joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
xor ebp, ebp
push esi
test ebx, ebx
je 0x441444
mov esi, ebx
jmp 0x441456
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
je 0x441544
lea eax, [esp + 0x18]
push eax
push 0x18
pop eax
push eax
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x441539
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.00423ff0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], edi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x18
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x441538
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push edi
push 0
push dword [esp + 0x78]
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul edi, dword [esp + 0x14]
test edi, edi
jle 0x441538
mov ebp, dword [esp + 0x10]
push 3
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
add eax, ecx
movzx ecx, byte [ebp]
add eax, ecx
div ebx
mov byte [ebp], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 1], al
mov ecx, dword [esp + 0x10]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, ebx
mov dword [esp + 0x10], ebp
sub edi, 1
jne 0x4414fc
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
pop edi
test ebx, ebx
jne 0x441544
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x441fab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebp
xor ebp, ebp
cmp dword [0x63c5dc], ebp
je 0x442191
push ebx
mov ebx, dword [esp + 0x60]
push edi
test ebx, ebx
je 0x441fcb
mov edi, ebx
jmp 0x441fdd
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x44218f
lea eax, [esp + 0x18]
push eax
push 0x18
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x442184
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push esi
mov esi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.00423ff0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], esi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x442183
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push esi
push 0
push dword [esp + 0x78]
push edi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul esi, dword [esp + 0x14]
test esi, esi
jle 0x442183
cmp dword [esp + 0x6c], 0
je 0x442130
mov ebp, dword [esp + 0x10]
push 0xa
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
lea eax, [eax + ecx*2]
movzx ecx, byte [ebp]
imul eax, eax, 3
add eax, ecx
div ebx
mov cl, al
cmp cl, 0x40
jae 0x4420c4
movzx eax, cl
sub eax, 0x40
imul eax, eax, 7
cdq
idiv ebx
lea ecx, [eax + 0x40]
jmp 0x4420da
cmp cl, 0xc0
jbe 0x4420da
movzx eax, cl
sub eax, 0xc0
imul eax, eax, 7
cdq
idiv ebx
lea ecx, [eax - 0x40]
movzx eax, byte [ebp + 3]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movzx eax, cl
movd xmm0, eax
divss xmm1, dword [0x5f06cc]
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm0
cvttss2si ecx, xmm1
mov byte [ebp], cl
mov eax, dword [esp + 0x10]
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, 4
mov dword [esp + 0x10], ebp
sub esi, 1
jne 0x442094
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
jmp 0x442183
mov edx, dword [esp + 0x10]
mov al, byte [edx + 3]
cmp al, 0xff
jae 0x442177
movzx ecx, al
movzx eax, byte [edx]
imul ecx, eax
shr ecx, 8
mov byte [edx], cl
mov edx, dword [esp + 0x10]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 3]
imul ecx, eax
shr ecx, 8
mov byte [edx + 1], cl
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
imul ecx, eax
shr ecx, 8
mov byte [edx + 2], cl
mov edx, dword [esp + 0x10]
add edx, 4
mov dword [esp + 0x10], edx
sub esi, 1
jne 0x442134
pop esi
test ebx, ebx
jne 0x44218f
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x50
ret 0xc
Function at 0x443330
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x443368
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x443363
xor eax, eax
cmp dword [esp + 0xc], esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call fcn.00427770
add dword [edi + 8], esi
add esp, 0xc
mov eax, 1
pop edi
pop esi
ret
Function at 0x4470ee
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push dword [0x63c610]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x44714f
push esi
push dword [0x63c60c]
push 8
push dword [0x63a35c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push dword [0x63c610]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [0x63c608]
jmp 0x44713f
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x44713d
mov eax, dword [esi + 8]
add eax, edi
push eax
call ecx
pop ecx
mov esi, dword [esi]
test esi, esi
jne 0x44712d
push edi
push 0x44708c
call fcn.005a646c
pop esi
mov eax, dword [esp + 8]
add eax, edi
pop edi
ret 4

Function at 0x447159
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ecx, edi
and ecx, 3
je 0x44716f
push 4
pop eax
sub eax, ecx
add edi, eax
mov esi, dword [0x63c60c]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
jne 0x4471a8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push edi
push 8
push dword [0x63a35c]
mov dword [0x63c610], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push dword [0x63c610]
call ebx
mov esi, dword [0x63c60c]
lea eax, [edi + esi]
push eax
push dword [0x63c610]
mov dword [0x63c60c], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
push 8
push dword [0x63a35c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebp, eax
push ebp
push dword [0x63c610]
call ebx
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test edi, edi
jne 0x4471e7
test ebx, ebx
je 0x447208
push 0x14
push 0x63c608
call fcn.00447a0e
pop ecx
pop ecx
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
test edi, edi
je 0x447208
lea ecx, [esi + ebp]
push ecx
call edi
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x447b80
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov edi, eax
mov ebp, dword [esp + 0x14]
mov esi, dword [edi + 8]
mov ecx, dword [ebp]
sub esi, ebx
lea eax, [esi + 0xa]
push eax
test ecx, ecx
jne 0x447bb9
push ecx
push dword [0x63dab8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x447bc8
push ecx
push 0
push dword [0x63dab8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
shr esi, 1
mov dword [ebp], ecx
mov eax, dword [edi]
push esi
add eax, ebx
push eax
push ecx
call fcn.00447ed0
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x447bf0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add dword [eax + 8], 2
ret

Function at 0x447cb0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
add ecx, dword [eax]
mov eax, ecx
ret
Function at 0x447db0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [esp + 0x18]
mov esi, eax
cmp ebx, 0xffffffff
jne 0x447dce
mov ebx, dword [esi + 8]
mov eax, dword [esp + 0x14]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
lea ebp, [eax + eax]
add ecx, ebp
lea eax, [edx - 4]
cmp ecx, eax
jl 0x447df2
lea eax, [ecx + 0x4000]
mov dword [esi + 4], eax
add eax, 0xa
jmp 0x447e0d
cmp edx, 0x100000
jle 0x447e20
cmp ecx, 0x100000
jge 0x447e07
mov ecx, 0x100000
mov dword [esi + 4], ecx
lea eax, [ecx + 0xa]
push eax
push dword [esi]
push 0
push dword [0x63dab8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi], eax
lea eax, [ebx + ebp]
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
pop ebp
add eax, ebx
pop ebx
ret 8

Function at 0x447e40
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
neg ecx
add ecx, ecx
add dword [eax + 8], ecx
ret 4

Function at 0x447e80
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
mov eax, dword [esp + 4]
mov edx, dword [ecx]
cmp eax, edx
jb 0x447ea7
mov ecx, dword [ecx + 8]
add ecx, edx
cmp eax, ecx
ja 0x447ea7
sub eax, edx
inc eax
ret 4
xor eax, eax
ret 4

Function at 0x447eb0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
dec eax
add eax, ecx
ret 4

Function at 0x447f10
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
add eax, dword [esp + 4]
ret 4

Function at 0x4480a0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x634c1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, dword [eax]
add eax, ecx
ret 4
Function at 0x449dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x449f55
cmp dword [esi + 0x20], 0
je 0x449f55
cmp dword [esi + 0x24], 0
je 0x449f55
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x449f55
cmp dword [eax], esi
jne 0x449f55
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x449e35
cmp eax, 0x39
je 0x449e35
cmp eax, 0x45
je 0x449e35
cmp eax, 0x49
je 0x449e35
cmp eax, 0x5b
je 0x449e35
cmp eax, 0x67
je 0x449e35
cmp eax, 0x71
je 0x449e35
cmp eax, 0x29a
jne 0x449f55
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x449e6e
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
push 0
mov edx, 0x39
cmove eax, edx
push 0
mov dword [edi + 4], eax
push 0
jne 0x449e90
call fcn.0044e890
jmp 0x449e95
call fcn.0044e4d0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0xfffffffe
push edi
call fcn.0044cd60
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.00423ff0
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x5f0862]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x5f0860]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x5f0864]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x5f0866]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x4638f0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x463907
call fcn.004151db
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call fcn.004157e2
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x463951
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x463944
call fcn.004151db
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.00463220
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x4a8ec0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4a8ee0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4a8ee0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4a8ee0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4d6a70
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push esi
mov esi, dword [esp + 0xc]
call fcn.0058a370
test eax, eax
jne 0x4d6bd0
push edi
cmp byte [0x635d24], al
jne 0x4d6a8f
xor edi, edi
jmp 0x4d6aaa
push 5
call dword [0x635d68]
mov edi, eax
add esp, 4
test edi, edi
je 0x4d6aaa
push edi
call dword [0x635d70]
add esp, 4
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x4d6bb6
test esi, esi
je 0x4d6bb6
cmp dword [0x63cf50], 0
jne 0x4d6b46
push 0
call fcn.004c15e0
movups xmm0, xmmword [str.expand_32_byte_k]
add esp, 4
movups xmmword [0x63cf50], xmm0
test eax, eax
jne 0x4d6af6
push 0x2c
push eax
push 0x63cf60
call fcn.00423ff0
add esp, 0xc
jmp 0x4d6b28
push ebp
mov ebp, dword [0x635e34]
test ebp, ebp
je 0x4d6b17
push 0x2c
push 0
push 0x63cf60
call fcn.00423ff0
mov dword [0x63cf60], ebp
jmp 0x4d6b24
push 0x63cf60
push 0x2c
push eax
mov eax, dword [eax + 0x38]
call eax
add esp, 0xc
pop ebp
mov eax, dword [0x63cf80]
xor cl, cl
mov dword [0x63cf8c], eax
mov dword [0x63cf80], 0
mov byte [0x63cfd0], cl
jmp 0x4d6b4c
mov cl, byte [0x63cfd0]
movzx eax, cl
cmp ebx, eax
jle 0x4d6b99
test cl, cl
je 0x4d6b74
movzx eax, cl
push eax
push 0x63cf90
push esi
call fcn.00427770
movzx eax, byte [0x63cfd0]
add esp, 0xc
sub ebx, eax
add esi, eax
inc dword [0x63cf80]
push 0x63cf50
push 0x63cf90
call fcn.004e03d0
add esp, 8
mov cl, 0x40
mov byte [0x63cfd0], cl
cmp ebx, 0x40
jg 0x4d6b53
movzx eax, cl
sub eax, ebx
push ebx
add eax, 0x63cf90
push eax
push esi
call fcn.00427770
add esp, 0xc
sub byte [0x63cfd0], bl
jmp 0x4d6bc0
mov dword [0x63cf50], 0
test edi, edi
je 0x4d6bce
push edi
call dword [0x635d78]
add esp, 4
pop ebx
pop edi
pop esi
ret
Function at 0x528780
Capabilities:
Reference sql statements

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
push dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov byte [edi + 0x10], 1
push ebx
push ebx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push edi
call fcn.005583e0
add esp, 0x1c
cmp dword [esp + 0x14], 0
jne 0x5287c8
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push edi
call fcn.005583e0
add esp, 0x14
pop edi
pop ebx
ret
Function at 0x591cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push 0
push 0x14
mov dword [ebp], 0
call fcn.00557720
mov esi, eax
add esp, 8
test esi, esi
jne 0x591cd5
lea eax, [esi + 7]
pop esi
pop ebp
ret
cmp byte [0x635d24], 0
push ebx
push edi
je 0x591d27
mov eax, dword [0x635e20]
test eax, eax
je 0x591cf7
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x591d27
mov eax, dword [esp + 0x18]
lea ebx, [esi + 4]
push ebx
push 0
push esi
push 0x56b4c0
lea edi, [esi + 8]
mov dword [edi], eax
mov eax, dword [esp + 0x2c]
push 0
push 0
mov dword [esi + 0xc], eax
call fcn.005d0940
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x591d3a
jmp 0x591d2d
lea edi, [esi + 8]
lea ebx, [esi + 4]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [edi], 0
jne 0x591d55
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [esp + 0x1c]
mov dword [ebx], eax
call dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
pop ebx
mov dword [ebp], esi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x595dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x635e20]
sub esp, 0x6c
test eax, eax
je 0x595e11
push 0x28a
call eax
add esp, 4
test eax, eax
je 0x595e11
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 3
push 0
push 0xc0000006
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
push esi
push edi
mov edi, dword [esp + 0x78]
cmp byte [edi + 0x2b], 2
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
movups xmm0, xmmword [esi]
movups xmmword [esp + 0x14], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [esp + 0x24], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [esp + 0x34], xmm0
je 0x595e4a
mov eax, dword [edi + 4]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
call eax
add esp, 4
movups xmm0, xmmword [esi + 0x30]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x44]
movups xmmword [esp + 0x44], xmm0
movups xmm0, xmmword [esi + 0x40]
movups xmmword [esp + 0x54], xmm0
movups xmm0, xmmword [esi + 0x50]
mov esi, 0x2c
movups xmmword [esp + 0x64], xmm0
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x595f32
add ecx, 4
add edx, 4
sub esi, 4
jae 0x595e72
cmp byte [esp + 0x20], 0
je 0x595f32
lea eax, [esp + 8]
push eax
push 0
push 0x28
lea eax, [esp + 0x20]
push eax
push 1
call fcn.005943a0
mov eax, dword [esp + 0x1c]
add esp, 0x14
cmp eax, dword [esp + 0x3c]
jne 0x595f32
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x40]
jne 0x595f32
push ebx
lea ecx, [edi + 0x34]
mov esi, 0x2c
lea edx, [esp + 0x18]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x595eea
add ecx, 4
add edx, 4
sub esi, 4
jae 0x595ed0
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x6c
ret
mov eax, dword [esp + 0x80]
movups xmm0, xmmword [esp + 0x18]
pop ebx
mov dword [eax], 1
movups xmmword [edi + 0x34], xmm0
movups xmm0, xmmword [esp + 0x24]
movups xmmword [edi + 0x44], xmm0
movups xmm0, xmmword [esp + 0x34]
movups xmmword [edi + 0x54], xmm0
movzx ecx, word [edi + 0x42]
mov eax, ecx
and ecx, 0xfe00
and eax, 1
shl eax, 0x10
add eax, ecx
mov dword [edi + 0x24], eax
xor eax, eax
pop edi
pop esi
add esp, 0x6c
ret
pop edi
mov eax, 1
pop esi
add esp, 0x6c
ret
Function at 0x5a646c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x63d124], 0
push ebx
push esi
mov esi, 0x63d12c
jne 0x5a6498
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x63d144], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x63d124], 1
push dword [0x63d144]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x5a6535
push 0x14
push 8
push dword [0x63a35c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x5a655f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x63d128]
test eax, eax
je 0x5a64da
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x63d128], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x5a6564
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x63d144]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x63a35c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x5a655f
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x5a6d40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5a6d6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5a6d6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5be81b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6342ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x612d68
push esi
call fcn.0041a8a2
pop ecx
pop ecx
test eax, eax
jne 0x5be849
xor al, al
jmp 0x5be8c6
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.005be4ae
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x5be883
push dword [ebp - 0x210]
call fcn.005a732a
xor al, al
jmp 0x5be8c4
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5be889
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x5be8a9
push edx
call fcn.005be752
pop ecx
test al, al
je 0x5be874
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x5be8b7
mov bl, 1
push dword [ebp - 0x210]
call fcn.005a732a
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040e6df
leave
ret