8]
mov ebp, dword [esp + 0x1dc]
mov ecx, 0x80000000
call fcn.0058cd29
Function at 0x5a02a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xac
call fcn.005a02af
Function at 0x5a2c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x94a924]
test eax, eax
je 0x5a2c88
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x5a2c9e
cmp dword [eax + 4], 0
mov edi, eax
je 0x5a2c9e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x94a924
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x5a2c78
mov eax, dword [0x94a924]
test eax, eax
je 0x5a2d1d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5a2d33
mov esi, eax
test eax, eax
jne 0x5a2cf2
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0x10
call fcn.0071ee80
test eax, eax
je 0x5a2d46
mov dword [eax], 0x94a924
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x94a924]
test eax, eax
je 0x5a2d3a
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x5a2c83
call fcn.005a2af0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x94a924
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x5a2cb4
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x94a924
call fcn.007d1810
jmp 0x5a2cea
mov ecx, 4
mov edx, 0x10
call fcn.007c1490
int3
Function at 0x61f960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x94b9d4]
test eax, eax
je 0x61f993
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x61f9a9
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x61f9a9
add ebx, 8
jmp 0x61fa93
mov ecx, 0x94b9d4
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x61f982
mov eax, dword [0x94b9d4]
test eax, eax
je 0x61fa77
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x61fa91
mov ebx, eax
test eax, eax
jne 0x61fa14
movzx eax, byte [0x94bfc5]
xor ecx, ecx
mov edx, 0x50
call fcn.0071ee80
test eax, eax
je 0x61faac
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x48], 0x94b9d4
mov ebx, eax
mov eax, dword [0x94b9d4]
test eax, eax
je 0x61fa9d
dec eax
push ebx
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov edi, esp
mov ecx, 0x12
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 4], 0
mov dword [ebx], 1
add ebx, 8
mov ecx, 0x10
mov esi, 0x936cd0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp]
or eax, dword [esp + 4]
je 0x61fa93
mov eax, dword [esp + 0xc]
cmp eax, 2
je 0x61fa93
test eax, eax
lea ecx, [esp + 0x10]
je 0x61fa67
mov eax, dword [esp + 0x10]
lock dec dword [eax]
jne 0x61fa93
call fcn.006200f0
jmp 0x61fa93
mov eax, dword [esp + 0x10]
lock dec dword [eax]
jne 0x61fa93
call fcn.004a8800
jmp 0x61fa93
mov ecx, 0x94b9d4
call fcn.007d1810
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x61f9c7
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x94b9d4
call fcn.007d1810
jmp 0x61fa0c
mov ecx, 8
mov edx, 0x50
call fcn.007c1490
int3
Function at 0x6485f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2d0
cmp byte [ecx + 0x38], 0
lea edi, [ecx + 0x28]
call fcn.0064860b
Function at 0x64a630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, dword [esp + 0x44]
mov edi, ecx
mov ecx, edx
mov ebx, edx
call fcn.004aa2f0
test al, al
je 0x64a667
mov eax, dword [esi]
mov byte [edi + 0x1a], 3
test eax, eax
je 0x64a806
lea ecx, [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push ecx
jmp 0x64a818
mov ecx, ebx
mov edx, esi
mov dword [esp + 0xc], edi
call fcn.004817e0
movzx edx, word [ebx + 0x38]
mov ecx, dword [esi]
mov edi, dword [ebx + 0x28]
mov dword [esp + 0x28], eax
mov ebp, dword [ebx + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x2c], edx
and edx, eax
mov eax, dword [ebx + 0x18]
test ecx, ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x24]
mov dword [esp + 0x20], edi
mov edi, dword [esi + 4]
sete byte [esp + 2]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 4]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 8]
xor esi, esi
mov dword [esp + 0x10], edi
mov byte [esp + 3], al
mov dword [esp + 0x14], ecx
jmp 0x64a6e0
movzx ecx, byte [esp + 3]
cmp byte [eax + 4], cl
je 0x64a787
inc ebx
inc esi
mov edx, ebx
nop word [eax + eax]
mov ebx, edx
cmp edx, ebp
mov edx, 0
jae 0x64a6e0
mov eax, dword [esp + 0x1c]
movzx edi, word [eax + ebx*4]
cmp edi, 0xffff
je 0x64a7a3
mov dword [esp + 4], esi
mov esi, dword [esp + 0x2c]
movzx eax, word [eax + ebx*4 + 2]
mov edx, ebx
mov ecx, esi
and ecx, eax
sub edx, ecx
and edx, esi
mov esi, dword [esp + 4]
cmp edx, esi
jb 0x64a7a3
cmp ax, word [esp + 0x28]
jne 0x64a6d3
cmp dword [esp + 0x20], edi
jbe 0x64a823
cmp dword [esp + 0x18], 0
mov ecx, dword [esp + 0x24]
sete dl
imul eax, edi, 0x34
mov ecx, dword [ecx + eax + 0x20]
test ecx, ecx
setne dh
cmp dh, dl
je 0x64a6d3
mov edx, dword [esp + 0x24]
test ecx, ecx
lea eax, [edx + eax + 0x20]
je 0x64a6c5
mov ecx, dword [esp + 0x14]
cmp dword [eax + 8], ecx
jne 0x64a6d3
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [eax + 4]
call fcn.007be090
add esp, 0xc
test eax, eax
jne 0x64a6d3
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov ah, byte [esp + 2]
mov al, 2
mov dword [esp + 4], ebx
jmp 0x64a7dd
mov ecx, dword [esp + 8]
cmp esi, 0x200
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0xc]
setae dl
mov eax, dword [ecx]
mov edi, dword [esi + 0xc]
xor eax, 2
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x18]
or eax, dword [ecx + 4]
mov ah, 1
mov dword [esp + 4], edi
mov edi, dword [esp + 0x10]
setne al
and al, dl
mov edx, dword [esi + 8]
mov dword [ebp], ecx
mov ecx, dword [esp + 4]
test ah, ah
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [ebp + 0x14], ebx
mov word [ebp + 0x18], cx
mov byte [ebp + 0x1a], al
je 0x64a80b
add esp, 0x30
jmp 0x64a81e
add esi, 0xc
push edx
push dword [esp + 0x14]
push esi
mov eax, dword [esp + 0x24]
call dword [eax + 0xc]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x20]
mov ecx, edi
push 0x8ac110
call fcn.007c1be0
int3
Function at 0x66f4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov eax, dword [ecx]
mov esi, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, eax
xor ecx, 3
lock cmpxchg dword [esi], ecx
jne 0x66f4d0
test al, 1
je 0x66f563
test al, 2
jne 0x66f577
test al, 8
jne 0x66f50d
lea ecx, [esi + 0x18]
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0xa
call fcn.0066fa90
jmp 0x66f52b
test al, 0x10
je 0x66f52b
mov eax, dword [esi + 0x470]
test eax, eax
je 0x66f5e3
push dword [esi + 0x474]
call dword [eax + 8]
add esp, 4
mov ecx, dword [esi + 0x18]
mov edx, esi
call fcn.0072a840
cmp eax, 1
mov eax, 2
sbb eax, 0
mov dword [esp], eax
shl eax, 6
neg eax
lock xadd dword [esi], eax
shr eax, 6
cmp eax, dword [esp]
jb 0x66f58b
jne 0x66f55d
mov ecx, esi
call fcn.0066f400
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, str.assertion_failed:_prev.is_running__
mov edx, 0x23
push 0x938094
call fcn.007c1ca0
mov ecx, 0x9380a4
mov edx, 0x25
push 0x9380cc
call fcn.007c1ca0
lea ecx, [esp + 4]
mov edx, esp
mov dword [esp + 0x18], 0x9380ec
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x4631b0
mov dword [esp + 0x10], edx
mov edx, 0x9380fc
mov dword [esp + 0x14], 0x4631b0
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 2
call fcn.007c1b50
lea ecx, [esp + 0x18]
mov edx, 0x937d4c
mov dword [esp + 0x18], 0x937d44
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0x93d1f8
mov dword [esp + 0x24], 0
call fcn.007c1b50
int3