joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [edx], 0x80000000
mov esi, dword [ecx]
mov edi, ecx
jne 0x4ec1c2
cmp esi, 0x80000000
je 0x4ec1bb
mov ebp, dword [edi + 8]
test ebp, ebp
je 0x4ec1bb
mov ebx, dword [edi + 4]
cmp ebp, 1
mov dword [esp + 8], esi
mov ecx, dword [ebx + 8]
jne 0x4ec21e
test ecx, ecx
je 0x4ec398
add ebx, 0xc
shl ebp, 4
nop
mov byte [ebx], 0
add ebx, 0x10
add ebp, 0xfffffff0
jne 0x4ec1b0
xor edi, edi
jmp 0x4ec3df
cmp esi, 0x80000000
jne 0x4ec3df
mov ebp, dword [edx + 8]
mov ebx, dword [edx + 4]
xor edi, edi
mov dword [edx + 8], 0
test ebp, ebp
je 0x4ec3df
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
add ebx, 4
mov dword [esp], edx
jmp 0x4ec20a
add ebx, 0x10
dec ebp
je 0x4ec3dc
cmp dword [ebx - 4], 0
je 0x4ec200
push dword [ebx]
push 0
push dword [0x5b93c8]
call esi
jmp 0x4ec200
lea eax, [ebp + 0xfffffff]
mov dword [esp], edx
mov dword [esp + 4], eax
and eax, 0xfffffff
cmp eax, 8
jae 0x4ec23c
xor esi, esi
jmp 0x4ec374
mov edx, dword [esp + 4]
movd xmm0, ecx
mov esi, eax
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x5473a0]
movdqa xmm2, xmm1
and edx, 7
sub esi, edx
mov dword [esp + 4], edx
lea edx, [ebx + 0x88]
mov ecx, esi
nop dword [eax + eax]
movd xmm3, dword [edx - 0x40]
movd xmm5, dword [edx - 0x50]
movd xmm4, dword [edx - 0x70]
movd xmm6, dword [edx - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edx]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edx - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x30]
sub edx, 0xffffff80
add ecx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x4ec270
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [esp + 4], 0
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ecx, xmm0
je 0x4ec38d
sub eax, esi
shl esi, 4
lea edx, [esi + ebx + 0x18]
nop dword [eax]
mov esi, dword [edx]
cmp ecx, esi
cmovae ecx, esi
add edx, 0x10
dec eax
jne 0x4ec380
mov edx, dword [esp]
test ecx, ecx
jne 0x4ec1a9
lea esi, [ebx + 4]
mov dword [esp], edx
jmp 0x4ec3a6
add esi, 0x10
dec ebp
je 0x4ec3be
cmp dword [esi - 4], 0
je 0x4ec3a0
push dword [esi]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4ec3a0
cmp dword [esp + 8], 0
je 0x4ec3d4
push ebx
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [edi], 0x80000000
xor edi, edi
mov edx, dword [esp]
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4fe250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x539390
mov esi, ecx
lea eax, [ebp - 0x18]
mov edx, 0x200
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
xor ecx, ecx
movzx eax, byte [0x5b9430]
call fcn.0051b940
test eax, eax
je 0x4fe354
movdqa xmm0, xmmword [0x5473a0]
mov ecx, 0xfffffe00
mov dword [ebp - 0x30], esi
nop word [eax + eax]
movdqu xmm2, xmmword [ecx + 0x5687b8]
pshufd xmm1, xmm2, 0xe8
pshufd xmm3, xmm2, 0xed
movdqa xmm4, xmm1
movdqa xmm2, xmm3
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm2, xmm4
movdqa xmm4, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmm1
pand xmm1, xmm2
pand xmm2, xmm3
pandn xmm4, xmm3
por xmm1, xmm4
por xmm2, xmm5
punpckldq xmm1, xmm2
movdqu xmmword [eax + ecx + 0x200], xmm1
add ecx, 0x10
jne 0x4fe2b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x40
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
call fcn.004f6d50
movsd xmm0, qword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
movsd xmm1, qword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 0x200
call fcn.0053b730
nop word cs:[eax + eax]
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x4fe38e
push dword [ebp - 0x28]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0xc
pop ebp
ret
Function at 0x4fed80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x5393d0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov edi, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], edi
mov dword fs:[0], eax
je 0x4fee12
mov dword [ebp - 0x20], edx
lea edx, [esi*8]
xor ecx, ecx
mov edi, esi
xor ebx, ebx
movzx eax, byte [0x5b9430]
mov esi, edx
call fcn.0051b940
test eax, eax
je 0x4fef10
cmp edi, 0x10
mov esi, edi
jae 0x4fee5d
mov edi, dword [ebp - 0x20]
nop word [eax + eax]
mov ecx, dword [edi + ebx*8]
mov edx, dword [edi + ebx*8 + 4]
cmp ecx, edx
mov edi, edx
cmovb edi, ecx
cmova edx, ecx
mov dword [eax + ebx*8], edi
mov edi, dword [ebp - 0x20]
mov dword [eax + ebx*8 + 4], edx
inc ebx
cmp esi, ebx
jne 0x4fedf0
jmp 0x4fee17
mov eax, 4
lea ecx, [ebp - 0x30]
test esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 0
sete byte [ebp - 0x24]
call fcn.004f6d50
movsd xmm0, qword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [eax + esi*8 - 8]
cmp ecx, eax
jb 0x4fef00
mov edx, eax
lea ecx, [eax + esi*8 - 4]
add edx, 4
cmp ecx, edx
jb 0x4fef08
mov edi, dword [ebp - 0x20]
lea ecx, [esi - 1]
cmp ecx, 0x1fffffff
ja 0x4fedf0
movdqa xmm0, xmmword [0x5473a0]
mov ebx, esi
xor ecx, ecx
and ebx, 0xfffffffe
nop dword [eax + eax]
movdqu xmm2, xmmword [edi + ecx*8]
pshufd xmm1, xmm2, 0xe8
pshufd xmm3, xmm2, 0xed
movdqa xmm4, xmm1
movdqa xmm2, xmm3
pxor xmm4, xmm0
pxor xmm2, xmm0
pcmpgtd xmm2, xmm4
movdqa xmm4, xmm2
movdqa xmm5, xmm2
pandn xmm5, xmm1
pand xmm1, xmm2
pand xmm2, xmm3
pandn xmm4, xmm3
por xmm1, xmm4
por xmm2, xmm5
punpckldq xmm1, xmm2
movdqu xmmword [eax + ecx*8], xmm1
add ecx, 2
cmp ebx, ecx
jne 0x4feea0
cmp ebx, esi
jne 0x4fedf0
jmp 0x4fee17
mov edi, dword [ebp - 0x20]
jmp 0x4fedf0
mov edi, dword [ebp - 0x20]
jmp 0x4fedf0
mov ecx, 4
mov edx, esi
call fcn.0053b730
nop dword [eax]
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp - 0x30], 0
je 0x4fef3e
push dword [ebp - 0x2c]
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0xc
pop ebp
ret
Function at 0x50e460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x539560
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x5b93d4]
test al, al
je 0x50e631
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x50e4ac
cmp eax, 3
jne 0x50e62a
mov ebx, dword [0x5b93d8]
test ebx, ebx
je 0x50e62a
mov dword [ebp - 0x20], 0
jmp 0x50e4d7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x50e508
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x50e67b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x50e4d0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x50e4d0
test byte [ebp - 0x20], 1
je 0x50e62a
mov ebx, dword [0x5b93d8]
test ebx, ebx
je 0x50e62a
mov dword [ebp - 0x20], 0
jmp 0x50e537
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x50e568
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x50e67b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x50e530
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x50e530
test byte [ebp - 0x20], 1
je 0x50e62a
mov ebx, dword [0x5b93d8]
test ebx, ebx
je 0x50e62a
mov dword [ebp - 0x20], 0
jmp 0x50e597
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x50e5c8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x50e67b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x50e590
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x50e590
test byte [ebp - 0x20], 1
je 0x50e62a
mov ebx, dword [0x5b93d8]
test ebx, ebx
je 0x50e62a
mov dword [ebp - 0x20], 0
jmp 0x50e5f7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x50e624
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x50e67b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x50e5f0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x50e5f0
test byte [ebp - 0x20], 1
jne 0x50e644
movzx eax, byte [0x5a92c0]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x5b93d8]
jmp 0x50e64f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x50e62a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x50e67b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x50e64c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x50e64c
mov ecx, 0x5a54cc
mov dword [ebp - 0x10], 0
call fcn.0053bf10
ud2
Function at 0x50f410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5b80f0]
test eax, eax
je 0x50f438
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x50f44e
cmp dword [eax + 4], 0
mov edi, eax
je 0x50f44e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5b80f0
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x50f428
mov eax, dword [0x5b80f0]
test eax, eax
je 0x50f4e7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x50f501
mov esi, eax
test eax, eax
jne 0x50f4ae
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0xc
call fcn.0051b940
test eax, eax
je 0x50f514
mov dword [eax], 0x5b80f0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5b80f0]
test eax, eax
je 0x50f508
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x50f433
test ecx, ecx
je 0x50f433
lock dec dword [ecx]
jne 0x50f433
call fcn.0050eef0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5b80f0
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x50f46c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5b80f0
call fcn.00545b80
jmp 0x50f4a6
mov ecx, 4
mov edx, 0xc
call fcn.0053b730
int3

Function at 0x50fa40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5b8100]
test eax, eax
je 0x50fabd
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x50fa5f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x50fab6
mov eax, dword [0x5b8100]
test eax, eax
je 0x50fad5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x50faeb
mov esi, eax
test eax, eax
jne 0x50fab0
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 8
call fcn.0051b940
test eax, eax
je 0x50fafd
mov dword [eax], 0x5b8100
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x5b8100]
test eax, eax
je 0x50faf1
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0x5b8100
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x50fa57
jmp 0x50fa5f
mov ecx, 0x5b8100
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x50fa75
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x5b8100
call fcn.00545b80
jmp 0x50faa8
mov ecx, 4
mov edx, 8
call fcn.0053b730
int3
Function at 0x510ac0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x5b80e0]
test eax, eax
je 0x510ae2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x510af8
cmp dword [eax + 4], 0
je 0x510af8
add eax, 8
pop esi
ret
mov ecx, 0x5b80e0
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x510ad7
mov eax, dword [0x5b80e0]
test eax, eax
je 0x510b63
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x510b79
mov esi, eax
test eax, eax
jne 0x510b4c
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0x10
call fcn.0051b940
test eax, eax
je 0x510b89
mov dword [eax], 0x5b80e0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5b80e0]
test eax, eax
je 0x510b7d
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
mov ecx, 0x5b80e0
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x510b0e
xor eax, eax
pop esi
ret
mov ecx, 0x5b80e0
call fcn.00545b80
jmp 0x510b44
mov ecx, 4
mov edx, 0x10
call fcn.0053b730
int3
Function at 0x5117b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x5396e0
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x51191b
mov ebx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
movq xmm0, qword [0x5b93e0]
movd edx, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [esi + 4], ecx
movd edi, xmm0
mov eax, edx
or eax, edi
jne 0x511869
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x511954
movq xmm0, qword [esi + 8]
mov edx, dword [esi + 8]
mov edi, dword [esi + 0xc]
movq qword [0x5b93e0], xmm0
mov eax, edx
mov ecx, dword [esi + 4]
or eax, edi
je 0x511907
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], ebx
push edi
push edx
push ecx
push ebx
mov edi, edx
mov dword [esi + 0x28], edx
call fcn.0053a370
mov dword [esi + 0x1c], eax
mov ebx, edx
mov ecx, edi
mov dword [esi + 0x2c], edx
mul edi
mov edi, dword [esi + 0x20]
imul ecx, ebx
mov ebx, dword [esi + 0x1c]
add ecx, edx
mov edx, edi
imul edx, ebx
add ecx, edx
mov edx, dword [esi + 0x24]
sub edx, eax
mov eax, dword [esi + 4]
sbb eax, ecx
imul ecx, eax, 0x3b9aca00
mov eax, edx
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push edi
push dword [esi + 0x28]
push edx
push eax
call fcn.0053a370
mov ecx, eax
mov dword [esi + 4], edx
mov eax, ebx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 0x2c], 0x3b9aca00
add eax, edx
add edi, ecx
adc eax, dword [esi + 4]
push 0
push 0x3b9aca00
push eax
push edi
call fcn.0053a370
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x38]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero
mov edx, 0x19
push 0x5a47dc
call fcn.0053bbd0
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x5a55d0
push 0x5a37bc
push eax
call fcn.0053be90
add esp, 0xc
jmp 0x51198b
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 1
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x5a55c0
push 0x5a37bc
push eax
call fcn.0053be90
add esp, 0xc
ud2
Function at 0x519d30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x5b8110]
test eax, eax
je 0x519d58
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x519d6e
cmp dword [eax + 4], 0
mov edi, eax
je 0x519d6e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5b8110
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x519d48
mov eax, dword [0x5b8110]
test eax, eax
je 0x519e07
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x519e21
mov esi, eax
test eax, eax
jne 0x519dce
movzx eax, byte [0x5b9430]
xor ecx, ecx
mov edx, 0xc
call fcn.0051b940
test eax, eax
je 0x519e34
mov dword [eax], 0x5b8110
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x5b8110]
test eax, eax
je 0x519e28
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x519d53
test ecx, ecx
je 0x519d53
lock dec dword [ecx]
jne 0x519d53
call fcn.004148e0
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5b8110
call fcn.00545b80
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x519d8c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x5b8110
call fcn.00545b80
jmp 0x519dc6
mov ecx, 4
mov edx, 0xc
call fcn.0053b730
int3
Function at 0x51a930
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x5b93cc]
mov esi, ecx
cmp eax, 3
jne 0x51aabb
cmp ebp, 0x17f
ja 0x51aacc
lea eax, [esp + 0x28]
push ebp
push edi
mov edi, eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x51a995
xor edx, edx
nop
cmp byte [esp + edx + 0x28], 0
je 0x51aa2f
inc edx
cmp eax, edx
jne 0x51a980
jmp 0x51aa85
lea ecx, [esp + 0x2b]
and ecx, 0xfffffffc
sub ecx, edi
je 0x51a9c8
je 0x51a9c8
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [esp + edx + 0x28], 0
je 0x51aa2f
inc edx
cmp ecx, edx
jne 0x51a9b0
lea edx, [ebp - 7]
mov dword [esp], ebx
cmp ecx, edx
jbe 0x51a9d0
jmp 0x51aa0e
mov dword [esp], ebx
lea edx, [ebp - 7]
xor ecx, ecx
movdqa xmm0, xmmword [0x547360]
movdqa xmm1, xmmword [0x547370]
movq xmm2, qword [esp + ecx + 0x28]
movdqa xmm3, xmm2
paddd xmm3, xmm0
pandn xmm2, xmm3
pand xmm2, xmm1
movd edi, xmm2
pshufd xmm2, xmm2, 0x55
movd ebx, xmm2
or ebx, edi
jne 0x51aa0e
add ecx, 8
cmp ecx, edx
jbe 0x51a9e0
mov ebx, dword [esp]
sub eax, ecx
je 0x51aa85
lea edi, [esp + ecx + 0x28]
xor edx, edx
nop dword [eax + eax]
cmp byte [edi + edx], 0
je 0x51aa2d
inc edx
cmp eax, edx
jne 0x51aa20
jmp 0x51aa85
add edx, ecx
cmp edx, ebp
jne 0x51aa85
pxor xmm0, xmm0
lea eax, [esp + 4]
mov dword [esp + 4], 0
lea ecx, [esp + 8]
movdqu xmmword [esp + 8], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x51aa9e
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x51aaae
mov eax, dword [0x5a4598]
mov ecx, dword [0x5a459c]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x51aab0
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], bx
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00546140
cmp ebp, 0x17f
jbe 0x51a95f
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.00546190
add esp, 0x1b0
jmp 0x51aab6
Function at 0x51b050
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
test dx, dx
mov eax, 2
mov ebx, 0x17
mov esi, ecx
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x51b08b
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x51b09f
cmp eax, 0x2739
jne 0x51b0ca
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x51b0d4
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x51b0e7
mov dword [esi + 4], edi
jmp 0x51b084
mov byte [esi], 0
mov dword [esi + 4], eax
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
pop esi
pop edi
pop ebx
ret

Function at 0x51b4c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x539920
mov esi, edx
mov edi, ecx
xor ecx, ecx
mov edx, 8
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x5b9430]
call fcn.0051b940
test eax, eax
je 0x51b5b3
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x51b640
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x51b53a
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x51b5a2
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x51b587
cmp dword [eax + 8], 9
jae 0x51b572
mov eax, dword [ebp - 0x20]
jmp 0x51b578
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x5b93c8]
call dword [sym.imp.kernel32.dll_HeapFree]
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.0053b730
ud2