joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539460
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x34
mov eax, dword [0x58a48c]
test eax, eax
js 0x5394e8
cmp eax, 1
je 0x5394c0
cmp eax, 0x100
je 0x5394c0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], esi
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov eax, dword [0x58a48c]
test eax, eax
je 0x5394b7
movzx eax, word [0x6da088]
mov dword [esp + 4], eax
mov eax, dword [0x6da084]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
add esp, 0x34
pop ebx
pop esi
ret
movzx eax, byte [ebx + 0x605553]
or ax, word [0x6da08a]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [0x6da084]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
sub esp, 8
jmp 0x53947e
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
cmp eax, 0xffffffff
mov dword [0x6da084], eax
je 0x539512
mov dword [esp], str.NO_COLOR
call sub.msvcrt.dll_getenv
test eax, eax
je 0x539521
mov dword [0x58a48c], 0
jmp 0x53947e
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x539512
lea eax, [esp + 0x1a]
mov dword [esp + 4], eax
mov eax, dword [0x6da084]
mov dword [0x58a48c], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push edx
push edx
movzx eax, word [esp + 0x22]
mov word [0x6da088], ax
and ax, 0xf0
mov word [0x6da08a], ax
mov eax, dword [0x58a48c]
jmp 0x539472
Function at 0x53b0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov eax, dword [esp + 0x14]
imul dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
imul ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
pop ebx
jmp fcn.0053ac00
Function at 0x53bff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
fld qword [esp + 0x80]
mov dword [esp + 0x6c], ebx
fld st(0)
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], ebp
fxam
wait
fnstsw ax
fstp st(0)
and eax, 0x4500
cmp eax, 0x100
je 0x53c1d0
fld st(0)
fabs
fld qword [0x605700]
fxch st(1)
fucomi st(1)
fstp st(1)
jbe 0x53c060
fstp st(0)
fldz
xor eax, eax
fucompi st(1)
fstp st(0)
setbe al
xor edx, edx
lea eax, [eax + eax - 1]
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
add esp, 0x7c
ret
fld xword [0x605710]
lea ebp, [esp + 0x58]
faddp st(1)
lea ebx, [esp + 0x5c]
fstp qword [esp]
fstp qword [esp + 0x20]
call fcn.00568740
mov edx, 0
mov ecx, 0x3d
fldln2
fdivp st(1)
fnstcw word [esp + 0x46]
movzx eax, word [esp + 0x46]
mov ah, 0xc
mov word [esp + 0x44], ax
fldcw word [esp + 0x44]
fistp dword [esp + 0x40]
fldcw word [esp + 0x46]
mov eax, dword [esp + 0x40]
test eax, eax
cmovs eax, edx
sub ecx, eax
mov edi, ecx
shr edi, 5
and edi, 1
mov esi, edi
xor esi, 1
shl esi, cl
shl edi, cl
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edi
fild qword [esp + 0x38]
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
fld qword [esp + 0x20]
fmulp st(1)
fadd dword [0x60571c]
fstp qword [esp]
call sub.msvcrt.dll_floor
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 4], ebx
mov dword [esp], ebp
fnstcw word [esp + 0x46]
movzx eax, word [esp + 0x46]
mov ah, 0xc
mov word [esp + 0x44], ax
mov eax, dword [esp + 0x88]
fldcw word [esp + 0x44]
fistp qword [esp + 0x30]
fldcw word [esp + 0x46]
mov edx, eax
sar edx, 0x1f
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call fcn.0053b810
mov eax, dword [esp + 0x58]
test eax, eax
fld qword [esp + 0x20]
jne 0x53c1b0
mov eax, dword [esp + 0x88]
test eax, eax
jle 0x53c1c0
fldz
mov eax, 1
fucompi st(1)
fstp st(0)
setp dl
cmove eax, edx
test al, al
je 0x53c1c2
cmp dword [esp + 0x88], 0x7fffffff
je 0x53c1c2
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x18], 0x7fffffff
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], ebp
call fcn.0053b810
jmp 0x53c1c2
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x53c14a
fstp st(0)
jmp 0x53c1c2
fstp st(0)
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
jmp 0x53c048
fstp st(0)
xor ax, ax
xor edx, edx
jmp 0x53c048
Function at 0x544ab0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
cmp edi, 0x3ffffffe
ja 0x544bb0
lea ebp, [edi + 2]
mov edx, 0x55555556
mov eax, ebp
imul edx
sar ebp, 0x1f
sub edx, ebp
shl edx, 2
cmp edx, dword [esp + 0x18]
jge 0x544bb0
cmp edi, 3
mov eax, dword [esp + 0x14]
jle 0x544b4b
mov edx, dword [ecx]
sub edi, 3
add ecx, 3
bswap edx
mov esi, edx
shr esi, 0x1a
movzx esi, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, esi
mov esi, edx
shr esi, 0x14
and esi, 0x3f
movzx esi, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], bl
mov ebx, esi
mov esi, edx
shr esi, 0xe
and esi, 0x3f
shr edx, 8
movzx esi, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], bl
mov ebx, esi
mov byte [eax + 2], bl
mov byte [eax + 3], dl
add eax, 4
cmp edi, 3
jg 0x544af1
test edi, edi
je 0x544b9e
mov esi, edi
xor edx, edx
movzx ebp, byte [ecx]
shl edx, 8
add ecx, 1
add edx, ebp
sub esi, 1
jne 0x544b53
lea ecx, [edi*8]
test ecx, ecx
jle 0x544b9e
shl edx, 6
mov esi, edx
shr esi, cl
sub ecx, 6
and esi, 0x3f
movzx esi, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, esi
mov byte [eax], bl
add eax, 1
test ecx, ecx
jg 0x544b71
mov edx, eax
sub edx, dword [esp + 0x14]
and edx, 3
je 0x544ba9
mov byte [eax], 0x3d
add eax, 1
mov edx, eax
sub edx, dword [esp + 0x14]
and edx, 3
jne 0x544b98
mov esi, dword [esp + 0x14]
mov byte [eax], 0
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x565bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
cmp dword [edx], 0x2c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
je 0x565be0
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.00562020
mov edx, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x565c68
lea ecx, [eax + 4]
mov edx, dword [eax + 0x104]
xor ebx, ebx
mov dword [esp + 0x1c], ecx
mov esi, eax
jmp 0x565c1c
mov ecx, edx
add edx, 1
add ebx, 1
cmp edi, ebx
mov byte [esi + ecx + 4], al
mov dword [esi + 0x104], edx
mov byte [esi + 0x108], al
je 0x565c68
cmp edx, 0xff
movzx eax, byte [ebp + ebx]
jne 0x565c00
mov edx, dword [esi + 0x110]
mov byte [esi + 0x103], 0
mov byte [esp + 0x18], al
mov dword [esp + 4], 0xff
mov dword [esp + 8], edx
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
call dword [esi + 0x10c]
mov edx, 1
xor ecx, ecx
add dword [esi + 0x124], 1
movzx eax, byte [esp + 0x18]
jmp 0x565c05
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret

Function at 0x565c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x28
mov eax, dword [edx]
cmp eax, 6
je 0x565c91
test eax, eax
jne 0x565ca0
add esp, 0x28
mov eax, ebx
pop ebx
jmp fcn.00562020
mov eax, dword [ebx + 0x104]
cmp eax, 0xff
lea ecx, [eax + 1]
je 0x565cf0
mov byte [ebx + eax + 4], 0x28
mov eax, ebx
mov dword [ebx + 0x104], ecx
mov byte [ebx + 0x108], 0x28
call fcn.00562020
mov eax, dword [ebx + 0x104]
cmp eax, 0xff
lea edx, [eax + 1]
je 0x565d30
mov byte [ebx + eax + 4], 0x29
mov dword [ebx + 0x104], edx
mov byte [ebx + 0x108], 0x29
add esp, 0x28
pop ebx
ret
mov eax, dword [ebx + 0x110]
mov dword [esp + 0x1c], edx
mov byte [ebx + 0x103], 0
mov dword [esp + 4], 0xff
mov dword [esp + 8], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call dword [ebx + 0x10c]
mov ecx, 1
xor eax, eax
add dword [ebx + 0x124], 1
mov edx, dword [esp + 0x1c]
jmp 0x565cb0
mov eax, dword [ebx + 0x110]
mov byte [ebx + 0x103], 0
mov dword [esp + 4], 0xff
mov dword [esp + 8], eax
lea eax, [ebx + 4]
mov dword [esp], eax
call dword [ebx + 0x10c]
mov edx, 1
xor eax, eax
add dword [ebx + 0x124], 1
jmp 0x565cd9

Function at 0x5666b0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00566710
Function at 0x566710
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
mov ecx, dword [0x6e7918]
mov dword [esp + 0x1c], edx
test ecx, ecx
jle 0x566819
mov eax, dword [0x6e7914]
xor esi, esi
mov edx, dword [eax + 4]
cmp ebx, edx
jb 0x566749
mov edi, dword [eax + 8]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x5667cc
add esi, 1
add eax, 0xc
cmp esi, ecx
jne 0x566734
mov dword [esp], ebx
call fcn.00566c10
test eax, eax
mov edi, eax
je 0x566840
lea edx, [esi + esi*2]
mov esi, dword [0x6e7914]
shl edx, 2
add esi, edx
mov dword [esi + 8], eax
mov dword [esi], 0
mov dword [esp + 0x18], edx
call fcn.00566cf0
mov edx, dword [esp + 0x18]
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [0x6e7914]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + edx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x18]
je 0x566820
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x5667e8
add dword [0x6e7918], 1
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x5667c5
mov eax, dword [esp + 0x30]
add edx, dword [0x6e7914]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
jmp 0x5667c5
xor esi, esi
jmp 0x566753
mov eax, dword [0x6e7914]
mov eax, dword [eax + edx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.005666b0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.005666b0

Function at 0x566b00
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0x566b10
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x566b0d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0x5670d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6e7c84
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6e7c9c]
sub esp, 4
test ebx, ebx
je 0x567125
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x56711e
test esi, esi
je 0x56711e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x567100
mov dword [esp], 0x6e7c84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x567310
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x58a4a4]
test ebx, ebx
je 0x56736e
mov ecx, dword [0x58a4ac]
mov eax, dword [0x58a4a8]
test ecx, ecx
jne 0x56736a
mov eax, 1
lock xadd dword [0x58a4b0], eax
cmp eax, 0xffffffff
je 0x567380
mov edx, dword [0x58a4ac]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test edx, edx
jne 0x567365
nop
mov dword [esp], 0
call ebx
mov eax, dword [0x58a4ac]
sub esp, 4
test eax, eax
je 0x567350
mov eax, dword [0x58a4a8]
test eax, eax
jns 0x567378
mov dword [0x58a4a8], 0
add esp, 0x18
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x5673b9
mov dword [0x6e7ca4], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0056e380
test eax, eax
sete al
movzx eax, al
mov dword [0x58a4a8], eax
mov dword [0x58a4ac], 1
jmp 0x567378
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x5673a0

Function at 0x5674d0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x3c
mov edx, dword [eax + 0xc]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x10]
mov eax, dword [ebx]
mov dword [esp + 0x2c], edx
jmp 0x5674fc
mov dword [0x6e7ca8], edi
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x5675c1
mov ebp, dword [eax + 0x18]
xor edi, edi
mov eax, 0xa
mov edx, dword [esp + 0x2c]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], edx
mov edx, dword [esi]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
mov dword [esp + 8], edx
call dword [esp + 0x28]
test eax, eax
jne 0x5675e0
cmp edi, 5
je 0x5675e5
test ebp, ebp
lea esi, [esi]
je 0x567584
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call ebp
cmp eax, 7
mov edi, eax
je 0x5675e5
cmp eax, 8
jne 0x5675e0
mov eax, dword [ebx]
mov edi, dword [eax]
mov eax, dword [0x58a4a8]
test eax, eax
js 0x5675d2
test eax, eax
je 0x5674f0
mov eax, dword [0x6e7ca4]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x5674f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x5674f6
xor ebp, ebp
mov edi, 5
mov eax, 0x1a
jmp 0x56750e
call fcn.00567310
mov eax, dword [0x58a4a8]
jmp 0x567591
mov edi, 2
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5675f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub esp, 0x2c
mov eax, dword [0x58a4a8]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
test eax, eax
mov dword [esp + 0x28], ebp
js 0x5676a0
test eax, eax
jne 0x567640
mov eax, dword [0x6e7ca8]
mov dword [0x6e7ca8], ebx
mov dword [ebx], eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [0x6e7ca4]
call esi
mov dword [esp], ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebp, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x6e7ca4]
mov dword [ebx], ebp
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x567625
mov edx, esi
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
add esp, 0x2c
jmp edx
call fcn.00567310
mov eax, dword [0x58a4a8]
jmp 0x567614

Function at 0x5676b0
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x58a4a8]
test eax, eax
js 0x5676f6
test eax, eax
jne 0x5676d2
mov dword [0x6e7ca8], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x6e7ca4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x5676cd
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x18
pop ebx
jmp eax
call fcn.00567310
mov eax, dword [0x58a4a8]
jmp 0x5676c3

Function at 0x567800
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x58a4a8]
mov ebx, dword [esp + 0x40]
test eax, eax
js 0x5678e3
test eax, eax
mov edi, dword [0x6e7ca8]
jne 0x567881
test edi, edi
mov dword [esp + 0x2c], edi
je 0x567875
mov eax, edi
lea esi, [esp + 0x2c]
nop
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x567867
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call ecx
cmp eax, 6
je 0x5678b0
cmp eax, 8
jne 0x5678d7
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x2c], eax
jne 0x567830
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov edi, dword [0x6e7ca4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x567821
mov eax, dword [esp + 0x2c]
mov edx, esi
mov dword [ebx + 0xc], 0
mov dword [esp + 0x2c], edi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.005673d0
cmp eax, 7
jne 0x56787a
mov eax, esi
call fcn.00567460
add esp, 0x30
mov eax, 3
pop ebx
pop esi
pop edi
ret
call fcn.00567310
mov eax, dword [0x58a4a8]
jmp 0x567817
Function at 0x5679b0
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [0x58a4a8]
mov ebx, dword [esp + 0x30]
test edx, edx
js 0x567a2b
test edx, edx
mov edi, dword [0x6e7ca8]
jne 0x567a05
mov dword [esp + 0x1c], edi
mov edi, dword [ebx + 0xc]
lea esi, [esp + 0x1c]
mov edx, esi
mov eax, ebx
test edi, edi
jne 0x5679f5
call fcn.005673d0
cmp eax, 7
je 0x5679fc
nop
lea esi, [esi]
call sub.msvcrt.dll_abort
call fcn.005674d0
jmp 0x5679e6
mov eax, esi
nop
call fcn.00567460
mov edi, dword [0x6e7ca4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ecx
jmp 0x5679ce
call fcn.00567310
mov edx, dword [0x58a4a8]
jmp 0x5679c4

Function at 0x567a40
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edi
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x567a72
mov dword [esp], ebx
call fcn.00567800
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov edx, dword [0x58a4a8]
test edx, edx
js 0x567ae0
test edx, edx
mov edi, dword [0x6e7ca8]
jne 0x567ab0
lea edx, [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x1c], edi
call fcn.005674d0
cmp eax, 7
je 0x567aa0
call sub.msvcrt.dll_abort
nop
lea eax, [esp + 0x1c]
call fcn.00567460
lea esi, [esi]
mov edi, dword [0x6e7ca4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x567a86
call fcn.00567310
mov edx, dword [0x58a4a8]
jmp 0x567a7c

Function at 0x568230
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret

Function at 0x568270
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x568295
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x1c
jmp eax

Function at 0x56e380
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test eax, eax
je 0x56e3b0
mov edx, dword [0x77cb08]
test edx, edx
je 0x56e3b3
mov edx, dword [0x77cb00]
test edx, edx
je 0x56e3b0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
jmp edx
xor eax, eax
ret
or edx, 0x8c15251a
sub edx, 0x122be677
invalid
Function at 0x56e450
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push es
and esi, dword [0x58ce31]
add edx, 0x5814c63f
mov ecx, 0x32c9cb3e
sub edx, esp
add ebx, 0x5c292ed9
xchg esi, edx
inc esi
shl eax, 0xb
cmp dword [0x58aeda], ebx
jne 0x56e482
test dword [0x589913], 0xced174d4
jo 0x56e48a
add edi, dword [0x58b1ac]
inc edi
not edi
xchg edx, eax
sub edx, edx
or edx, 0x4ad4d9
shr esi, 0x1c
xchg ebx, edx
not edi
add ebx, ebp
shr ebx, 0x1c
dec ecx
jne 0x56e462
not esi
mov ebx, 0xc170e6c8
xor eax, ebp
neg esi
rol edx, 0xb
sub ecx, edi
not edx
call fcn.004c8a0f
rol esi, 0x18
sbb bh, dh
salc
xor ecx, edi
inc edi
not ebx
call fcn.00401390
call fcn.0050d353
not ebx
dec edi
xor ecx, edi
not esi
ror esi, 0x18
call fcn.004752b6
not edx
add ecx, edi
ror edx, 0xb
neg esi
xor eax, ebp
and ebx, 0x3a4a31df
xchg edx, eax
call fcn.004709f3
xchg esi, edx
ror esi, 1
sub ebx, 0x25fe0252
xchg esi, edx
neg edi
xchg ecx, edx
xor esi, 0x9e35bf20
inc edx
call fcn.004784b1
xor ebx, 0x6b335a59
call fcn.00421634
rol edx, 0x1c
dec edx
call fcn.004cd27e
xor edi, esi
call fcn.004061c6
call fcn.004e4ea2
xor edi, esi
call fcn.00468b59
inc edx
ror edx, 0x1c
xor ebx, 0x6b335a59
dec edx
xor esi, 0x9e35bf20
xchg ecx, edx
neg edi
xchg esi, edx
add ebx, 0x25fe0252
rol esi, 1
xchg esi, edx
xchg edx, eax
xor ebx, 0x4020c8
ror esi, 0xf
sub edi, ecx
neg ecx
rol esi, 7
xchg eax, edx
neg eax
xchg edi, esi
xor ebx, 0xcbea78b6
add ecx, 0x132f802e
sub byte [edi], 0x13

Function at 0x56e7e0
Capabilities:
Hash data using murmur3

Disassembly:
salc
inc eax
dec esi
rol edi, 0xe
neg esi
rol edx, 3
xor esi, 0xf227d55c
sub esi, ecx
rol ecx, 0x10
inc eax
push edi
xor ecx, esp
call fcn.0050d5c0
rol edi, 0x12
xor esi, edx
call fcn.0045b434
xor ecx, 0xf0536580
sub edi, 0x89defbd
rol edi, 7
call fcn.0051a3ba
sub edi, 0x71478fa8
ror edi, 4
sub ebx, 0x33b5795a
pop edx
jns 0x56e798
xor ebp, eax
les eax, [edx]
hlt
inc dword [ecx - 0x66a74c16]
inc edi
call fcn.0041d162
call fcn.004ce4ee
add edx, 0x479958b3
call fcn.00494250
add ebx, 0x33b5795a
rol edi, 4
add edi, 0x71478fa8
ror edi, 7
add edi, 0x89defbd
xor ecx, 0xf0536580
call fcn.00407952
xor esi, edx
ror edi, 0x12
call fcn.0041932a
xor ecx, esp
mov eax, 0x86317064
ror ebx, 5
sub eax, edx
call fcn.0041b7fa
neg esi
sub ebx, 0x5554b8f0
not edx
add esi, edi
ror edx, 0x15
dec esi
call fcn.004e6b02
inc ebx
add ebx, 0x7222673e
xor ebx, 0x4ade2433
xchg ebx, edx
not esi
call fcn.00472c72
not esi
xchg ebx, edx
xor ebx, 0x4ade2433
sub ebx, 0x7222673e
dec ebx
inc esi
rol edx, 0x15
sub esi, edi
not edx
add ebx, 0x5554b8f0
neg esi
invalid
invalid
pop edx
jns 0x56e798
xor ebp, eax
les eax, [edx]
hlt