joyce8/EMBER2024-capa huggingface dataset:
Function at 0x516470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [edx], 1
mov dword [ebp - 0x18], ecx
jne 0x5164a2
mov ecx, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
mov esi, dword [edx + 0x3c]
lea eax, [edx + 8]
mov dword [ebp - 0x14], ecx
je 0x5164b6
mov ecx, dword [ebp - 0x18]
mov edx, eax
push 0
jmp 0x5164bd
cmp byte [edx + 0xe], 0
je 0x5164d0
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
add esp, 0x10
jmp 0x5164cb
mov ecx, dword [ebp - 0x18]
mov edx, eax
push 1
push esi
push ebx
push edi
push dword [ebp - 0x14]
call fcn.00586840
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov bl, byte [edx + 0xc]
mov edi, dword [edx + 4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ecx
jmp 0x516505
add edi, ecx
mov ecx, esi
mov esi, dword [ebp - 0x14]
mov dword [edx + 4], edi
mov ebx, dword [edx + 0xc]
test ebx, 0xff0000
jne 0x5164a8
mov eax, ebx
xor al, 1
test edi, edi
mov byte [edx + 0xc], al
je 0x516526
cmp esi, edi
jbe 0x516520
cmp byte [ecx + edi], 0xbf
jg 0x516526
jmp 0x5165f0
jne 0x5165f0
cmp edi, esi
je 0x5165cd
movzx eax, byte [ecx + edi]
test al, al
jns 0x51658e
movzx ecx, byte [ecx + edi + 1]
mov edx, eax
and edx, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x516575
mov esi, dword [ebp - 0x10]
shl ecx, 6
movzx esi, byte [esi + edi + 2]
and esi, 0x3f
or esi, ecx
cmp al, 0xf0
jb 0x516581
mov ecx, dword [ebp - 0x10]
and edx, 7
shl esi, 6
shl edx, 0x12
movzx eax, byte [ecx + edi + 3]
and eax, 0x3f
or eax, esi
or eax, edx
jmp 0x51658b
shl edx, 6
or edx, ecx
mov ecx, dword [ebp - 0x10]
mov eax, edx
jmp 0x51658b
mov ecx, dword [ebp - 0x10]
shl edx, 0xc
or esi, edx
mov eax, esi
mov edx, dword [ebp - 0x1c]
test bl, bl
jne 0x5165da
cmp eax, 0x110000
je 0x5165d1
mov esi, ecx
mov ecx, 1
cmp eax, 0x80
jb 0x5164f0
mov ecx, 2
cmp eax, 0x800
jb 0x5164f0
cmp eax, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x5164f0
test bl, bl
jne 0x5165dc
mov byte [edx + 0xe], 1
jmp 0x5164a8
mov esi, edi
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax], 1
jmp 0x5164b1
mov edx, esi
push 0x6dd4e8
push esi
push edi
call fcn.0045d720
add esp, 0xc
ud2
Function at 0x51ee70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], ecx
mov cl, 1
lea esi, [eax + 1]
mov dword [edx + 8], esi
mov edi, dword [edx + 4]
mov ebx, dword [edx]
cmp esi, edi
jae 0x51eead
mov cl, byte [ebx + esi]
cmp cl, 0x2b
je 0x51eea3
cmp cl, 0x2d
mov cl, 1
jne 0x51eead
xor ecx, ecx
jmp 0x51eea5
mov cl, 1
add eax, 2
mov esi, eax
mov dword [edx + 8], eax
cmp esi, edi
jae 0x51f040
mov al, byte [ebx + esi]
mov dword [ebp - 0x18], ecx
mov ecx, edx
lea edx, [esi + 1]
mov dword [ebp - 0x14], ecx
mov dword [ecx + 8], edx
add al, 0xd0
cmp al, 0xa
jae 0x51f050
mov ecx, dword [ebp + 0xc]
cmp edx, edi
movzx eax, al
mov dword [ebp - 0x28], ecx
jae 0x51ef47
mov edx, dword [ebp - 0x14]
neg edi
add esi, 2
jmp 0x51ef03
movzx ecx, cl
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
lea ecx, [edi + esi + 1]
inc esi
cmp ecx, 1
je 0x51ef4a
movzx ecx, byte [ebx + esi - 1]
add cl, 0xd0
cmp cl, 0xa
jae 0x51ef4a
cmp eax, 0xccccccc
mov dword [edx + 8], esi
jl 0x51eef0
jne 0x51ef21
cmp cl, 7
jbe 0x51eef0
mov ecx, dword [ebp - 0x28]
xor eax, eax
movzx esi, byte [ebp - 0x18]
movzx edi, byte [ebp + 8]
or ecx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
sete al
push esi
push eax
push edi
call fcn.0051f0b0
add esp, 0x28
jmp 0x51f02c
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp + 0x14]
cmp byte [ebp - 0x18], 0
je 0x51ef66
mov esi, edi
xor ecx, ecx
add esi, eax
setns cl
add ecx, 0x7fffffff
add edi, eax
jmp 0x51ef75
xor ecx, ecx
cmp edi, eax
setns cl
add ecx, 0x7fffffff
sub edi, eax
cmovo edi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movd xmm0, eax
movd xmm1, ecx
mov eax, edi
punpckldq xmm1, xmm0
neg eax
punpckldq xmm1, xmmword [0x606e40]
cmovl eax, edi
cmp eax, 0x135
subpd xmm1, xmmword [0x606e50]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
jb 0x51efe8
movsd xmm2, qword [0x606e60]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x51efc8
jnp 0x51f035
test edi, edi
jns 0x51f085
divsd xmm0, xmm2
add edi, 0x134
mov eax, edi
neg eax
cmovl eax, edi
cmp eax, 0x135
jae 0x51efc0
movsd xmm1, qword [eax*8 + 0x6d1c08]
test edi, edi
js 0x51f031
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x606e70]
mov esi, dword [ebp - 0x10]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x606e80]
jae 0x51f070
cmp byte [ebp + 8], 0
jne 0x51f020
xorpd xmm0, xmmword [0x606e90]
movsd qword [esi + 8], xmm0
xor eax, eax
mov dword [esi], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
divsd xmm0, xmm1
mov esi, dword [ebp - 0x10]
cmp byte [ebp + 8], 0
je 0x51f018
jmp 0x51f020
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 5
mov edx, eax
jmp 0x51f05d
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], 0xc
lea edx, [ebp - 0x24]
call fcn.0046b640
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], 1
jmp 0x51f029
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 0xd
mov edx, eax
call fcn.0046b640
jmp 0x51f09b
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 0xd
mov edx, eax
call fcn.0046b640
mov esi, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, 1
jmp 0x51f027
Function at 0x51ff70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [edx + 8]
mov dword [ebp - 0x10], ecx
mov cl, 1
lea esi, [eax + 1]
mov dword [edx + 8], esi
mov edi, dword [edx + 4]
mov ebx, dword [edx]
cmp esi, edi
jae 0x51ffad
mov cl, byte [ebx + esi]
cmp cl, 0x2b
je 0x51ffa3
cmp cl, 0x2d
mov cl, 1
jne 0x51ffad
xor ecx, ecx
jmp 0x51ffa5
mov cl, 1
add eax, 2
mov esi, eax
mov dword [edx + 8], eax
cmp esi, edi
jae 0x520140
mov al, byte [ebx + esi]
mov dword [ebp - 0x18], ecx
mov ecx, edx
lea edx, [esi + 1]
mov dword [ebp - 0x14], ecx
mov dword [ecx + 8], edx
add al, 0xd0
cmp al, 0xa
jae 0x520150
mov ecx, dword [ebp + 0xc]
cmp edx, edi
movzx eax, al
mov dword [ebp - 0x28], ecx
jae 0x520047
mov edx, dword [ebp - 0x14]
neg edi
add esi, 2
jmp 0x520003
movzx ecx, cl
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
lea ecx, [edi + esi + 1]
inc esi
cmp ecx, 1
je 0x52004a
movzx ecx, byte [ebx + esi - 1]
add cl, 0xd0
cmp cl, 0xa
jae 0x52004a
cmp eax, 0xccccccc
mov dword [edx + 8], esi
jl 0x51fff0
jne 0x520021
cmp cl, 7
jbe 0x51fff0
mov ecx, dword [ebp - 0x28]
xor eax, eax
movzx esi, byte [ebp - 0x18]
movzx edi, byte [ebp + 8]
or ecx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
sete al
push esi
push eax
push edi
call fcn.00520330
add esp, 0x28
jmp 0x52012c
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp + 0x14]
cmp byte [ebp - 0x18], 0
je 0x520066
mov esi, edi
xor ecx, ecx
add esi, eax
setns cl
add ecx, 0x7fffffff
add edi, eax
jmp 0x520075
xor ecx, ecx
cmp edi, eax
setns cl
add ecx, 0x7fffffff
sub edi, eax
cmovo edi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movd xmm0, eax
movd xmm1, ecx
mov eax, edi
punpckldq xmm1, xmm0
neg eax
punpckldq xmm1, xmmword [0x606fb0]
cmovl eax, edi
cmp eax, 0x135
subpd xmm1, xmmword [0x606fc0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
jb 0x5200e8
movsd xmm2, qword [0x606fd0]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x5200c8
jnp 0x520135
test edi, edi
jns 0x520185
divsd xmm0, xmm2
add edi, 0x134
mov eax, edi
neg eax
cmovl eax, edi
cmp eax, 0x135
jae 0x5200c0
movsd xmm1, qword [eax*8 + 0x6d1c08]
test edi, edi
js 0x520131
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x606fe0]
mov esi, dword [ebp - 0x10]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x606ff0]
jae 0x520170
cmp byte [ebp + 8], 0
jne 0x520120
xorpd xmm0, xmmword [0x607000]
movsd qword [esi + 8], xmm0
xor eax, eax
mov dword [esi], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
divsd xmm0, xmm1
mov esi, dword [ebp - 0x10]
cmp byte [ebp + 8], 0
je 0x520118
jmp 0x520120
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 5
mov edx, eax
jmp 0x52015d
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], 0xc
lea edx, [ebp - 0x24]
call fcn.0051c4e0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov dword [ecx], 1
jmp 0x520129
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 0xd
mov edx, eax
call fcn.0051c4e0
jmp 0x52019b
lea eax, [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x24], 0xd
mov edx, eax
call fcn.0051c4e0
mov esi, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, 1
jmp 0x520127
Function at 0x52a410
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
test edx, edx
je 0x52a447
nop dword [eax]
test edx, edx
je 0x52a447
lea edi, [ecx + edx]
push 2
push edx
push ecx
push 0
call sub.bcrypt.dll_BCryptGenRandom
xor edx, edx
cmp eax, 0xc0000000
mov ecx, edi
jb 0x52a420
mov esi, eax
xor esi, 0x80000000
jne 0x52a44b
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x6f1130]
test eax, eax
jne 0x52a462
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x52a470
mov dword [0x6f1130], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x52a481
mov ecx, 4
mov edx, 4
call fcn.0040a640
ud2
mov dword [eax], esi
mov ecx, str.Rng::fill_failed_cargo_registry_src_github.com_1ecc6299db9ec823_rand_0.8.4_src_rng.rs
mov edx, 0x10
push 0x684f50
call fcn.0045aec0
add esp, 4
ud2
Function at 0x553ce0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
push str.api_ms_win_core_synch_l1_2_0.dll
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x553d34
mov esi, eax
push str.WaitOnAddress
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x553d34
mov ebx, eax
push str.WakeByAddressSingle
push esi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x553d34
mov esi, eax
mov dword [ebp - 0x10], 1
mov eax, dword [0x6f1130]
test eax, eax
jne 0x553dc2
jmp 0x553db4
push 0x6887e8
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x553e18
mov ebx, eax
push str.NtCreateKeyedEvent
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x553e18
mov edi, eax
push str.NtReleaseKeyedEvent
push ebx
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x553e18
mov esi, eax
push str.NtWaitForKeyedEvent
push ebx
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x553e18
mov ebx, eax
lea eax, [ebp - 0x18]
push 0
push 0
push 0xc0000000
push eax
call edi
test eax, eax
jne 0x553e18
test esi, esi
je 0x553e18
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x553dc2
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x553e1f
mov dword [0x6f1130], eax
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x553e1f
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], ebx
mov dword [edi + 8], esi
mov dword [edi + 0xc], eax
xor eax, eax
lock cmpxchg dword [0x6f108c], edi
je 0x553e0e
cmp dword [edi], 0
mov esi, eax
jne 0x553dfe
push dword [edi + 4]
call sub.KERNEL32.dll_CloseHandle
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov edi, esi
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00553e30
ud2
mov ecx, 0x10
mov edx, 4
call fcn.0040a640
ud2
Function at 0x556bd0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x2c
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push 2
push 4
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x556bfe
mov esi, eax
xor esi, 0x80000000
jne 0x556c07
mov eax, dword [ebp - 8]
add esp, 0x2c
pop esi
pop ebp
ret
mov eax, dword [0x6f1130]
test eax, eax
jne 0x556c1e
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x556c2c
mov dword [0x6f1130], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x556c3d
mov ecx, 4
mov edx, 4
call fcn.0040a640
ud2
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
mov dword [eax], esi
mov dword [ebp - 0x30], 0x688fc8
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x688f94
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x30]
mov edx, 0x68901c
mov dword [ebp - 0x14], 0x556b20
mov dword [ebp - 0x1c], 1
call fcn.0045a2c0
ud2
Function at 0x56eee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x60504c]
test eax, eax
je 0x56eefa
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x56ef0f
jmp 0x56ef22
mov ecx, 0x60504c
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x56ef22
mov ecx, eax
xor esi, esi
add ecx, 4
cmp dword [eax], 1
cmove esi, ecx
je 0x56efb7
mov eax, dword [0x60504c]
test eax, eax
je 0x56efbc
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x56efd5
mov esi, eax
test eax, eax
jne 0x56ef9a
mov eax, dword [0x6f1130]
test eax, eax
jne 0x56ef5f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x56eff5
mov dword [0x6f1130], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x56eff5
mov dword [eax], 0
mov dword [eax + 8], 0x60504c
mov esi, eax
mov eax, dword [0x60504c]
test eax, eax
jne 0x56ef93
mov ecx, 0x60504c
call fcn.005dcc80
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, 1
lock xadd dword [0x605048], eax
test eax, eax
je 0x56efdc
mov dword [esi], 1
mov dword [esi + 4], eax
add esi, 4
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x60504c
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x56ef3e
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x689d44
mov edx, 0x2b
push 0x689d70
call fcn.0056a990
add esp, 4
ud2
mov ecx, 0xc
mov edx, 4
call fcn.0040a640
ud2
Function at 0x5bf890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x5bf8a6
test eax, eax
jne 0x5bf9be
mov edi, dword [0x6f1144]
test edi, edi
je 0x5bf9be
xor ebx, ebx
jmp 0x5bf8c7
mov edi, dword [edi + 8]
test edi, edi
je 0x5bf8e9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5bf8c0
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x5bf8c0
test bl, 1
je 0x5bf9be
mov edi, dword [0x6f1144]
test edi, edi
je 0x5bf9be
xor ebx, ebx
jmp 0x5bf917
mov edi, dword [edi + 8]
test edi, edi
je 0x5bf939
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5bf910
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x5bf910
test bl, 1
je 0x5bf9be
mov edi, dword [0x6f1144]
test edi, edi
je 0x5bf9be
xor ebx, ebx
jmp 0x5bf957
mov edi, dword [edi + 8]
test edi, edi
je 0x5bf979
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5bf950
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x5bf950
test bl, 1
je 0x5bf9be
mov edi, dword [0x6f1144]
test edi, edi
je 0x5bf9be
xor ebx, ebx
jmp 0x5bf997
mov edi, dword [edi + 8]
test edi, edi
je 0x5bf9b9
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5bf990
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
mov bl, 1
jmp 0x5bf990
test bl, 1
jne 0x5bf9c5
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x6f1144]
jmp 0x5bf9d0
mov edi, dword [edi + 8]
test edi, edi
je 0x5bf9be
push dword [edi + 4]
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5bf9cd
mov esi, eax
push 0
push dword [edi + 4]
call sub.KERNEL32.dll_TlsSetValue
push esi
call dword [edi]
add esp, 4
jmp 0x5bf9cd
Function at 0x5bfac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x6050f0]
test eax, eax
je 0x5bfadb
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x5bfaf0
jmp 0x5bfaff
mov ecx, 0x6050f0
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x5bfaff
cmp dword [eax], 1
mov edi, eax
jne 0x5bfaff
add edi, 4
jmp 0x5bfbb0
mov eax, dword [0x6050f0]
test eax, eax
je 0x5bfb21
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5bfb35
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x5bfbb0
jmp 0x5bfb83
mov ecx, 0x6050f0
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x5bfb12
mov eax, dword [0x6f1130]
test eax, eax
jne 0x5bfb4c
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x5bfbb6
mov dword [0x6f1130], eax
push 0x10
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x5bfbb6
mov dword [eax], 0
mov dword [eax + 0xc], 0x6050f0
mov esi, eax
mov eax, dword [0x6050f0]
test eax, eax
jne 0x5bfb7c
mov ecx, 0x6050f0
call fcn.005dcc80
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
je 0x5bfbb0
test ecx, ecx
je 0x5bfbb0
lock dec dword [ecx]
jne 0x5bfbb0
call fcn.004023c0
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x10
mov edx, 4
call fcn.0040a640
ud2

Function at 0x5c0230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x6050f8]
test eax, eax
je 0x5c024a
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x5c025f
jmp 0x5c026a
mov ecx, 0x6050f8
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x5c026a
cmp dword [eax], 1
mov esi, eax
je 0x5c02f7
mov eax, dword [0x6050f8]
test eax, eax
je 0x5c0288
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5c029c
xor esi, esi
cmp eax, 1
je 0x5c02fa
mov esi, eax
jmp 0x5c02ea
mov ecx, 0x6050f8
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x5c027d
mov eax, dword [0x6f1130]
test eax, eax
jne 0x5c02b3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x5c02ff
mov dword [0x6f1130], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x5c02ff
mov dword [eax], 0
mov dword [eax + 8], 0x6050f8
mov esi, eax
mov eax, dword [0x6050f8]
test eax, eax
jne 0x5c02e3
mov ecx, 0x6050f8
call fcn.005dcc80
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0xc
mov edx, 4
call fcn.0040a640
ud2
Function at 0x5c06a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x6050e4]
test eax, eax
je 0x5c06bb
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x5c06d0
jmp 0x5c06df
mov ecx, 0x6050e4
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x5c06df
cmp dword [eax], 1
mov edi, eax
jne 0x5c06df
add edi, 4
jmp 0x5c0789
mov eax, dword [0x6050e4]
test eax, eax
je 0x5c0701
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x5c0715
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x5c0789
jmp 0x5c0763
mov ecx, 0x6050e4
call fcn.005dcc80
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
jne 0x5c06f2
mov eax, dword [0x6f1130]
test eax, eax
jne 0x5c072c
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x5c078f
mov dword [0x6f1130], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x5c078f
mov dword [eax], 0
mov dword [eax + 8], 0x6050e4
mov esi, eax
mov eax, dword [0x6050e4]
test eax, eax
jne 0x5c075c
mov ecx, 0x6050e4
call fcn.005dcc80
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi + 4]
cmp dword [esi], 0
lea edi, [esi + 4]
mov dword [esi], 1
mov dword [esi + 4], 0
je 0x5c0789
test ecx, ecx
je 0x5c0789
lock dec dword [ecx]
jne 0x5c0789
call fcn.005c09a0
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0xc
mov edx, 4
call fcn.0040a640
ud2
Function at 0x5c1a50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x41c
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x428]
push 0x400
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [0x6dd42c]
mov esi, 0x200
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0
cmp esi, 0x201
jae 0x5c1abe
jmp 0x5c1af0
cmp edi, esi
mov esi, edi
jb 0x5c1b35
cmp esi, 0x201
jb 0x5c1af0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, esi
sub eax, edx
sub ecx, edx
cmp ecx, eax
jb 0x5c1adb
mov edi, dword [ebp - 0x10]
mov ebx, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
jmp 0x5c1afb
lea ecx, [ebp - 0x28]
push eax
call fcn.005d96d0
add esp, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
jmp 0x5c1ace
lea edi, [ebp - 0x428]
mov ebx, 0x200
mov dword [ebp - 0x18], edi
push 0
call sub.KERNEL32.dll_SetLastError
push edi
push esi
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov edi, eax
test eax, eax
jne 0x5c1b1b
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x5c1b58
cmp edi, esi
jne 0x5c1ab0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x5c1ab0
add esi, esi
cmp esi, 0x201
jb 0x5c1af0
jmp 0x5c1abe
cmp edi, ebx
ja 0x5c1ba0
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea ecx, [esi + 4]
push edi
call fcn.005c2940
add esp, 4
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x5c1b78
jmp 0x5c1b95
call sub.KERNEL32.dll_GetLastError
mov esi, dword [ebp - 0x14]
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
mov dword [esi], eax
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x5c1b95
cmp dword [ebp - 0x10], 0
je 0x5c1b95
and eax, 0x7fffffff
je 0x5c1b95
push dword [ebp - 0x10]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
add esp, 0x41c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
mov edx, ebx
push 0x6d5e10
call fcn.0045ab50
add esp, 4
ud2