joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52da90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531730
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x636fbd]
push 4
push 8
call fcn.00452e20
add esp, 8
test eax, eax
je 0x52db72
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [edi], ebx
mov dword [edi + 4], ecx
push 0
push 0x10000
push edi
push 0x52dbe0
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x52db0d
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x52db5f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x52db44
push dword [ecx + 8]
push eax
push dword [ebp - 0x20]
call fcn.00452e30
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.00452e30
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.005b14d0
add esp, 8
ud2
Function at 0x52dd90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531750
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x52ddce
test eax, eax
jne 0x52df4a
mov ebx, dword [0x637398]
test ebx, ebx
je 0x52df4a
mov dword [ebp - 0x20], 0
jmp 0x52ddf7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x52de28
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x52df9b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x52ddf0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x52ddf0
test byte [ebp - 0x20], 1
je 0x52df4a
mov ebx, dword [0x637398]
test ebx, ebx
je 0x52df4a
mov dword [ebp - 0x20], 0
jmp 0x52de57
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x52de88
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x52df9b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x52de50
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x52de50
test byte [ebp - 0x20], 1
je 0x52df4a
mov ebx, dword [0x637398]
test ebx, ebx
je 0x52df4a
mov dword [ebp - 0x20], 0
jmp 0x52deb7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x52dee8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x52df9b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x52deb0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x52deb0
test byte [ebp - 0x20], 1
je 0x52df4a
mov ebx, dword [0x637398]
test ebx, ebx
je 0x52df4a
mov dword [ebp - 0x20], 0
jmp 0x52df17
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x52df44
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x52df9b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x52df10
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x52df10
test byte [ebp - 0x20], 1
jne 0x52df64
movzx eax, byte [0x624440]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x637398]
jmp 0x52df6f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x52df4a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x52df9b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x52df6c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x52df6c
mov dword [ebp - 0x10], 0
push 0x60d43c
push 0x2b
push str.called__Option::unwrap____on_a__None__value_rustc_8ede3aae28fe6e4d52b38157d7bfe0d3bceef225library_alloc_srccollections_btree_navigate.rs
call fcn.005b1730
add esp, 0xc
ud2
Function at 0x52fa50
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b4
mov eax, dword [esp + 0x1cc]
mov esi, dword [esp + 0x1c8]
mov edi, dword [eax]
mov ebp, dword [eax + 4]
movzx ebx, word [eax + 8]
mov eax, dword [0x637384]
cmp eax, 3
jne 0x52fb3b
cmp ebp, 0x17f
ja 0x52fb4c
mov dword [esp + 4], ebx
lea ebx, [esp + 0x34]
push ebp
push edi
push ebx
call fcn.005885b0
add esp, 0xc
mov byte [esp + ebp + 0x34], 0
inc ebp
lea eax, [esp + 8]
push ebp
push ebx
push eax
call fcn.0053e7f0
add esp, 0xc
cmp dword [esp + 8], 0
je 0x52fad6
mov eax, dword [0x60c108]
mov ecx, dword [0x60c10c]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x52fb5a
mov eax, dword [esp + 0xc]
xorps xmm0, xmm0
mov ecx, esp
mov dword [esp], 0
lea edx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x52fb24
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x52fb5a
mov eax, dword [esp]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov eax, dword [esp + 4]
mov word [esi + 0xc], ax
xor eax, eax
mov dword [esi], eax
jmp 0x52fb5a
call fcn.005b0750
cmp ebp, 0x17f
jbe 0x52fa8b
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.005b0890
add esp, 8
mov eax, esi
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x530650
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x636448]
mov esi, ecx
test eax, eax
je 0x530676
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x53068f
cmp dword [eax + 4], 0
je 0x53068f
add eax, 8
pop esi
pop edi
ret
push 0x636448
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x53066a
mov eax, dword [0x636448]
test eax, eax
je 0x530726
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x530743
mov edi, eax
test eax, eax
jne 0x5306ef
movzx eax, byte [0x636fbd]
push 4
push 0x10
call fcn.00452e20
add esp, 8
test eax, eax
je 0x530757
mov dword [eax], 0x636448
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x636448]
test eax, eax
je 0x530748
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x53070f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x530713
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x530713
xor ecx, ecx
xor edx, edx
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
lea eax, [edi + 8]
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x636448
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x5306ad
xor eax, eax
pop esi
pop edi
ret
push 0x636448
call fcn.005b0a70
add esp, 4
jmp 0x5306e7
push 0x10
push 4
call fcn.005b14d0
add esp, 8
ud2
Function at 0x530770
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531810
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x636458]
test eax, eax
je 0x5307c5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x5307de
cmp dword [eax + 4], 0
mov ebx, eax
je 0x5307de
add ebx, 8
jmp 0x5308a8
push 0x636458
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x5307b5
mov eax, dword [0x636458]
test eax, eax
je 0x530889
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5308a6
mov edi, eax
test eax, eax
jne 0x530842
movzx eax, byte [0x636fbd]
push 4
push 0x10
call fcn.00452e20
add esp, 8
test eax, eax
je 0x5308cd
mov dword [eax], 0x636458
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x636458]
test eax, eax
je 0x5308bb
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x53085c
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x530860
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x530860
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 0xc]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
je 0x5308a8
test ecx, ecx
je 0x5308a8
lock dec dword [ecx]
jne 0x5308a8
call fcn.00449c60
jmp 0x5308a8
push 0x636458
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x5307fc
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x636458
call fcn.005b0a70
add esp, 4
jmp 0x53083a
mov dword [ebp - 0x10], 0
push 0x10
push 4
call fcn.005b14d0
add esp, 8
ud2
Function at 0x530910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x636468]
mov esi, ecx
test eax, eax
je 0x530936
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x53094f
cmp byte [eax + 4], 0
je 0x53094f
add eax, 5
pop esi
pop edi
ret
push 0x636468
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x53092a
mov eax, dword [0x636468]
test eax, eax
je 0x5309c2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5309db
mov edi, eax
test eax, eax
jne 0x5309a0
movzx eax, byte [0x636fbd]
push 4
push 8
call fcn.00452e20
add esp, 8
test eax, eax
je 0x5309ef
mov dword [eax], 0x636468
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x636468]
test eax, eax
je 0x5309e0
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x5309b5
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
mov byte [edi + 4], 1
lea eax, [edi + 5]
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x636468
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x530965
xor eax, eax
pop esi
pop edi
ret
push 0x636468
call fcn.005b0a70
add esp, 4
jmp 0x530998
push 8
push 4
call fcn.005b14d0
add esp, 8
ud2

Function at 0x530a00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x636478]
test eax, eax
je 0x530a22
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x530a3b
cmp byte [eax + 4], 0
je 0x530a3b
add eax, 5
pop esi
ret
push 0x636478
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x530a17
mov eax, dword [0x636478]
test eax, eax
je 0x530ab1
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x530aca
mov esi, eax
test eax, eax
jne 0x530a8c
movzx eax, byte [0x636fbd]
push 4
push 8
call fcn.00452e20
add esp, 8
test eax, eax
je 0x530add
mov dword [eax], 0x636478
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x636478]
test eax, eax
je 0x530ace
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
je 0x530aa5
cmp byte [eax], 0
mov byte [eax], 0
movzx eax, byte [eax + 1]
cmove eax, ecx
mov ecx, eax
mov byte [esi + 4], 1
lea eax, [esi + 5]
mov byte [esi + 5], cl
pop esi
ret
push 0x636478
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x530a51
xor eax, eax
pop esi
ret
push 0x636478
call fcn.005b0a70
add esp, 4
jmp 0x530a84
push 8
push 4
call fcn.005b14d0
add esp, 8
ud2
Function at 0x530af0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531820
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x636488]
test eax, eax
je 0x530b43
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x530b5c
cmp dword [eax + 4], 0
mov edi, eax
je 0x530b5c
add edi, 8
jmp 0x530c1d
push 0x636488
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x530b33
mov eax, dword [0x636488]
test eax, eax
je 0x530bfe
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x530c1b
mov esi, eax
test eax, eax
jne 0x530bbc
movzx eax, byte [0x636fbd]
push 4
push 0xc
call fcn.00452e20
add esp, 8
test eax, eax
je 0x530c42
mov dword [eax], 0x636488
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x636488]
test eax, eax
je 0x530c30
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x530bf7
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
je 0x530bf7
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x530c1d
test ecx, ecx
je 0x530c1d
lock dec dword [ecx]
jne 0x530c1d
call fcn.005133f0
jmp 0x530c1d
call fcn.005b0640
jmp 0x530bd1
push 0x636488
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x530b7a
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x636488
call fcn.005b0a70
add esp, 4
jmp 0x530bb4
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.005b14d0
add esp, 8
ud2
Function at 0x530c80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x531830
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x636498]
test eax, eax
je 0x530cd5
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x530cee
cmp dword [eax + 4], 0
mov ebx, eax
je 0x530cee
add ebx, 8
jmp 0x530daa
push 0x636498
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x530cc5
mov eax, dword [0x636498]
test eax, eax
je 0x530d8b
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x530da8
mov edi, eax
test eax, eax
jne 0x530d4e
movzx eax, byte [0x636fbd]
push 4
push 0xc
call fcn.00452e20
add esp, 8
test eax, eax
je 0x530dcf
mov dword [eax], 0x636498
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x636498]
test eax, eax
je 0x530dbd
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x530d63
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x530d65
mov eax, dword [esi + 4]
jmp 0x530d65
xor eax, eax
mov ecx, dword [edi + 8]
cmp dword [edi + 4], 0
lea ebx, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x530daa
test ecx, ecx
je 0x530daa
lock dec dword [ecx]
jne 0x530daa
call fcn.005134a0
jmp 0x530daa
push 0x636498
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x530d0c
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x636498
call fcn.005b0a70
add esp, 4
jmp 0x530d46
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.005b14d0
add esp, 8
ud2
Function at 0x530e10
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x6364a8]
test eax, eax
je 0x530f0f
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x530e41
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x530f0a
mov eax, dword [0x6364a8]
test eax, eax
je 0x530f31
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x530f4e
mov esi, eax
test eax, eax
jne 0x530eac
movzx eax, byte [0x636fbd]
push 8
push 0x20
call fcn.00452e20
add esp, 8
test eax, eax
je 0x530f6a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x6364a8
mov esi, eax
mov eax, dword [0x6364a8]
test eax, eax
je 0x530f58
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x530ecb
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x530ef9
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x530eeb
movaps xmm0, xmmword [esp]
jmp 0x530ef9
lea ecx, [esp + 0x10]
call fcn.0052cd30
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x530f50
push 0x6364a8
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x530e34
jmp 0x530e41
push 0x6364a8
call fcn.005b0a70
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x530e5f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x6364a8
call fcn.005b0a70
add esp, 4
jmp 0x530ea4
push 0x20
push 8
call fcn.005b14d0
add esp, 8
ud2
Function at 0x543db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x543e08
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x543e00
cmp ebp, ebx
jb 0x543e82
cmp ebp, dword [esp + 0x1c]
ja 0x543e93
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x543e02
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x543df0
jmp 0x543e5f
ja 0x543e08
cmp edx, edi
mov ebx, ebp
jne 0x543dc5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x543e63
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x543e40
mov esi, edi
sub ecx, ebx
jns 0x543e57
jmp 0x543e65
cmp edi, edx
je 0x543e6c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x543e65
xor al, 1
cmp esi, edx
jne 0x543e20
jmp 0x543e65
xor eax, eax
jmp 0x543e65
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x610cb4
push 0x2b
push 0x60fddd
call fcn.005b1730
add esp, 0xc
ud2
push 0x610ca4
push ebp
push ebx
call fcn.005b1b90
add esp, 0xc
ud2
push 0x610ca4
push dword [esp + 0x20]
push ebp
call fcn.005b1b20
add esp, 0xc
ud2
Function at 0x550e10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x550e9c
push esi
call fcn.005626f0
add esp, 4
test al, al
jne 0x550e9c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x550e33
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0056cb50
add esp, 0xc
test eax, eax
je 0x550e67
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0056cb50
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x550e69
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x550e95
mov al, byte [esi]
push eax
call fcn.0056b8f0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x550e77
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5562e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, 0x180
mov eax, dword [ecx]
cmp eax, 0x6360dc
mov edx, dword [ecx + 8]
push esi
mov esi, 0x140
mov dword [esp + 0x10], edx
cmovne ebx, esi
mov byte [esp + 0xf], 1
add ebx, dword [ecx + 0xc]
mov esi, 0x3bc
cmp eax, 0x6360dc
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x28]
mov ecx, 0x424
cmovne ecx, esi
mov dword [eax], 0
add ecx, ebp
je 0x55647d
cmp byte [ecx + 0x3c], 0
je 0x55647d
cmp dword [ebp + 0x888], 0
je 0x55647d
mov eax, dword [ebp + 0x78]
test eax, eax
je 0x556362
test byte [eax + 4], 0x10
je 0x556362
add eax, 0x78
jmp 0x556368
lea eax, [ebp + 0x88c]
push edi
xor edi, edi
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x494], edi
jbe 0x556446
xor ebx, ebx
nop dword [eax]
mov esi, dword [ebp + 0x888]
add esi, ebx
cmp dword [esi + 0xc], 0
je 0x556436
push dword [esi]
push dword [edx + 8]
call fcn.0056ba30
add esp, 8
test eax, eax
je 0x556432
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 4]
cmp byte [ecx + 0x1c9], 0
jne 0x5563c0
test eax, eax
je 0x5563d4
jmp 0x556432
test eax, eax
je 0x556432
push eax
push dword [ecx + 0x64]
call fcn.0056ba30
add esp, 8
test eax, eax
je 0x556432
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x1c]
cmp byte [ecx + 0x1ca], 0
jne 0x5563ee
cmp eax, 0xffffffff
je 0x5563fb
jmp 0x556432
cmp eax, 0xffffffff
je 0x556432
cmp dword [ecx + 0x31c], eax
jne 0x556432
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x30]
cmp eax, dword [esi + 0x18]
jne 0x556436
mov eax, dword [ecx + 0x1dc]
push dword [esi + 8]
push dword [eax]
call fcn.0056ba30
add esp, 8
test eax, eax
je 0x556432
lea eax, [esi + 0x20]
push eax
push dword [esp + 0x20]
call fcn.00555e90
add esp, 8
test al, al
jne 0x556452
mov edx, dword [esp + 0x14]
inc edi
add ebx, 0x60
cmp edi, dword [ebp + 0x494]
jb 0x556380
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x556473
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret