joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ef80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [edx], 0x80000000
mov esi, dword [ecx]
mov edi, ecx
jne 0x53efd2
cmp esi, 0x80000000
je 0x53efcb
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x53efcb
mov ebx, dword [edi + 4]
cmp ebp, 1
mov dword [esp + 8], esi
mov ecx, dword [ebx + 8]
jne 0x53f02e
test ecx, ecx
je 0x53f1a8
add ebx, 0xc
shl ebp, 4
nop
mov byte [ebx], 0
add ebx, 0x10
add ebp, 0xfffffff0
jne 0x53efc0
xor edi, edi
jmp 0x53f1ef
cmp esi, 0x80000000
jne 0x53f1ef
mov ebp, dword [edx + 8]
mov ebx, dword [edx + 4]
xor edi, edi
mov dword [edx + 8], 0
test ebp, ebp
je 0x53f1ef
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
add ebx, 4
mov dword [esp], edx
jmp 0x53f01a
add ebx, 0x10
dec ebp
je 0x53f1ec
cmp dword [ebx - 4], 0
je 0x53f010
push dword [ebx]
push 0
push dword [0x5fd290]
call esi
jmp 0x53f010
lea eax, [ebp + 0xfffffff]
mov dword [esp], edx
mov dword [esp + 4], eax
and eax, 0xfffffff
cmp eax, 8
jae 0x53f04c
xor esi, esi
jmp 0x53f184
mov edx, dword [esp + 4]
movd xmm0, ecx
mov esi, eax
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x589850]
movdqa xmm2, xmm1
and edx, 7
sub esi, edx
mov dword [esp + 4], edx
lea edx, [ebx + 0x88]
mov ecx, esi
nop dword [eax + eax]
movd xmm3, dword [edx - 0x40]
movd xmm5, dword [edx - 0x50]
movd xmm4, dword [edx - 0x70]
movd xmm6, dword [edx - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edx]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edx - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x30]
sub edx, 0xffffff80
add ecx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x53f080
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [esp + 4], 0
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ecx, xmm0
je 0x53f19d
sub eax, esi
shl esi, 4
lea edx, [esi + ebx + 0x18]
nop dword [eax]
mov esi, dword [edx]
cmp ecx, esi
cmovae ecx, esi
add edx, 0x10
dec eax
jne 0x53f190
mov edx, dword [esp]
test ecx, ecx
jne 0x53efb9
lea esi, [ebx + 4]
mov dword [esp], edx
jmp 0x53f1b6
add esi, 0x10
dec ebp
je 0x53f1ce
cmp dword [esi - 4], 0
je 0x53f1b0
push dword [esi]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x53f1b0
cmp dword [esp + 8], 0
je 0x53f1e4
push ebx
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi], 0x80000000
xor edi, edi
mov edx, dword [esp]
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x551110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x579b40
mov esi, ecx
lea eax, [ebp - 0x18]
mov edx, 0x200
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
xor ecx, ecx
movzx eax, byte [0x5fd2ec]
call fcn.0056a9f0
test eax, eax
je 0x551214
movdqa xmm0, xmmword [0x589850]
mov ecx, 0xfffffe00
mov dword [ebp - 0x30], esi
nop word [eax + eax]
movdqu xmm2, xmmword [ecx + 0x5aedf8]
pshufd xmm1, xmm2, 0xe8
pshufd xmm3, xmm2, 0xed
movdqa xmm4, xmm1
movdqa xmm2, xmm3
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm2, xmm4
movdqa xmm4, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmm1
pand xmm1, xmm2
pand xmm2, xmm3
pandn xmm4, xmm3
por xmm1, xmm4
por xmm2, xmm5
punpckldq xmm1, xmm2
movdqu xmmword [eax + ecx + 0x200], xmm1
add ecx, 0x10
jne 0x551170
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x40
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
call fcn.00549b80
movsd xmm0, qword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
movsd xmm1, qword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 0x200
call fcn.0057f230
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x55124e
push dword [ebp - 0x28]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0xc
pop ebp
ret
Function at 0x551c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x579b80
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov edi, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], edi
mov dword fs:[0], eax
je 0x551cd2
mov dword [ebp - 0x20], edx
lea edx, [esi*8]
xor ecx, ecx
mov edi, esi
xor ebx, ebx
movzx eax, byte [0x5fd2ec]
mov esi, edx
call fcn.0056a9f0
test eax, eax
je 0x551dd0
cmp edi, 0x10
mov esi, edi
jae 0x551d1d
mov edi, dword [ebp - 0x20]
nop word [eax + eax]
mov ecx, dword [edi + ebx*8]
mov edx, dword [edi + ebx*8 + 4]
cmp ecx, edx
mov edi, edx
cmovb edi, ecx
cmova edx, ecx
mov dword [eax + ebx*8], edi
mov edi, dword [ebp - 0x20]
mov dword [eax + ebx*8 + 4], edx
inc ebx
cmp esi, ebx
jne 0x551cb0
jmp 0x551cd7
mov eax, 4
lea ecx, [ebp - 0x30]
test esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 0
sete byte [ebp - 0x24]
call fcn.00549b80
movsd xmm0, qword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [eax + esi*8 - 8]
cmp ecx, eax
jb 0x551dc0
mov edx, eax
lea ecx, [eax + esi*8 - 4]
add edx, 4
cmp ecx, edx
jb 0x551dc8
mov edi, dword [ebp - 0x20]
lea ecx, [esi - 1]
cmp ecx, 0x1fffffff
ja 0x551cb0
movdqa xmm0, xmmword [0x589850]
mov ebx, esi
xor ecx, ecx
and ebx, 0xfffffffe
nop dword [eax + eax]
movdqu xmm2, xmmword [edi + ecx*8]
pshufd xmm1, xmm2, 0xe8
pshufd xmm3, xmm2, 0xed
movdqa xmm4, xmm1
movdqa xmm2, xmm3
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm2, xmm4
movdqa xmm4, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmm1
pand xmm1, xmm2
pand xmm2, xmm3
pandn xmm4, xmm3
por xmm1, xmm4
por xmm2, xmm5
punpckldq xmm1, xmm2
movdqu xmmword [eax + ecx*8], xmm1
add ecx, 2
cmp ebx, ecx
jne 0x551d60
cmp ebx, esi
jne 0x551cb0
jmp 0x551cd7
mov edi, dword [ebp - 0x20]
jmp 0x551cb0
mov edi, dword [ebp - 0x20]
jmp 0x551cb0
mov ecx, 4
mov edx, esi
call fcn.0057f230
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp - 0x30], 0
je 0x551dfe
push dword [ebp - 0x2c]
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0xc
pop ebp
ret
Function at 0x55ad90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x579bc0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x5fd294]
test al, al
je 0x55af61
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x55addc
cmp eax, 3
jne 0x55af5a
mov ebx, dword [0x5fd298]
test ebx, ebx
je 0x55af5a
mov dword [ebp - 0x20], 0
jmp 0x55ae07
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x55ae38
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x55afab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x55ae00
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x55ae00
test byte [ebp - 0x20], 1
je 0x55af5a
mov ebx, dword [0x5fd298]
test ebx, ebx
je 0x55af5a
mov dword [ebp - 0x20], 0
jmp 0x55ae67
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x55ae98
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x55afab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x55ae60
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x55ae60
test byte [ebp - 0x20], 1
je 0x55af5a
mov ebx, dword [0x5fd298]
test ebx, ebx
je 0x55af5a
mov dword [ebp - 0x20], 0
jmp 0x55aec7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x55aef8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x55afab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x55aec0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x55aec0
test byte [ebp - 0x20], 1
je 0x55af5a
mov ebx, dword [0x5fd298]
test ebx, ebx
je 0x55af5a
mov dword [ebp - 0x20], 0
jmp 0x55af27
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x55af54
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x55afab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x55af20
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x55af20
test byte [ebp - 0x20], 1
jne 0x55af74
movzx eax, byte [0x5ee700]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x5fd298]
jmp 0x55af7f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x55af5a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x55afab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x55af7c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x55af7c
mov ecx, 0x5eb6bc
mov dword [ebp - 0x10], 0
call fcn.0057fb10
ud2
Function at 0x55bdf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5fd094]
test eax, eax
je 0x55be18
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x55be2e
cmp dword [eax + 4], 0
mov edi, eax
je 0x55be2e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5fd094
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x55be08
mov eax, dword [0x5fd094]
test eax, eax
je 0x55bec7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x55bee1
mov esi, eax
test eax, eax
jne 0x55be8e
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, 0xc
call fcn.0056a9f0
test eax, eax
je 0x55bef4
mov dword [eax], 0x5fd094
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5fd094]
test eax, eax
je 0x55bee8
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x55be13
test ecx, ecx
je 0x55be13
lock dec dword [ecx]
jne 0x55be13
call fcn.004bdd50
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5fd094
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x55be4c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5fd094
call fcn.005878a0
jmp 0x55be86
mov ecx, 4
mov edx, 0xc
call fcn.0057f230
int3

Function at 0x55c630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5fd0a4]
test eax, eax
je 0x55c6ad
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x55c64f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x55c6a6
mov eax, dword [0x5fd0a4]
test eax, eax
je 0x55c6c5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x55c6db
mov esi, eax
test eax, eax
jne 0x55c6a0
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, 8
call fcn.0056a9f0
test eax, eax
je 0x55c6ed
mov dword [eax], 0x5fd0a4
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5fd0a4]
test eax, eax
je 0x55c6e1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x5fd0a4
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x55c647
jmp 0x55c64f
mov ecx, 0x5fd0a4
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x55c665
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x5fd0a4
call fcn.005878a0
jmp 0x55c698
mov ecx, 4
mov edx, 8
call fcn.0057f230
int3
Function at 0x55d6b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5fd084]
test eax, eax
je 0x55d6d2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x55d6e8
cmp dword [eax + 4], 0
je 0x55d6e8
add eax, 8
pop esi
ret
mov ecx, 0x5fd084
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x55d6c7
mov eax, dword [0x5fd084]
test eax, eax
je 0x55d753
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x55d769
mov esi, eax
test eax, eax
jne 0x55d73c
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, 0x10
call fcn.0056a9f0
test eax, eax
je 0x55d779
mov dword [eax], 0x5fd084
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5fd084]
test eax, eax
je 0x55d76d
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
mov ecx, 0x5fd084
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x55d6fe
xor eax, eax
pop esi
ret
mov ecx, 0x5fd084
call fcn.005878a0
jmp 0x55d734
mov ecx, 4
mov edx, 0x10
call fcn.0057f230
int3
Function at 0x55e0f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x579d40
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x55e25b
mov ebx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movq xmm0, qword [0x5fd2a0]
movd edx, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [esi + 4], ecx
movd edi, xmm0
mov eax, edx
or eax, edi
jne 0x55e1a9
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x55e293
movq xmm0, qword [esi + 8]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0xc]
movq qword [0x5fd2a0], xmm0
mov eax, edx
mov ecx, dword [esi + 4]
or eax, edi
je 0x55e247
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
push edi
push edx
push ecx
push ebx
mov edi, edx
mov dword [esi + 0x28], edx
call fcn.0057a310
mov dword [esi + 0x1c], eax
mov ebx, edx
mov ecx, edi
mov dword [esi + 0x2c], edx
mul edi
mov edi, dword [esi + 0x20]
imul ecx, ebx
mov ebx, dword [esi + 0x1c]
add ecx, edx
mov edx, edi
imul edx, ebx
add ecx, edx
mov edx, dword [esi + 0x24]
sub edx, eax
mov eax, dword [esi + 4]
sbb eax, ecx
imul ecx, eax, 0x3b9aca00
mov eax, edx
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push edi
push dword [esi + 0x28]
push edx
push eax
call fcn.0057a310
mov ecx, eax
mov dword [esi + 4], edx
mov eax, ebx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 0x2c], 0x3b9aca00
add eax, edx
add edi, ecx
adc eax, dword [esi + 4]
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0057a310
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x38]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zeroreentrant_init
mov edx, 0x19
push 0x5eaab4
call fcn.0057f7d0
call sub.kernel32.dll_GetLastError
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x5eb7c0
push 0x5e9b40
push eax
call fcn.0057fa90
add esp, 0xc
jmp 0x55e2c9
call sub.kernel32.dll_GetLastError
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 1
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x5eb7b0
push 0x5e9b40
push eax
call fcn.0057fa90
add esp, 0xc
ud2
Function at 0x563cd0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x563d1d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x563d2d
mov dword [esi + 4], 0
jmp 0x563d3f
cmp eax, 0x103
je 0x563d5b
test eax, eax
js 0x563d48
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x5eb200
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0055b360
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0055b4c0
mov ecx, 7
int 0x29
ud2

Function at 0x568450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5fd0d4]
test eax, eax
je 0x568478
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x56848e
cmp dword [eax + 4], 0
mov edi, eax
je 0x56848e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5fd0d4
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x568468
mov eax, dword [0x5fd0d4]
test eax, eax
je 0x568527
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x568541
mov esi, eax
test eax, eax
jne 0x5684ee
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, 0xc
call fcn.0056a9f0
test eax, eax
je 0x568554
mov dword [eax], 0x5fd0d4
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5fd0d4]
test eax, eax
je 0x568548
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x568473
test ecx, ecx
je 0x568473
lock dec dword [ecx]
jne 0x568473
call fcn.004182e0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5fd0d4
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x5684ac
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5fd0d4
call fcn.005878a0
jmp 0x5684e6
mov ecx, 4
mov edx, 0xc
call fcn.0057f230
int3
Function at 0x569e20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x579ff0
mov esi, edx
mov edi, ecx
xor ecx, ecx
mov edx, 8
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x5fd2ec]
call fcn.0056a9f0
test eax, eax
je 0x569f12
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x569fa0
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x569e9a
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x569f01
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x569ee7
cmp dword [eax + 8], 9
jae 0x569ed2
mov eax, dword [ebp - 0x20]
jmp 0x569ed8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x5fd290]
call dword [sym.imp.kernel32.dll_HeapFree]
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.0057f230
ud2

Function at 0x56a0f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x57a010
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x56a16e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
lea edx, [esi + 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], 0x5eb400
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], edx
mov dword [esi + 0x38], ecx
lea ecx, [esi + 0x30]
mov edx, 0x5eb430
mov dword [esi + 0x2c], fcn.00563260
mov dword [esi + 0x3c], 1
call fcn.0057f680
ud2
Function at 0x56a620
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5fd0b4]
test eax, eax
je 0x56a69d
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x56a63f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x56a696
mov eax, dword [0x5fd0b4]
test eax, eax
je 0x56a6b5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x56a6cb
mov esi, eax
test eax, eax
jne 0x56a690
movzx eax, byte [0x5fd2ec]
xor ecx, ecx
mov edx, 8
call fcn.0056a9f0
test eax, eax
je 0x56a6dd
mov dword [eax], 0x5fd0b4
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5fd0b4]
test eax, eax
je 0x56a6d1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x5fd0b4
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x56a637
jmp 0x56a63f
mov ecx, 0x5fd0b4
call fcn.005878a0
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x56a655
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x5fd0b4
call fcn.005878a0
jmp 0x56a688
mov ecx, 4
mov edx, 8
call fcn.0057f230
int3