joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51b7a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x539940
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x51b81e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x5a5110
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x5a5140
mov dword [esi + 0x2c], fcn.00516bd0
mov dword [esi + 0x3c], 1
call fcn.0053ba80
ud2
Function at 0x51ea10
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
movzx eax, byte [edx]
mov esi, ecx
cmp al, 4
jne 0x51ea73
mov ebp, dword [edx + 4]
mov eax, dword [0x5b93cc]
cmp eax, 3
jne 0x51eb1f
mov edx, dword [ebp]
lea edi, [esp + 4]
mov ecx, edi
push 1
call fcn.0051b050
add esp, 4
movzx eax, byte [esp + 4]
cmp al, 4
jne 0x51ea87
mov eax, dword [esp + 8]
cmp word [ebp], 0
mov dword [esp], eax
je 0x51eaa9
movups xmm0, xmmword [ebp + 4]
mov edx, dword [ebp + 0x18]
lea eax, [ebp + 0x14]
add ebp, 0x1c
mov ecx, 0x1c
mov bx, 0x17
jmp 0x51eabb
movzx ecx, byte [edx + 3]
mov byte [esi + 3], cl
movzx ecx, word [edx + 1]
mov word [esi + 1], cx
mov ecx, dword [edx + 4]
jmp 0x51ea9c
movzx ecx, byte [esp + 7]
mov byte [esi + 3], cl
movzx ecx, word [esp + 5]
mov word [esi + 1], cx
mov ecx, dword [esp + 8]
mov byte [esi], al
mov dword [esi + 4], ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp + 2]
add ebp, 6
mov ecx, 0x10
mov bx, 2
xorps xmm0, xmm0
movzx ebp, word [ebp]
mov eax, dword [eax]
mov word [esp + 4], bx
rol bp, 8
mov word [esp + 6], bp
mov dword [esp + 8], eax
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edx
push ecx
push edi
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x51eaf6
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x51eaa1
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x51eaa1
call fcn.00546140
jmp 0x51ea31
Function at 0x51ec70
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5b8120]
test eax, eax
je 0x51ed50
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x51eca1
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x51ed4b
mov eax, dword [0x5b8120]
test eax, eax
je 0x51ed6f
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x51ed89
mov esi, eax
test eax, eax
jne 0x51ed0c
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0x20
call fcn.0051b940
test eax, eax
je 0x51eda2
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x5b8120
mov esi, eax
mov eax, dword [0x5b8120]
test eax, eax
je 0x51ed93
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x51ed2c
movaps xmm0, xmmword [esp]
jmp 0x51ed3a
lea ecx, [esp + 0x10]
call fcn.0051b7a0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x51ed8b
mov ecx, 0x5b8120
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x51ec94
jmp 0x51eca1
mov ecx, 0x5b8120
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x51ecbf
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x5b8120
call fcn.00545b80
jmp 0x51ed04
mov ecx, 8
mov edx, 0x20
call fcn.0053b730
int3
Function at 0x521df0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov eax, dword [0x5b8148]
test eax, eax
je 0x521e1a
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x521e30
mov ebx, eax
mov eax, dword [eax]
or eax, dword [ebx + 4]
je 0x521e30
add ebx, 8
jmp 0x521f07
mov ecx, 0x5b8148
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x521e09
mov eax, dword [0x5b8148]
test eax, eax
je 0x521eeb
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x521f05
mov esi, eax
test eax, eax
jne 0x521e97
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0x50
call fcn.0051b940
test eax, eax
je 0x521f1c
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x48], 0x5b8148
mov esi, eax
mov eax, dword [0x5b8148]
test eax, eax
je 0x521f0d
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi]
lea ebx, [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
mov dword [esi], 1
mov edi, ebx
or ecx, dword [esi + 4]
mov dword [esi + 4], 0
mov ecx, 0x10
mov esi, 0x5a6d58
rep movsd dword es:[edi], dword [esi]
je 0x521f07
cmp edx, 2
je 0x521f07
lock dec dword [eax]
sete cl
test edx, edx
je 0x521ede
test cl, cl
je 0x521f07
mov ecx, eax
call fcn.0051f200
jmp 0x521f07
test cl, cl
je 0x521f07
mov ecx, eax
call fcn.0051f1d0
jmp 0x521f07
mov ecx, 0x5b8148
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x521e4e
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
ret
mov ecx, 0x5b8148
call fcn.00545b80
jmp 0x521e8f
mov ecx, 8
mov edx, 0x50
call fcn.0053b730
int3
Function at 0x527320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5b8158]
test eax, eax
je 0x527346
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x52735c
cmp dword [eax + 4], 0
mov esi, eax
je 0x52735c
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0x5b8158
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x527337
mov eax, dword [0x5b8158]
test eax, eax
je 0x527417
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x527431
mov esi, eax
test eax, eax
jne 0x5273c0
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 8
call fcn.0051b940
test eax, eax
je 0x527455
mov dword [eax], 0x5b8158
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5b8158]
test eax, eax
je 0x527437
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0x14
call fcn.0051b940
test eax, eax
je 0x527446
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
add esi, 4
mov byte [eax + 0x10], 0
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
je 0x527342
lock dec dword [ecx]
jne 0x527342
call fcn.00413f60
mov eax, esi
pop esi
ret
mov ecx, 0x5b8158
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x52737a
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x5b8158
call fcn.00545b80
jmp 0x5273b8
mov ecx, 4
mov edx, 0x14
call fcn.0053b730
mov ecx, 4
mov edx, 8
call fcn.0053b730
int3
Function at 0x52daa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x539f80
mov esi, ecx
lea ebx, [ebp - 0x18]
mov ecx, dword fs:[0]
sub edi, eax
cmp edi, 0x100
mov dword [ebp - 0x18], ecx
mov dword fs:[0], ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
jne 0x52dc6f
mov edi, dword [esi]
lea ebx, [eax + 0x80]
mov edx, eax
mov ecx, ebx
lock cmpxchg8b qword [edi + 8]
jne 0x52dbee
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov esi, dword [eax + 0x14]
movzx edx, cl
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edi, dword [esi + edx*4]
mov ecx, esi
xor edx, edx
mov esi, 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], edi
nop word [eax + eax]
mov eax, dword [ebp - 0x20]
mov ebx, edi
add eax, esi
add esi, 1
movzx eax, al
adc edx, 0
mov edi, dword [ecx + eax*4]
mov eax, esi
xor eax, 0x80
or eax, edx
mov dword [ebx + 4], edi
jne 0x52db30
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp + 0x10]
mov dl, 1
mov dword [edi + 4], eax
xor eax, eax
lea ecx, [esi + 0x104]
lock cmpxchg byte [esi + 0x104], dl
mov edx, dword [ebp - 0x24]
je 0x52db89
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], ecx
call fcn.0053e0c0
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 0x24]
cmp byte [esi + 0x11c], 0
je 0x52dbf7
xor ebx, ebx
mov al, 1
lock cmpxchg byte [ecx], bl
je 0x52dbb6
mov dword [ebp - 0x10], 0
call fcn.0053dda0
mov edx, dword [ebp - 0x24]
jmp 0x52dbb6
test ecx, ecx
mov edx, ecx
je 0x52dbf3
mov eax, 0xffffffc0
mov ecx, dword [edx + 4]
lock xadd dword [edx], eax
cmp eax, 0x3f
jbe 0x52dc4f
and eax, 0xffffffc0
cmp eax, 0x40
jne 0x52dbb0
mov eax, dword [edx + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], 0
push edx
mov dword [ebp - 0x20], ecx
call eax
mov ecx, dword [ebp - 0x20]
add esp, 4
jmp 0x52dbb0
mov edx, dword [ebp - 0x28]
jmp 0x52dc3c
xor edx, edx
jmp 0x52dc3c
mov edi, dword [esi + 0x118]
lea eax, [esi + 0x114]
test edi, edi
lea edi, [edi + 4]
cmove edi, eax
mov eax, dword [ebp - 0x2c]
mov dword [edi], edx
xor edx, edx
mov dword [esi + 0x118], eax
mov al, 1
add dword [esi + 0x100], 0x81
lock cmpxchg byte [esi + 0x104], dl
je 0x52dc3c
mov dword [ebp - 0x10], 0
call fcn.0053dda0
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.assertion_failed:_prev.ref_count_____1
mov edx, 0x27
push 0x5a81f8
call fcn.0053bbd0
add esp, 4
jmp 0x52dccb
lea eax, [ebp + 0xc]
mov dword [ebp - 0x5c], 0x5a72e8
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
mov edx, 0x5a721c
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x40], 0x453380
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x38], 0x453380
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x5c]
push 0x5a72f8
push eax
call fcn.00546d00
add esp, 8
ud2
Function at 0x53ac0d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x53ac4c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x53ac4c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x53ac4c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x53ac4c
cmp dword [ecx + 0x74], 0xe
jbe 0x53ac4c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x53fd20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x538590
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x53fd86
mov edi, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x53fd86
mov esi, eax
push str.WakeByAddressSingle
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x53fd86
mov edi, eax
xor ebx, ebx
jmp 0x53fdf3
push 0x553c78
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x53fe6a
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x53fe6a
mov edi, eax
push str.NtReleaseKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x53fe6a
mov ebx, eax
push str.NtWaitForKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x53fe6a
mov esi, eax
lea eax, [ebp - 0x28]
push 0
push 0
push 0xc0000000
push eax
call edi
test eax, eax
jne 0x53fe6a
mov edi, dword [ebp - 0x28]
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0xc
call fcn.0051b940
test eax, eax
je 0x53fe6f
mov dword [eax], ebx
mov dword [eax + 4], esi
mov ecx, eax
mov dword [eax + 8], edi
xor eax, eax
lock cmpxchg dword [0x5b9364], ecx
je 0x53fe57
cmp dword [ecx], 0
mov esi, eax
mov dword [ebp - 0x20], ecx
je 0x53fe44
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], 1
push eax
mov dword [ebp - 0x24], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, dword [ebp - 0x24]
push dword [ebp - 0x20]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0053fed0
mov ecx, 4
mov edx, 0xc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0
call fcn.0053b730
ud2
Function at 0x544920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov ebp, dword [edx]
mov esi, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
lea edi, [ebp - 1]
cmp edi, 2
jae 0x54494d
cmp dword [edx + 0xc], esi
jbe 0x5449bc
mov edx, dword [edx + 8]
cmp byte [edx + esi], 0xc0
setge dl
jmp 0x5449bf
mov dword [esp], ecx
mov ecx, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebx, dword [edx + 0x10]
mov dword [esp + 4], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 8], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x14], ecx
mov ecx, dword [edx + 0x14]
movzx edx, byte [edx + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x48], ebp
mov ebp, ecx
mov ecx, dword [esp + 4]
cmp ebp, edi
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x60], dl
jae 0x5449d3
mov edx, dword [esp + 0x7c]
cmp ebp, esi
jbe 0x544a69
mov ecx, dword [esp + 8]
cmp byte [ecx + esi], 0xbf
jg 0x544a6b
jmp 0x544a8b
sete dl
movzx edx, dl
mov dword [ecx], edx
mov edx, dword [esp + 0x7c]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x544a83
mov edx, dword [esp + 0x7c]
lea ecx, [edi + 1]
mov dword [esp + 4], ecx
cmp esi, ebp
jae 0x544a00
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, dword [esp + 8]
cmp byte [ecx + esi], 0xc0
jl 0x544a02
jmp 0x544a6b
je 0x544a6b
inc ebx
je 0x544a8e
cmp dword [esp + 4], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
jb 0x544aa0
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x58], ebx
push eax
push dword [esp + 0x8c]
call fcn.00488e10
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, 1
jne 0x544a57
mov edx, dword [esp + 0x28]
mov esi, edx
cmp esi, ebp
jae 0x544a00
jmp 0x5449f0
cmp ecx, 2
jne 0x544a7c
mov ecx, dword [esp]
mov dword [ecx + 4], eax
mov eax, 2
jmp 0x544a81
jne 0x544a8b
mov ecx, dword [esp]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x544a83
mov ecx, dword [esp]
xor eax, eax
mov dword [ecx], eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
inc ebx
jne 0x544a98
mov ecx, 0x558304
call fcn.0053bf10
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
lea eax, [esp + 0xc]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], 0x554300
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x44e360
mov dword [esp + 0x40], edx
lea ecx, [esp + 0x20]
mov edx, 0x558388
mov dword [esp + 0x44], 0x453380
mov dword [esp + 0x2c], 2
call fcn.0053ba80
int3
Function at 0x544b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov esi, dword [edx]
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
lea edi, [esi - 1]
cmp edi, 2
jae 0x544b38
cmp dword [edx + 0xc], ebx
jbe 0x544c23
mov edx, dword [edx + 8]
cmp byte [edx + ebx], 0xc0
setge dl
jmp 0x544c26
mov dword [esp + 0xc], ebp
mov ebp, dword [edx + 0x10]
mov edi, dword [edx + 8]
mov dword [esp], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x18], ebp
mov dword [esp + 4], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x50], edi
mov dword [esp + 8], edi
mov ebp, dword [edx + 0x14]
movzx edx, byte [edx + 0x18]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x48], esi
mov esi, dword [esp + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x4c], esi
mov byte [esp + 0x60], dl
lea edx, [ebp - 1]
cmp edx, ecx
jbe 0x544bb0
cmp ecx, ebx
jbe 0x544c36
mov ecx, dword [esp + 8]
cmp byte [ecx + ebx], 0xbf
jg 0x544c38
jmp 0x544c50
cmp ebx, ecx
jae 0x544bc0
mov ecx, dword [esp + 8]
cmp byte [ecx + ebx], 0xc0
jl 0x544bc2
jmp 0x544c38
je 0x544c38
xor ebx, ebx
test ebp, ebp
je 0x544cd1
lea esi, [ebp - 1]
cmp ebp, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
jb 0x544c61
mov edx, dword [esp + 0x84]
lea ecx, [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x5c], esi
push eax
push dword [esp + 0x8c]
call fcn.0048c160
add esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp ecx, 1
jne 0x544cbf
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 4]
mov ebp, esi
mov dword [esp + 0xc], ebx
jmp 0x544bb0
sete dl
movzx edx, dl
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebp
jmp 0x544cd6
jne 0x544c50
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
mov dword [ecx], 1
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
jmp 0x544cd6
mov ecx, dword [esp]
xor ebx, ebx
test ebp, ebp
je 0x544cd4
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
mov eax, dword [esp + 4]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], 0x554300
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x3c], 0x44e360
mov dword [esp + 0x40], edx
mov edx, 0x558388
mov dword [esp + 0x44], 0x453380
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 2
mov dword [esp + 0x1c], eax
call fcn.0053ba80
cmp ecx, 2
mov ecx, dword [esp]
jne 0x544cd4
mov dword [ecx + 4], eax
mov ebx, 2
jmp 0x544cd4
mov ecx, dword [esp]
mov dword [ecx], ebx
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x545b80
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x545c01
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x545c3c
cmp dword [esp + 4], 0
je 0x545c23
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x545c5a
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5b93d8]
nop word cs:[eax + eax]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x5b93d8], esi
jne 0x545be0
mov byte [0x5b93d4], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x545c33
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x545c9b
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x545c27
mov edi, dword [esp]
jmp 0x545c33
mov edi, dword [esi]
jmp 0x545c32
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x5a50f4
push 0x5a54a8
push eax
call fcn.00545cd0
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x5a5498
mov dword [esp + 8], 0x5a545c
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str.Index_out_of_bounds
mov dword [esp + 0x14], 0
call fcn.0053ba80
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x5a545c
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str.Index_out_of_bounds
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00545d00
int3
Function at 0x546190
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov esi, edx
mov edx, edi
inc edx
sete al
je 0x546385
mov byte [esp + 3], al
js 0x54638f
movzx eax, byte [0x5b9430]
mov ebp, ecx
xor ecx, ecx
mov dword [esp + 4], edx
call fcn.0051b940
test eax, eax
je 0x546394
mov ebx, eax
push edi
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp edi, 8
jae 0x546202
test edi, edi
je 0x5462a9
mov eax, edi
nop dword [eax + eax]
cmp byte [esi], 0
je 0x5462c8
inc esi
dec eax
jne 0x5461f0
jmp 0x5462a9
lea eax, [esi + 3]
and eax, 0xfffffffc
sub eax, esi
je 0x54623a
cmp eax, edi
cmovae eax, edi
test eax, eax
je 0x54623a
mov ecx, esi
mov edx, eax
nop dword [eax]
cmp byte [ecx], 0
je 0x5462c8
inc ecx
dec edx
jne 0x546220
lea ecx, [edi - 8]
mov dword [esp + 8], ebp
cmp eax, ecx
jbe 0x546243
jmp 0x54628d
mov dword [esp + 8], ebp
lea ecx, [edi - 8]
xor eax, eax
movdqa xmm0, xmmword [0x547360]
movdqa xmm1, xmmword [0x547370]
nop word cs:[eax + eax]
nop dword [eax]
movq xmm2, qword [esi + eax]
movdqa xmm3, xmm2
paddd xmm3, xmm0
pandn xmm2, xmm3
pand xmm2, xmm1
movd edx, xmm2
pshufd xmm2, xmm2, 0x55
movd ebp, xmm2
or ebp, edx
jne 0x54628d
add eax, 8
cmp eax, ecx
jbe 0x546260
mov ebp, dword [esp + 8]
mov ecx, edi
sub ecx, eax
je 0x5462a9
add esi, eax
nop dword [eax]
cmp byte [esi], 0
je 0x5462c8
inc esi
dec ecx
jne 0x5462a0
mov eax, dword [esp + 4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
call fcn.0044e4b0
mov ebx, eax
mov edi, edx
jmp 0x5462d6
cmp dword [esp + 4], 0x80000000
jne 0x546364
pxor xmm0, xmm0
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x10]
movdqu xmmword [esp + 0x10], xmm0
movdqu xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], 1
push eax
push ecx
push 0
push ebx
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x546343
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [ebp + 8], eax
mov dword [ebp + 4], 0
mov eax, 1
test edi, edi
mov dword [ebp], eax
mov byte [ebx], 0
je 0x54633b
push ebx
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0xc]
movzx eax, word [esp + 0x48]
mov dword [ebp + 4], ecx
mov dword [ebp + 8], ecx
mov word [ebp + 0xc], ax
xor eax, eax
test edi, edi
mov dword [ebp], eax
mov byte [ebx], 0
jne 0x54632c
jmp 0x54633b
mov eax, dword [0x5a4598]
mov ecx, dword [0x5a459c]
cmp byte [esp + 3], 0
mov dword [ebp + 8], ecx
mov dword [ebp + 4], eax
mov dword [ebp], 1
je 0x54632c
jmp 0x54633b
mov ecx, 0x54b600
call fcn.0053bf10
call fcn.0044e3c0
mov edx, dword [esp + 4]
mov ecx, 1
call fcn.0053b730
int3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx