joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5387c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x538895
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x34], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
and al, 0x50
add byte [rax], al
add byte [rax], al
lea r8, [0x005cd8b0]

Function at 0x5390a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x5391ad
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x5390d8
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x539170
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x53918f
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x53912d
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x539149
jmp 0x53913e
call fcn.005ab3f4
cmp eax, 0x3e5
je 0x539144
cmp eax, 0x6d
jne 0x539160
mov byte [rsi + 1], 0
jmp 0x539154
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x539156
mov r8d, 0x10
mov rcx, rbx
call fcn.004fec60
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x5390e5
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.004fec60
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x5390e5
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.004f7a50
ud2
Function at 0x53de20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.00540560
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x53de95
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.00530050
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x53dea3
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x53dec3
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x53deb4
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.004f5ab0
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rdx, xmm6
test rdx, rdx
je 0x53deb4
add rdx, rdx
mov r8d, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.0044f660

Function at 0x53edc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x80
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x53edf6
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
add rsp, 0x80
pop rsi
ret
call fcn.005ab3f4
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [fcn.00518df0]
mov qword [rsp + 0x48], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rsp + 0x50]
call fcn.00587e80
ud2

Function at 0x53f9d0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x53fa92
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x0053faf0]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x53fa85
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x53fa5e
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.0044f660
mov edx, 0x10
mov r8d, 8
mov rcx, rsi
call fcn.0044f660
call fcn.005ab3f4
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 8
mov edx, 0x10
call fcn.00578c70
ud2
Function at 0x53fd10
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp qword [rcx], 0
je 0x53fd95
mov dword [rsp + 0x2c], 0
lea rbx, [rsi + 0x10]
lea r8, [rsp + 0x2c]
mov rcx, rbx
xor edx, edx
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rsp + 0x28], eax
cmp eax, 1
jne 0x53fdd6
cmp dword [rsp + 0x2c], 0
je 0x53fdba
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x53fdfe
mov edi, eax
inc eax
mov dword [rsi + 0x18], eax
mov rax, qword [0x00632250]
nop
mov qword [rsi + 8], rax
lock cmpxchg qword [0x00632250], rsi
jne 0x53fd70
mov byte [0x00632248], 1
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x53fdcc
call sub.KERNEL32.dll_TlsAlloc
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x53fe4a
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x53fdbf
mov edi, dword [rsp + 0x28]
jmp 0x53fdcc
mov edi, dword [rsi + 0x18]
jmp 0x53fdca
mov edi, eax
mov ecx, dword [rsp + 0x28]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
lea rdx, [0x005d0dd8]
lea r9, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
call fcn.004f7aa0
ud2
mov rcx, rbx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x005cb080]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rdx, str.library_std_src_syswindows_thread_local_key.rs
lea rcx, [rsp + 0x30]
call fcn.00587e80
ud2
lea rax, str.out_of_TLS_indexes
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
lea rax, [0x005cb080]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call fcn.004f79c0
ud2
Function at 0x542200
Capabilities:
Resolve dns

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1f0
mov rsi, rcx
mov r14, qword [rdx]
mov rbx, qword [rdx + 8]
movzx edi, word [rdx + 0x10]
mov rax, qword [0x00632220]
cmp rax, 3
jne 0x5422f4
cmp rbx, 0x17f
ja 0x542306
lea r15, [rsp + 0x70]
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
inc rbx
lea rcx, [rsp + 0x28]
mov rdx, r15
mov r8, rbx
call fcn.00584f10
cmp qword [rsp + 0x28], 0
je 0x542284
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x542317
mov rcx, qword [rsp + 0x30]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x20]
xor edx, edx
call sub.WS2_32.dll_getaddrinfo
test eax, eax
je 0x5422dc
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x542317
mov rax, qword [rsp + 0x20]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], di
xor eax, eax
mov qword [rsi], rax
jmp 0x542317
call fcn.005283a0
cmp rbx, 0x17f
jbe 0x54223a
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, edi
call fcn.00529130
mov rax, rsi
add rsp, 0x1f0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x5428c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], pe_nt_image_headers64
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call sub.WS2_32.dll_getsockname
cmp eax, 0xffffffff
je 0x54296f
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x54297e
cmp ecx, 0x17
jne 0x5429a5
cmp eax, 0x1b
jbe 0x5429be
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
jmp 0x5429ac
cmp eax, 0xf
jbe 0x5429d8
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, [0x005d16b0]
mov edx, 0x43
call fcn.00587f10
ud2
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
lea r8, [0x005d1650]
mov edx, 0x42
call fcn.00587f10
ud2
Function at 0x542c70
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, r8
mov rsi, rcx
mov r10, qword [rsp + 0x90]
cmp r9, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, r9
cmp word [r10], 0
je 0x542cba
movups xmm0, xmmword [r10 + 4]
mov ecx, dword [r10 + 0x14]
mov r11d, dword [r10 + 0x18]
movzx r10d, word [r10 + 0x1c]
mov r9d, 0x1c
mov di, 0x17
jmp 0x542cd0
mov ecx, dword [r10 + 2]
movzx r10d, word [r10 + 6]
mov r9d, 0x10
mov di, 2
xorps xmm0, xmm0
rol r10w, 8
mov word [rsp + 0x3c], di
mov word [rsp + 0x3e], r10w
mov dword [rsp + 0x40], ecx
movups xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], r11d
mov rcx, qword [rdx]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r9d, r9d
call sub.WS2_32.dll_sendto
cmp eax, 0xffffffff
je 0x542d1a
cdqe
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x542d30
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x542d40
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x48
mov rax, r8
test rdx, rdx
je 0x542d51
add rsp, 0x48
ret
cmp word [rax], 0
je 0x542d73
movups xmm0, xmmword [rax + 4]
mov edx, dword [rax + 0x14]
mov r9d, dword [rax + 0x18]
movzx eax, word [rax + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x542d88
mov edx, dword [rax + 2]
movzx eax, word [rax + 6]
mov r8d, 0x10
mov r10w, 2
xorps xmm0, xmm0
rol ax, 8
mov word [rsp + 0x2c], r10w
mov word [rsp + 0x2e], ax
mov dword [rsp + 0x30], edx
movups xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x44], r9d
mov rcx, qword [rcx]
lea rdx, [rsp + 0x2c]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x542dbe
xor eax, eax
add rsp, 0x48
ret
call sub.WS2_32.dll_WSAGetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x48
ret
Function at 0x5479d0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rax, r8
mov rdi, rcx
mov dword [rsp + 0x60], 0
mov word [rsp + 0x64], 0
mov dword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 1
lea r8, [rsp + 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.00530910
mov rsi, rdx
test rax, rax
je 0x547a42
mov rcx, rax
mov rdx, rsi
call fcn.004f28f0
mov qword [rdi], 0
jmp 0x547baa
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.00530b80
cmp dword [rsp + 0x40], 2
jne 0x547ac8
mov rax, qword [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x547aa9
test rcx, rcx
je 0x547aa9
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rcx, r14
call qword [r15]
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x547a96
mov r8, qword [r15 + 0x10]
mov rcx, r14
call fcn.0044f660
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call fcn.0044f660
mov qword [rdi], 0
mov rcx, rsi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
mov r12, qword [rsp + 0x78]
test rsi, rsi
je 0x547b1a
mov qword [rsp + 0x40], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.KERNEL32.dll_DuplicateHandle
test eax, eax
je 0x547b96
mov rbx, qword [rsp + 0x40]
jmp 0x547b1c
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingA
test rax, rax
je 0x547b85
mov r14, rax
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x547b85
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x547ba2
mov qword [rdi], 0
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x547ba2
call fcn.005ab3f4
mov qword [rdi], 0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x549e90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x005ae808]
test ecx, ecx
je 0x549ec0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x549ed9
cmp qword [rax + 8], 0
je 0x549ed9
add rax, 0x10
jmp 0x549fa1
lea rcx, [0x005ae7f0]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x549eb0
mov ecx, dword [0x005ae808]
test ecx, ecx
je 0x549f82
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x549f9f
mov rdi, rax
test rax, rax
jne 0x549f4b
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x549fb8
mov rdi, rax
lea rax, [0x005ae7f0]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x005ae808]
test ecx, ecx
je 0x549fa8
dec ecx
mov rdx, rdi
call fcn.005ab204
xor ecx, ecx
test rsi, rsi
je 0x549f6b
mov rax, qword [rsi]
mov qword [rsi], 0
cmp rax, 1
jne 0x549f6b
mov rdx, qword [rsi + 8]
mov ecx, dword [rsi + 0x10]
jmp 0x549f6d
xor edx, edx
mov qword [rdi + 8], 1
lea rax, [rdi + 0x10]
mov qword [rdi + 0x10], rdx
mov byte [rdi + 0x18], cl
jmp 0x549fa1
lea rcx, [0x005ae7f0]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x549ef8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x005ae7f0]
call fcn.0053fd10
mov ecx, eax
jmp 0x549f43
mov ecx, 8
mov edx, 0x20
call fcn.00578c70
ud2
Function at 0x549fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x005ae828]
test ecx, ecx
je 0x54a0e6
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x54a002
mov rdi, rax
cmp qword [rax + 8], 0
jne 0x54a0e0
mov ecx, dword [0x005ae828]
test ecx, ecx
je 0x54a108
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x54a125
mov rdi, rax
test rax, rax
jne 0x54a08c
mov qword [rsp + 0x28], 0
lea rax, case.0x522105.301
mov qword [rsp + 0x20], rax
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x54a144
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov ecx, dword [0x005ae828]
test ecx, ecx
je 0x54a131
dec ecx
mov rdx, rdi
call fcn.005ab204
test rsi, rsi
je 0x54a0a6
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x54a0a8
mov rax, qword [rsi + 8]
jmp 0x54a0a8
xor eax, eax
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
test rdx, rdx
je 0x54a0e0
test rcx, rcx
je 0x54a0e0
lock dec qword [rcx]
jne 0x54a0e0
lea rcx, [rsp + 0x28]
call fcn.004fd970
add rdi, 0x10
jmp 0x54a127
lea rcx, case.0x522105.301
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x549ff4
jmp 0x54a002
lea rcx, case.0x522105.301
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x54a021
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, case.0x522105.301
call fcn.0053fd10
mov ecx, eax
jmp 0x54a084
mov ecx, 8
mov edx, 0x18
call fcn.00578c70
ud2

Function at 0x54a170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x005ae848]
test ecx, ecx
je 0x54a19f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x54a1b8
cmp byte [rax + 8], 0
je 0x54a1b8
add rax, 9
jmp 0x54a260
lea rcx, [0x005ae830]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x54a190
mov ecx, dword [0x005ae848]
test ecx, ecx
je 0x54a241
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x54a25e
mov rdi, rax
test rax, rax
jne 0x54a21e
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x54a277
mov rdi, rax
lea rax, [0x005ae830]
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov ecx, dword [0x005ae848]
test ecx, ecx
je 0x54a267
dec ecx
mov rdx, rdi
call fcn.005ab204
xor ecx, ecx
test rsi, rsi
je 0x54a234
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x54a260
lea rcx, [0x005ae830]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x54a1d3
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x005ae830]
call fcn.0053fd10
mov ecx, eax
jmp 0x54a216
mov ecx, 8
mov edx, 0x10
call fcn.00578c70
ud2
Function at 0x54a290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x005ae868]
test ecx, ecx
je 0x54a2bf
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x54a2d8
cmp byte [rax + 8], 0
je 0x54a2d8
add rax, 9
jmp 0x54a380
lea rcx, [0x005ae850]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x54a2b0
mov ecx, dword [0x005ae868]
test ecx, ecx
je 0x54a361
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x54a37e
mov rdi, rax
test rax, rax
jne 0x54a33e
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x54a397
mov rdi, rax
lea rax, [0x005ae850]
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov ecx, dword [0x005ae868]
test ecx, ecx
je 0x54a387
dec ecx
mov rdx, rdi
call fcn.005ab204
xor ecx, ecx
test rsi, rsi
je 0x54a354
cmp byte [rsi], 0
mov byte [rsi], 0
movzx eax, byte [rsi + 1]
cmove eax, ecx
mov ecx, eax
lea rax, [rdi + 9]
mov byte [rdi + 8], 1
mov byte [rdi + 9], cl
jmp 0x54a380
lea rcx, [0x005ae850]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x54a2f3
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x005ae850]
call fcn.0053fd10
mov ecx, eax
jmp 0x54a336
mov ecx, 8
mov edx, 0x10
call fcn.00578c70
ud2

Function at 0x54a550
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x005ae8a8]
test ecx, ecx
je 0x54a666
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x54a582
mov rdi, rax
cmp qword [rax + 8], 0
jne 0x54a660
mov ecx, dword [0x005ae8a8]
test ecx, ecx
je 0x54a688
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x54a6a5
mov rdi, rax
test rax, rax
jne 0x54a60c
mov qword [rsp + 0x28], 0
lea rax, [0x005ae890]
mov qword [rsp + 0x20], rax
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x54a6c4
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov ecx, dword [0x005ae8a8]
test ecx, ecx
je 0x54a6b1
dec ecx
mov rdx, rdi
call fcn.005ab204
test rsi, rsi
je 0x54a626
mov rax, qword [rsi]
mov qword [rsi], 0
test rax, rax
je 0x54a628
mov rax, qword [rsi + 8]
jmp 0x54a628
xor eax, eax
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rax
test rdx, rdx
je 0x54a660
test rcx, rcx
je 0x54a660
lock dec qword [rcx]
jne 0x54a660
lea rcx, [rsp + 0x28]
call fcn.004fdc10
add rdi, 0x10
jmp 0x54a6a7
lea rcx, [0x005ae890]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x54a574
jmp 0x54a582
lea rcx, [0x005ae890]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x54a5a1
xor edi, edi
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x005ae890]
call fcn.0053fd10
mov ecx, eax
jmp 0x54a604
mov ecx, 8
mov edx, 0x18
call fcn.00578c70
ud2
Function at 0x54a6f0
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov ecx, dword [0x005ae8c8]
test ecx, ecx
je 0x54a723
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x54a73c
mov rcx, rax
cmp qword [rax + 8], 0
je 0x54a73c
add rcx, 0x10
jmp 0x54a839
lea rcx, [0x005ae8b0]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jae 0x54a710
mov ecx, dword [0x005ae8c8]
test ecx, ecx
je 0x54a81a
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x54a837
mov rdi, rax
test rax, rax
jne 0x54a7b2
mov rax, qword [0x005f7f18]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 8
call fcn.0044f650
test rax, rax
je 0x54a856
mov rdi, rax
lea rax, [0x005ae8b0]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x005ae8c8]
test ecx, ecx
je 0x54a843
dec ecx
mov rdx, rdi
call fcn.005ab204
test rsi, rsi
je 0x54a7cf
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov qword [rsi], 0
cmp rcx, 1
je 0x54a804
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x54a7ff
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x54a804
call fcn.0053edc0
mov qword [rdi + 8], 1
lea rcx, [rdi + 0x10]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rdx
jmp 0x54a839
lea rcx, [0x005ae8b0]
call fcn.0053fd10
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jne 0x54a75b
xor ecx, ecx
mov rax, rcx
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [0x005ae8b0]
call fcn.0053fd10
mov ecx, eax
jmp 0x54a7aa
mov ecx, 8
mov edx, 0x20
call fcn.00578c70
ud2