joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x4024eb
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x4024db
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x4024c1
jmp 0x4024e0
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40253b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x402500
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402500
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40251c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402ce0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40255d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x4025d0
mov esi, dword [ebx]
cmp esi, ebx
je 0x4025d0
test esi, esi
je 0x4025d0
cmp word [esi + 0x24], 2
jbe 0x4025ca
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x4025ca
cmp dword [esi + 0x18], 0
je 0x4025ca
test ebp, ebp
je 0x402585
cmp ebp, eax
jne 0x4025ca
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402ce0
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4025aa
cmp eax, dword [esi + 0x18]
jne 0x4025ca
cmp dword [esp + 0x10], 0
je 0x4025dd
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401040
add esp, 8
test eax, eax
je 0x4025dd
mov esi, dword [esi]
cmp esi, ebx
jne 0x402563
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x402990
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x4029b8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x4029c6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x4029df
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x4029ed
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x402a06
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x402a14
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x402a2d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x402a3b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.00402a82

Function at 0x402bc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7fa920]
sub esp, 0x11c
test eax, eax
jne 0x402cbe
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004036e0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402c10
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + str.QME:]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402c20
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41d104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402c55
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403490
pop edi
pop esi
pop ebx
test eax, eax
je 0x402cb9
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402cb9
mov dword [0x7fa920], eax
add esp, 0x11c
ret
mov eax, dword [0x7fa920]
add esp, 0x11c
ret
Function at 0x403490
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4034eb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4034b0
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x4034cc
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402ce0
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40350d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x40357f
mov esi, dword [ebx]
cmp esi, ebx
je 0x40357f
test esi, esi
je 0x40357f
cmp word [esi + 0x24], 2
jbe 0x403579
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x403579
cmp dword [esi + 0x18], 0
je 0x403579
test ebp, ebp
je 0x403535
cmp ebp, eax
jne 0x403579
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402ce0
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x40355a
cmp edx, dword [esi + 0x18]
jne 0x403579
cmp dword [esp + 0x14], eax
je 0x40358c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00401040
add esp, 8
test eax, eax
je 0x40358c
mov esi, dword [esi]
cmp esi, ebx
jne 0x403513
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x41cd12
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1cfc7e48
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x475706fc
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x408964
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
mov esi, 0x9fd7bb3d
add edi, esi
call fcn.00408988
inc edi
xor dword [edx], eax
dec esi
mov edi, esi
inc edx
dec edi
dec esi
cmp edx, ecx
jne fcn.00408964
or edi, edi
inc esi
ret
Function at 0x62c81873
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call eax
sub esp, 4
cmp dword [ebp + 0xc], 1
jne 0x62c818c8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.77777777777777.dll__Z10FUNSARANSKP11HINSTANCE___4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov eax, 1
leave
ret 0xc
Function at 0x62c96870
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x62c968d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x62db3034]
test esi, esi
jle 0x62c969f0
mov eax, dword [0x62db3038]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x62c96904
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x62c96987
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x62c968f0
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x62c96a17
mov eax, dword [0x62db3038]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x62db3038]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x62c969f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x62c96980
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x62c96990
add dword [0x62db3034], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x62db3038]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x62c96980
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x62c9690e
mov eax, dword [0x62db3038]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x62c96e50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
cmp eax, 2
je 0x62c96f80
ja 0x62c96e98
test eax, eax
je 0x62c96f18
mov eax, dword [0x62db3040]
test eax, eax
je 0x62c97000
mov dword [0x62db3040], 1
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 3
jne 0x62c96e85
mov eax, dword [0x62db3040]
test eax, eax
je 0x62c96e85
mov dword [esp], 0x62db3044
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x62db303c]
sub esp, 4
test ebx, ebx
je 0x62c96efd
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call edi
mov ebp, eax
sub esp, 4
call esi
test ebp, ebp
je 0x62c97028
test eax, eax
jne 0x62c97028
mov eax, dword [ebx + 4]
mov dword [esp], ebp
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62c96ed0
mov dword [esp], 0x62db3044
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x62c96e85
mov eax, dword [0x62db3040]
test eax, eax
jne 0x62c96f98
mov eax, dword [0x62db3040]
cmp eax, 1
jne 0x62c96e85
mov ebx, dword [0x62db303c]
test ebx, ebx
je 0x62c96f51
lea esi, [esi]
mov eax, ebx
mov ebx, dword [ebx + 8]
mov dword [esp], eax
call sym._free
test ebx, ebx
jne 0x62c96f40
mov dword [0x62db303c], 0
mov dword [0x62db3040], 0
mov dword [esp], 0x62db3044
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
sub esp, 4
jmp 0x62c96e85
call sym.__fpreset
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x62db3044
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x62db303c]
sub esp, 4
test ebx, ebx
je 0x62c96fe5
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 4
mov ebp, eax
call esi
test eax, eax
jne 0x62c97018
test ebp, ebp
je 0x62c97018
mov eax, dword [ebx + 4]
mov dword [esp], ebp
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62c96fc0
mov dword [esp], 0x62db3044
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x62c96f21
mov dword [esp], 0x62db3044
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
jmp 0x62c96e7b
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62c96fc0
jmp 0x62c96fe5
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62c96ed0
jmp 0x62c96efd

Function at 0x62c97150
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x62c80000], 0x5a4d
jne 0x62c97175
mov ecx, dword [0x62c8003c]
cmp dword [ecx + 0x62c80000], 0x4550
lea edx, [ecx + 0x62c80000]
je 0x62c97180
ret
cmp word [ecx + 0x62c80018], 0x10b
jne 0x62c97175
push esi
movzx eax, word [ecx + 0x62c80014]
push ebx
movzx esi, word [ecx + 0x62c80006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x62c80000
test si, si
je 0x62c971c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x62c971be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x62c971ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x62c971b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x62c97890
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x62c978c0
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp sym.___mingwthr_key_dtor
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x62c97900
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x62c97940
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x62c97968
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x62c97b30
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x62da302c]
test eax, eax
je 0x62c97b50
mov eax, dword [0x62da3030]
test eax, eax
je 0x62c97b60
mov eax, dword [0x62da3038]
test eax, eax
js 0x62c97b50
ret
mov dword [0x62da3038], 0
ret
push ebx
sub esp, 0x18
lock add dword [0x62da3034], 1
jne 0x62c97bb0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x62c97bf0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x62db3070], eax
call sym.___mingwthr_key_dtor
mov dword [0x62da3030], 1
test eax, eax
sete al
movzx eax, al
mov dword [0x62da3038], eax
add esp, 0x18
pop ebx
ret
mov eax, dword [0x62da3030]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x62c97bd6
nop
mov dword [esp], 0
call ebx
mov ecx, dword [0x62da3030]
sub esp, 4
test ecx, ecx
je 0x62c97bc0
mov edx, dword [0x62da3038]
test edx, edx
jns 0x62c97ba5
mov dword [0x62da3038], 0
jmp 0x62c97ba5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x62c97b8e

Function at 0x62c97c00
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov edx, dword [0x62da3038]
test edx, edx
js 0x62c97c28
mov esi, dword [0x62db3074]
test edx, edx
jne 0x62c97c3d
mov dword [ebx], esi
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call sym._fc_key_init_once
mov edx, dword [0x62da3038]
mov esi, dword [0x62db3074]
test edx, edx
je 0x62c97c1c
mov esi, dword [0x62db3070]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebx], esi
sub esp, 4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x62c97cd0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, 1
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov ecx, dword [edx]
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x24], eax
jmp 0x62c97d0f
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [0x62db3074], edx
mov dword [ebx], ecx
add ebp, 1
mov eax, dword [edi]
mov edx, dword [edi + 4]
test ecx, ecx
je 0x62c97df8
mov esi, dword [ecx + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call eax
test eax, eax
jne 0x62c97e31
test esi, esi
je 0x62c97d90
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 4], 0xa
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call esi
cmp eax, 7
je 0x62c97f10
cmp eax, 8
jne 0x62c97e31
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [0x62da3038]
test eax, eax
js 0x62c97dd0
test eax, eax
je 0x62c97d00
mov eax, dword [0x62db3070]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x62c97e40
mov eax, dword [ebx]
mov ecx, dword [eax]
jmp 0x62c97d0a
mov eax, dword [0x62da302c]
mov ecx, edx
test eax, eax
je 0x62c97de5
mov esi, dword [0x62da3030]
test esi, esi
je 0x62c97e50
mov dword [0x62da3038], 0
jmp 0x62c97d04
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
je 0x62c97eb0
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x62c97dc2
lock add dword [0x62da3034], 1
jne 0x62c97ec0
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x62c97f18
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x62db3070], eax
call sym.___mingwthr_key_dtor
mov edx, dword [esp + 0x2c]
mov dword [0x62da3030], 1
test eax, eax
sete al
movzx eax, al
mov dword [0x62da3038], eax
jmp 0x62c97d9d
mov dword [esi], ebp
mov eax, 5
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x62da3030]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test ecx, ecx
jne 0x62c97ef1
mov dword [esp + 0x2c], edx
lea esi, [esi]
mov dword [esp], 0
call esi
mov eax, dword [0x62da3030]
sub esp, 4
test eax, eax
je 0x62c97ed8
mov edx, dword [esp + 0x2c]
mov eax, dword [0x62da3038]
test eax, eax
jns 0x62c97d9d
mov eax, dword [ebx]
mov ecx, dword [eax]
jmp 0x62c97de5
mov esi, dword [esp + 0x28]
mov dword [esi], ebp
jmp 0x62c97eb7
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x2c]
jmp 0x62c97e8a
Function at 0x62c97f30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x62da3038]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x62c97fb0
test eax, eax
jne 0x62c97f60
mov eax, dword [0x62db3074]
mov dword [0x62db3074], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x62db3070]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x62db3070]
mov dword [ebx], esi
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x62c97f55
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call sym._fc_key_init_once
mov eax, dword [0x62da3038]
jmp 0x62c97f44

Function at 0x62c97fc0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x62da3038]
test eax, eax
js 0x62c98010
test eax, eax
jne 0x62c97fe8
mov dword [0x62db3074], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x62db3070]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x62c97fdd
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call sym._fc_key_init_once
mov eax, dword [0x62da3038]
jmp 0x62c97fd3
Function at 0x62ca2d80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], str.msvcrt.dll
mov esi, dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x62ca2dc8
mov dword [esp + 0x20], esi
mov dword [sym._init_rand_s], eax
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
mov dword [0x62db3b24], eax
sub esp, 8
mov eax, sym._mingw_rand_s
jmp 0x62ca2db3