joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003c70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10003cad
cmp byte [ebp - 0x190], 2
jne 0x10003ca7
mov al, byte [ebp - 0x18f]
cmp al, 2
jne 0x10003ca7
push 1
pop eax
leave
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
leave
ret

Function at 0x10003d67
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10003dae
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x10003dae
movsx eax, word [eax + 0xa]
push eax
lea eax, [ebp - 0xc]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x10003db2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003dd0
xor eax, eax
jmp 0x10003e0f
push dword [ebp + 8]
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10003e0d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x10003e0f
mov eax, esi
pop esi
leave
ret
Function at 0x10004048
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x10091d98], esi
jne 0x1000407d
push edi
push esi
push esi
push esi
push 0x100043b2
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [esp + 0xc], esi
mov edi, eax
je 0x10004075
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 4
Function at 0x1000480f
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x100047a8
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x10004dc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
jle 0x10004e11
push esi
inc cl
movzx ecx, cl
mov edx, dword [eax + ecx*4 + 8]
mov dword [ebp + 8], ecx
lea esi, [eax + ecx*4 + 8]
mov cl, dl
add cl, bl
movzx ebx, cl
mov ecx, dword [eax + ebx*4 + 8]
mov dword [esi], ecx
mov esi, dword [ebp + 0xc]
add cl, dl
mov dword [eax + ebx*4 + 8], edx
movzx ecx, cl
add esi, edi
mov cl, byte [eax + ecx*4 + 8]
xor byte [esi], cl
mov ecx, dword [ebp + 8]
inc edi
cmp edi, dword [ebp + 0x10]
jl 0x10004dd6
pop esi
mov dword [eax + 4], ebx
pop edi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
Function at 0x10005545
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x104
push edi
push esi
push 0x10091fa4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push 0x10091ea0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x10091d9c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, 0x100920a8
push esi
push ebx
push 0
call edi
mov eax, dword [0x100923b4]
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
test eax, eax
je 0x100055a0
push esi
mov esi, 0x100922b0
push esi
push eax
call edi
push esi
call ebp
pop ecx
push ebx
call ebp
push ebx
call fcn.100055bc
push eax
push 0x100921ac
call sub.MSVCRT.dll_strcpy
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1000572e
Capabilities:
Set file attributes

Disassembly:
push 6
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x1000573b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10005782
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x10005782
movsx eax, word [eax + 0xa]
push eax
lea eax, [ebp - 0xc]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0xc]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x10005a65
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret

Function at 0x10006536
Capabilities:
Accept command line arguments
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, str.ServerMain
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x1000657e
add esi, 0xb
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x1000657e
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10006565
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006588
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
leave
ret 8

Function at 0x100065fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 0x10], 0
push edi
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp + 0xc]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
pop edi
jne 0x10006649
mov eax, dword [ebp + 8]
shr eax, 0x10
test ax, ax
jne 0x10006641
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x1000a7f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
leave
ret 8
Function at 0x65901873
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call eax
sub esp, 4
cmp dword [ebp + 0xc], 1
jne 0x659018c8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.77777777777777.dll__Z10FUNSARANSKP11HINSTANCE___4
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov eax, 1
leave
ret 0xc
Function at 0x65916870
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x659168d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x65a36034]
test esi, esi
jle 0x659169f0
mov eax, dword [0x65a36038]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x65916904
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x65916987
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x659168f0
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x65916a17
mov eax, dword [0x65a36038]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x65a36038]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x659169f7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x65916980
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x65916990
add dword [0x65a36034], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x65a36038]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x65916980
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x6591690e
mov eax, dword [0x65a36038]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x65916e50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
cmp eax, 2
je 0x65916f80
ja 0x65916e98
test eax, eax
je 0x65916f18
mov eax, dword [0x65a36040]
test eax, eax
je 0x65917000
mov dword [0x65a36040], 1
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 3
jne 0x65916e85
mov eax, dword [0x65a36040]
test eax, eax
je 0x65916e85
mov dword [esp], 0x65a36044
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x65a3603c]
sub esp, 4
test ebx, ebx
je 0x65916efd
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call edi
mov ebp, eax
sub esp, 4
call esi
test ebp, ebp
je 0x65917028
test eax, eax
jne 0x65917028
mov eax, dword [ebx + 4]
mov dword [esp], ebp
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65916ed0
mov dword [esp], 0x65a36044
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x65916e85
mov eax, dword [0x65a36040]
test eax, eax
jne 0x65916f98
mov eax, dword [0x65a36040]
cmp eax, 1
jne 0x65916e85
mov ebx, dword [0x65a3603c]
test ebx, ebx
je 0x65916f51
lea esi, [esi]
mov eax, ebx
mov ebx, dword [ebx + 8]
mov dword [esp], eax
call sym._free
test ebx, ebx
jne 0x65916f40
mov dword [0x65a3603c], 0
mov dword [0x65a36040], 0
mov dword [esp], 0x65a36044
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
sub esp, 4
jmp 0x65916e85
call sym.__fpreset
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x65a36044
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x65a3603c]
sub esp, 4
test ebx, ebx
je 0x65916fe5
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 4
mov ebp, eax
call esi
test eax, eax
jne 0x65917018
test ebp, ebp
je 0x65917018
mov eax, dword [ebx + 4]
mov dword [esp], ebp
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65916fc0
mov dword [esp], 0x65a36044
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x65916f21
mov dword [esp], 0x65a36044
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
jmp 0x65916e7b
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65916fc0
jmp 0x65916fe5
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x65916ed0
jmp 0x65916efd

Function at 0x65917150
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x65900000], 0x5a4d
jne 0x65917175
mov ecx, dword [0x6590003c]
cmp dword [ecx + 0x65900000], 0x4550
lea edx, [ecx + 0x65900000]
je 0x65917180
ret
cmp word [ecx + 0x65900018], 0x10b
jne 0x65917175
push esi
movzx eax, word [ecx + 0x65900014]
push ebx
movzx esi, word [ecx + 0x65900006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x65900000
test si, si
je 0x659171c8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x659171be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x659171ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x659171b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x65917890
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x659178c0
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp sym.___mingwthr_key_dtor
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x65917900
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x65917940
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x65917968
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x65917b30
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x65a2622c]
test eax, eax
je 0x65917b50
mov eax, dword [0x65a26230]
test eax, eax
je 0x65917b60
mov eax, dword [0x65a26238]
test eax, eax
js 0x65917b50
ret
mov dword [0x65a26238], 0
ret
push ebx
sub esp, 0x18
lock add dword [0x65a26234], 1
jne 0x65917bb0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x65917bf0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x65a36070], eax
call sym.___mingwthr_key_dtor
mov dword [0x65a26230], 1
test eax, eax
sete al
movzx eax, al
mov dword [0x65a26238], eax
add esp, 0x18
pop ebx
ret
mov eax, dword [0x65a26230]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x65917bd6
nop
mov dword [esp], 0
call ebx
mov ecx, dword [0x65a26230]
sub esp, 4
test ecx, ecx
je 0x65917bc0
mov edx, dword [0x65a26238]
test edx, edx
jns 0x65917ba5
mov dword [0x65a26238], 0
jmp 0x65917ba5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x65917b8e

Function at 0x65917c00
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
mov edx, dword [0x65a26238]
test edx, edx
js 0x65917c28
mov esi, dword [0x65a36074]
test edx, edx
jne 0x65917c3d
mov dword [ebx], esi
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call sym._fc_key_init_once
mov edx, dword [0x65a26238]
mov esi, dword [0x65a36074]
test edx, edx
je 0x65917c1c
mov esi, dword [0x65a36070]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebx], esi
sub esp, 4
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x65917cd0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, 1
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov ecx, dword [edx]
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x24], eax
jmp 0x65917d0f
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [0x65a36074], edx
mov dword [ebx], ecx
add ebp, 1
mov eax, dword [edi]
mov edx, dword [edi + 4]
test ecx, ecx
je 0x65917df8
mov esi, dword [ecx + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call eax
test eax, eax
jne 0x65917e31
test esi, esi
je 0x65917d90
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 4], 0xa
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call esi
cmp eax, 7
je 0x65917f10
cmp eax, 8
jne 0x65917e31
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [0x65a26238]
test eax, eax
js 0x65917dd0
test eax, eax
je 0x65917d00
mov eax, dword [0x65a36070]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x65917e40
mov eax, dword [ebx]
mov ecx, dword [eax]
jmp 0x65917d0a
mov eax, dword [0x65a2622c]
mov ecx, edx
test eax, eax
je 0x65917de5
mov esi, dword [0x65a26230]
test esi, esi
je 0x65917e50
mov dword [0x65a26238], 0
jmp 0x65917d04
mov ecx, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
je 0x65917eb0
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x65917dc2
lock add dword [0x65a26234], 1
jne 0x65917ec0
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edx, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x65917f18
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x65a36070], eax
call sym.___mingwthr_key_dtor
mov edx, dword [esp + 0x2c]
mov dword [0x65a26230], 1
test eax, eax
sete al
movzx eax, al
mov dword [0x65a26238], eax
jmp 0x65917d9d
mov dword [esi], ebp
mov eax, 5
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x65a26230]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test ecx, ecx
jne 0x65917ef1
mov dword [esp + 0x2c], edx
lea esi, [esi]
mov dword [esp], 0
call esi
mov eax, dword [0x65a26230]
sub esp, 4
test eax, eax
je 0x65917ed8
mov edx, dword [esp + 0x2c]
mov eax, dword [0x65a26238]
test eax, eax
jns 0x65917d9d
mov eax, dword [ebx]
mov ecx, dword [eax]
jmp 0x65917de5
mov esi, dword [esp + 0x28]
mov dword [esi], ebp
jmp 0x65917eb7
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x2c]
jmp 0x65917e8a
Function at 0x65917f30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x65a26238]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x65917fb0
test eax, eax
jne 0x65917f60
mov eax, dword [0x65a36074]
mov dword [0x65a36074], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x65a36070]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x65a36070]
mov dword [ebx], esi
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x65917f55
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call sym._fc_key_init_once
mov eax, dword [0x65a26238]
jmp 0x65917f44

Function at 0x65917fc0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x65a26238]
test eax, eax
js 0x65918010
test eax, eax
jne 0x65917fe8
mov dword [0x65a36074], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x65a36070]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x65917fdd
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call sym._fc_key_init_once
mov eax, dword [0x65a26238]
jmp 0x65917fd3
Function at 0x65922d80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], str.msvcrt.dll
mov esi, dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x65922dc8
mov dword [esp + 0x20], esi
mov dword [sym._init_rand_s], eax
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
mov dword [0x65a36b24], eax
sub esp, 8
mov eax, sym._mingw_rand_s
jmp 0x65922db3
Function at 0x6593e810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x80]
mov dword [esp + 0x38], ecx
mov ecx, 0x65a271ac
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x34], eax
call dbg.std::locale::id::_M_id() const
mov edx, dword [esi + 0x6c]
mov ecx, dword [edx + 4]
cmp eax, dword [edx + 8]
jae 0x6593e96a
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x6593e96a
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x44]
mov ecx, dword [esp + 0x38]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.65940ac0
mov ecx, ebp
sub esp, 0x24
mov esi, eax
mov ebx, edx
mov eax, dword [esp + 0x88]
mov dword [esp], eax
call dbg.std::__time_get_state::_M_finalize_state(tm*)
sub esp, 4
cmp ebx, 0xffffffff
sete dl
test esi, esi
setne al
and al, dl
mov ebp, eax
jne 0x6593e948
cmp dword [esp + 0x34], 0xffffffff
sete al
test edi, edi
je 0x6593e8fe
test al, al
jne 0x6593e920
cmp dl, al
jne 0x6593e90c
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, esi
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ecx
jb 0x6593e8fe
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x6593e8fe
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
jae 0x6593e958
xor edx, edx
jmp 0x6593e8ee
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x6593e950
mov edx, ebp
xor esi, esi
jmp 0x6593e8ee
call dbg.std::__throw_bad_cast()
nop