joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5503e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
xorps xmm0, xmm0
movaps xmmword [esp], xmm0
mov eax, esp
push 0x10
push eax
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x550425
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
call sub.KERNEL32.DLL_GetLastError
mov byte [esp + 0x20], 0
mov dword [esp + 0x24], eax
lea edi, [esp + 0x20]
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x69db8c
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], fcn.005417e0
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x28]
mov edx, 0x69dbb8
call fcn.00439fc0
ud2

Function at 0x552040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x552109
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
test edx, edx
jne 0x552070
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x5520f4
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x5520e1
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [ebp - 0x24], 0
lea ebx, [ebp - 0x24]
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x5520a7
mov eax, dword [ebp - 0x24]
mov ecx, 2
test eax, eax
jne 0x5520c4
jmp 0x5520b8
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3e5
je 0x5520bf
cmp eax, 0x6d
jne 0x5520d6
mov word [esi], 4
jmp 0x5520ce
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x5520ce
mov ecx, ebx
push 1
call fcn.00524120
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x552077
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.00524120
add esp, 4
mov edx, dword [ebx]
jmp 0x552070
lea edx, [ebp - 0x24]
mov ecx, edi
mov dword [ebp - 0x24], 0
call 0x552120
nop word [eax + eax]
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x69da6c
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
xor ecx, ecx
push 0x69da74
push eax
push 0x69b960
push esi
push 0x69b960
call fcn.0043aa50
nop word cs:[eax + eax]
nop dword [eax + eax]
push ebp
mov ebp, esp
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
test edx, edx
je 0x552183
cmp edx, 1
jne 0x552195
mov eax, dword [ecx + 0x18]
push 7
push 0x69e1ea
jmp 0x55218d
mov eax, dword [ecx + 0x18]
push 0xa
push str.NotReadingReadingReadfailed_to_reserve_stack_space_for_exception_handling
push dword [ecx + 0x14]
call dword [eax + 0xc]
jmp 0x5521b0
add eax, 4
mov edx, 0x69e1f1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 0x69b990
push eax
push 4
call fcn.004414d0
add esp, 0x10
pop ebp
ret
Function at 0x552770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x5920b8]
test eax, eax
je 0x5527f5
dec eax
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, 2
jb 0x552791
cmp byte [eax + 4], 0
mov esi, eax
jne 0x5527e9
mov eax, dword [0x5920b8]
test eax, eax
je 0x552804
dec eax
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, 1
je 0x5527ee
mov esi, eax
test eax, eax
jne 0x5527e3
movzx eax, byte [0x706188]
mov ecx, 8
mov edx, 4
call fcn.00425680
test eax, eax
je 0x55281c
mov dword [eax], 0x5920b8
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5920b8]
test eax, eax
je 0x552810
dec eax
push esi
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov word [esi + 4], 1
add esi, 5
jmp 0x5527f0
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x5920b8
call fcn.0051f070
jmp 0x55277e
mov ecx, 0x5920b8
call fcn.0051f070
jmp 0x55279b
mov ecx, 0x5920b8
call fcn.0051f070
jmp 0x5527dc
mov ecx, 4
mov edx, 8
call fcn.00434230
nop dword [eax + eax]

Function at 0x555310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [0x5920c8]
test eax, eax
je 0x5553a4
dec eax
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, 2
jb 0x55533d
cmp dword [eax + 4], 0
mov esi, eax
je 0x55533d
add esi, 8
jmp 0x555354
mov eax, dword [0x5920c8]
test eax, eax
je 0x5553b3
dec eax
push eax
call sub.KERNEL32.DLL_TlsGetValue
xor esi, esi
cmp eax, 1
jne 0x55535c
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
test eax, eax
mov esi, eax
jne 0x5553c7
movzx eax, byte [0x706188]
mov ecx, 0xc
mov edx, 4
call fcn.00425680
test eax, eax
je 0x555408
mov dword [eax], 0x5920c8
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5920c8]
test eax, eax
jne 0x5553bf
mov ecx, 0x5920c8
call fcn.0051f070
jmp 0x5553c0
mov ecx, 0x5920c8
call fcn.0051f070
jmp 0x555325
mov ecx, 0x5920c8
call fcn.0051f070
jmp 0x555347
dec eax
push esi
push eax
call sub.KERNEL32.DLL_TlsSetValue
call fcn.005526a0
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x555338
test ecx, ecx
je 0x555338
lock dec dword [ecx]
jne 0x555338
lea ecx, [ebp - 8]
call fcn.00555420
jmp 0x555338
mov ecx, 4
mov edx, 0xc
call fcn.00434230
nop word [eax + eax]
Function at 0x555500
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5920e8]
test eax, eax
je 0x5555e1
dec eax
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, 2
jb 0x555530
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x5555d6
mov eax, dword [0x5920e8]
test eax, eax
je 0x5555f0
dec eax
push eax
call sub.KERNEL32.DLL_TlsGetValue
cmp eax, 1
je 0x5555b3
mov esi, eax
test eax, eax
jne 0x555594
movzx eax, byte [0x706188]
mov ecx, 0x20
mov edx, 8
call fcn.00425680
test eax, eax
je 0x55560b
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x5920e8
mov esi, eax
mov eax, dword [0x5920e8]
test eax, eax
je 0x5555ff
dec eax
push esi
push eax
call sub.KERNEL32.DLL_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x5555b7
movaps xmm0, xmmword [esp]
jmp 0x5555c5
xor esi, esi
jmp 0x5555d9
lea ecx, [esp + 0x10]
call fcn.005503e0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x5920e8
call fcn.0051f070
jmp 0x555518
mov ecx, 0x5920e8
call fcn.0051f070
jmp 0x55553e
mov ecx, 0x5920e8
call fcn.0051f070
jmp 0x55558d
mov ecx, 8
mov edx, 0x20
call fcn.00434230
nop word [eax + eax]
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x18]
mov eax, dword [esi]
test eax, eax
je 0x555634
dec eax
jmp 0x55563b
mov ecx, esi
call fcn.0051f070
push 1
push eax
call sub.KERNEL32.DLL_TlsSetValue
mov ecx, edi
mov edx, 8
call fcn.004256e0
mov eax, dword [esi]
test eax, eax
je 0x555658
dec eax
jmp 0x55565f
mov ecx, esi
call fcn.0051f070
push 0
push eax
call sub.KERNEL32.DLL_TlsSetValue
pop esi
pop edi
pop ebp
ret
Function at 0x559be3
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
mov eax, dword [edx]
or eax, dword [edx + 4]
jne 0x559c10
mov eax, dword [edx + 8]
mov esi, dword [edx + 0xc]
mov edi, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], edi
mov dword [ecx + 4], esi
mov dword [ecx], eax
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 9]
push 0x46
pop edx
mov ecx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_src_threadlocal.rs
push 0x69ea74
push 0x69ead8
push eax
call fcn.0043f6f0
Function at 0x55adf2
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
and dword [ebp - 0x10], 0
cmp dword [edx + 8], 0
mov esi, edx
mov ebx, ecx
je 0x55ae8f
push 0x69ecf2
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x18], ebx
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov edi, eax
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
push edx
push 0
push 0x30
push edi
push ebx
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x14], eax
push ebx
mov ebx, dword [ebp - 0x18]
call sub.oleaut32.dll_SysFreeString
push edi
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0x14], 0
js 0x55ae8f
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, dword [ebp - 0x10]
call fcn.00558bc4
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], edi
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [ebx + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [ebx + 0x18], eax
movsd qword [ebx], xmm0
movsd qword [ebx + 0x10], xmm1
jmp 0x55ae9c
mov ecx, esi
mov dword [ebx], 2
call fcn.00558b5a
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x563be7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x28]
lea edi, [ebp - 0x34]
add ecx, eax
xor esi, esi
inc esi
mov dword [edx], esi
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
and word [edx + 0xc], 0
mov ecx, edi
call fcn.00567b23
mov ebx, dword [edi + 8]
mov esi, dword [edi + 4]
add ebx, ebx
mov ecx, ebx
call fcn.004d76ca
mov edi, edx
mov dword [ebp - 0x14], eax
push ebx
push esi
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x34]
mov edx, esi
mov ecx, dword [eax]
call fcn.00567db4
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x28]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.00563bba
pop eax
mov esi, dword [esi + 4]
push ebx
push edi
xor eax, eax
inc eax
push eax
push 0
push esi
push dword [ebp - 0x18]
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x563c7a
mov ecx, dword [ebp - 0x10]
and dword [ecx], 0
mov dword [ecx + 4], eax
jmp 0x563c80
mov eax, dword [ebp - 0x10]
mov byte [eax], 4
mov ecx, dword [ebp - 0x28]
mov edx, esi
call fcn.00567db4
mov ecx, dword [ebp - 0x14]
mov edx, edi
call fcn.00563c9c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x563cb7
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
lea eax, [ebp - 0x38]
add edx, ecx
mov dword [eax], 1
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
and word [eax + 0xc], 0
mov ecx, eax
call fcn.00567f60
test ax, ax
je 0x563d7e
lea edi, [ebp - 0x28]
mov ebx, edx
lea edx, [ebp - 0x38]
mov ecx, edi
call fcn.00563b3f
mov eax, dword [edi]
xor ecx, ecx
dec ecx
inc eax
cmove eax, ecx
cmp eax, 5
push 4
pop ecx
cmovae ecx, eax
call fcn.00567cdf
lea ecx, [ebp - 0x18]
mov word [edx], bx
mov esi, edx
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ecx + 8], 1
lea ecx, [ebp - 0x38]
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
xor edi, edi
inc edi
lea ecx, [ebp - 0x28]
call fcn.00567f60
cmp ax, 1
jne 0x563d79
cmp edi, dword [ebp - 0x18]
mov ebx, edx
jne 0x563d6f
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x28]
call fcn.00563b3f
mov edx, dword [ebp - 0x44]
mov eax, 0xffffffff
lea ecx, [ebp - 0x18]
inc edx
cmove edx, eax
call fcn.00567d19
mov esi, dword [ebp - 0x14]
mov word [esi + edi*2], bx
inc edi
mov dword [ebp - 0x10], edi
jmp 0x563d38
mov edi, dword [ebp - 0x18]
jmp 0x563d83
xor edi, edi
push 2
pop esi
push 3
push esi
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoW
xor ebx, ebx
cmp eax, 1
je 0x563dab
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x28]
mov byte [ecx], 0
mov dword [ecx + 4], eax
call fcn.00563ae7
mov ebx, eax
mov ecx, edi
mov edx, esi
call fcn.00567db4
mov eax, ebx
mov edx, 0x6c39e4
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56804d
Capabilities:
Encrypt data using aes via x86 extensions
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1018
call fcn.005760a0
mov ebx, dword [edx + 4]
mov esi, dword [edx]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
lea edi, [ebp - 0x1024]
mov dword [eax], 0x800
push 0x1000
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [esi]
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
je 0x5680b2
cmp eax, 0x103
jne 0x5680e6
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x80000001
jmp 0x568106
mov eax, dword [ebp - 0x18]
cmp eax, 0x801
jae 0x568111
lea esi, [ebp - 0x24]
lea edx, [ebp - 0x1024]
mov ecx, esi
push eax
call fcn.00434c30
pop eax
mov ecx, dword [esi]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
cmp ecx, 0x80000000
je 0x5680f5
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jmp 0x5680fa
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x80000000
jmp 0x5680fa
xor edx, edx
push 9
pop eax
inc ebx
mov dword [esi], ecx
mov dword [esi + 8], eax
mov dword [esi + 4], edx
mov dword [edi + 4], ebx
add esp, 0x1018
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, eax
mov edx, 0x800
push 0x6d4b60
call fcn.0043a6f0

Function at 0x568122
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
mov esi, eax
test edx, edx
je 0x568139
mov byte [esi], 0
inc esi
dec edx
jmp 0x56812e
and dword [ecx + 8], 0
mov ecx, dword [ecx]
test ecx, ecx
js 0x568151
sub ecx, 1
jb 0x56814e
mov byte [eax], 0
inc eax
jmp 0x568143
pop esi
pop ebp
ret
push 0x2d
pop edx
mov ecx, 0x6d4bcd
push 0x6d4bfc
call fcn.0043a9e0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x568180
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x5681a2
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x56fff0
Capabilities:
Print debug messages

Disassembly:
push edi
pxor xmm0, xmm0
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
sub esp, 0x84
movups xmmword [ebp - 0x23], xmm0
movdqu xmm1, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movdqu xmm2, xmmword [0x6d6040]
movdqu xmm3, xmmword [0x6d6050]
movups xmmword [ebp - 0x43], xmm0
movups xmmword [ebp - 0x73], xmm1
movups xmmword [ebp - 0x63], xmm2
movups xmmword [ebp - 0x53], xmm3
movups xmmword [ebp - 0x33], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea edx, [ebp - 0x4c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [ebp - 0x4c], 0
je 0x5700a3
mov eax, 0x27
lea edx, [ebp - 0x73]
jmp 0x570075
cmp eax, 0x6a
je 0x570092
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x570070
cmp eax, 0x6a
je 0x570092
add ecx, 2
mov byte [ebp + eax - 0x73], 0xa
mov byte [ebp + ecx - 0x73], 0
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
sub esp, 4
call sub.msvcrt.dll_abort
mov ecx, 0x28
mov eax, 0x27
lea edx, [ebp - 0x73]
jmp 0x570088

Function at 0x570430
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x7061ec], 1
je 0x5704e8
push edi
mov eax, 0x7061ec
push esi
push ebx
sub esp, 0x10
call fcn.0056fdd0
lea esi, [eax + 4]
mov ebx, eax
mov dword [esp], esi
call fcn.0056f6d0
mov edi, dword [0x7061ec]
test edi, edi
jne 0x5704a0
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov dword [0x592114], eax
cmp eax, 0xffffffff
je 0x58fe49
mov dword [0x7061ec], 1
mov dword [esp], esi
call fcn.0056fa10
test ebx, ebx
je 0x5704da
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.005700c0
cmp edi, 1
je 0x570482
mov dword [esp], 2
call dword [0x592124]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x7061ec
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], esi
call fcn.0056fa10
test ebx, ebx
jne 0x57048e
add esp, 0x10
pop ebx
pop esi
pop edi
ret
ret
Function at 0x5704f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
call fcn.005701b0
mov edx, dword [entry4]
test edx, edx
je 0x570620
mov ebx, eax
test eax, eax
je 0x570620
mov dword [eax + 0x24], 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [ebx + 0x1c], 0xffffffff
mov dword [ebx + 0x18], eax
sub esp, 0x10
lea eax, [ebx + 0x38]
mov dword [esp], eax
call fcn.00573970
cmp eax, 1
je 0x57062c
mov ebp, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [ebx + 0x38], 0xffffffff
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call ebp
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov esi, eax
call ebp
lea edx, [ebx + 0x14]
mov dword [esp + 8], edi
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je fcn.0058fe4e
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x592114]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
je 0x570631
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0056fff0
jmp fcn.0058fe4e

Function at 0x570640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00570430
mov eax, dword [0x592114]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
test eax, eax
je 0x570668
add esp, 0x1c
ret
add esp, 0x1c
jmp fcn.005704f0
Function at 0x570930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x570960
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x570a30
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
cmp eax, 1
je 0x570a60
cmp eax, 3
jne 0x57094b
mov eax, dword [0x592114]
cmp eax, 0xffffffff
je 0x57094b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x57094b
lea esi, [eax + 0x1c]
lea edi, [eax + 0x38]
test byte [eax + 0x20], 0x30
je 0x570a90
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x5709a9
call fcn.00570670
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5709db
mov dword [esp], eax
mov ebp, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call ebp
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x5709cd
mov dword [esp], eax
call ebp
sub esp, 4
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [esp], esi
call fcn.0056fb90
mov dword [esp], edi
call fcn.00573970
cmp eax, 1
je 0x570b56
mov eax, dword [ebx + 0xb0]
mov dword [ebx + 0x38], 0xffffffff
test eax, eax
je 0x570b4a
mov eax, dword [0x592114]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
jmp 0x57094b
mov eax, dword [0x7061c8]
test eax, eax
je 0x57094b
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_RemoveVectoredExceptionHandler]
mov dword [0x7061c8], 0
sub esp, 4
jmp 0x57094b
mov dword [esp + 4], 0x56fd40
mov dword [esp], 1
call dword [sym.imp.KERNEL32.DLL_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x7061c8], eax
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov edx, dword [ebx + 0x68]
mov eax, dword [eax + 0x18]
test edx, edx
jne 0x570b00
test eax, eax
je 0x570aaa
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
je 0x570ac7
call fcn.00570670
test byte [ebx + 0x24], 4
je 0x570b40
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x5709db
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x14], 0
sub esp, 4
mov dword [esp], esi
call fcn.0056fb90
jmp 0x5709e3
test eax, eax
je 0x570b40
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x18], 0
sub esp, 4
mov dword [esp], esi
call fcn.0056fb90
mov dword [esp], edi
call fcn.00573970
cmp eax, 1
je 0x570b56
mov dword [ebx + 0x38], 0xffffffff
jmp 0x57094b
mov dword [esp], esi
call fcn.0056fb90
jmp 0x570b1f
mov eax, ebx
call fcn.00570270
jmp 0x570a09
call fcn.0056fff0
lea esi, [esi]
nop
Function at 0x570df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [ebx]
test edx, edx
je 0x570f10
cmp eax, 1
je 0x570e44
mov eax, ebx
call fcn.0056fdd0
lea edi, [eax + 4]
mov esi, eax
mov dword [esp], edi
call fcn.0056f6d0
mov ebp, dword [ebx]
test ebp, ebp
je 0x570e50
cmp ebp, 1
jne 0x570ee0
mov dword [esp], edi
call fcn.0056fa10
test esi, esi
je 0x570e44
mov eax, esi
call fcn.005700c0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x570180
mov dword [esp + 0x18], esi
call fcn.00570430
mov eax, dword [0x592114]
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x570f48
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], eax
lock or dword [esp], 0
call fcn.00570430
mov eax, dword [0x592114]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x570f30
lea edx, [esp + 0x14]
mov dword [eax + 0xc], edx
lock or dword [esp], 0
call dword [esp + 0x44]
call fcn.00570430
mov eax, dword [0x592114]
mov dword [esp], eax
call ebp
sub esp, 4
test eax, eax
je 0x570f20
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov dword [ebx], 1
jmp 0x570e31
mov dword [esp], 2
call dword [0x592124]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], str._once__p_is__d_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x570e31
add esp, 0x2c
mov eax, 0x16
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.005704f0
test eax, eax
jne 0x570ec8
jmp 0x58fe61
call fcn.005704f0
test eax, eax
jne 0x570ea2
jmp 0x58fe73
call fcn.005704f0
test eax, eax
jne 0x570e7c
jmp 0x58fe6c
mov eax, dword [esp + 0x1c]
mov dword [0], eax
ud2
mov eax, dword [pe_dos_header]
ud2
lea eax, [esp + 0x14]
mov dword [0], eax
ud2

Function at 0x5713e0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.00570430
mov eax, dword [0x592114]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
test eax, eax
je 0x571408
mov eax, dword [eax + 0x18]
add esp, 0x1c
ret
call fcn.005704f0
test eax, eax
jne 0x5713fd
add esp, 0x1c
ret