joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59e52e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x72db00
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test byte [esi + 0x1f], 2
jne 0x59e743
mov eax, dword [esi + 0x14]
cmp eax, ebx
push edi
mov edi, 0x72db3c
je 0x59e584
push eax
mov ecx, edi
call fcn.005a059e
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x59e685
lea eax, [ebp - 0x23c]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x43b9dc
push ebx
call fcn.0059c61f
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x59e685
mov eax, dword [ebp - 0x238]
push 4
xor ecx, ecx
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or eax, ecx
push eax
mov ecx, edi
call fcn.005a0574
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x59e695
cmp dword [ebp - 0x238], ebx
mov dword [ebp - 0x21c], ebx
jbe 0x59e659
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x23c]
push dword [eax + ecx*4]
call fcn.0059debd
cmp eax, ebx
mov dword [ebp - 0x218], eax
jl 0x59e63e
movzx eax, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0x224]
mov dword [ecx + eax*4], edx
inc byte [esi + 0x1d]
jmp 0x59e645
cmp eax, 0x8007000e
je 0x59e670
inc dword [ebp - 0x21c]
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x238]
jb 0x59e604
cmp byte [esi + 0x1d], bl
jne 0x59e72f
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
jmp 0x59e72f
push dword [esi + 0x14]
mov ecx, edi
call fcn.005a059e
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
jmp 0x59e742
push 4
mov ecx, edi
call fcn.005a0574
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x59e6a4
mov dword [ebp - 0x218], 0x8007000e
jmp 0x59e742
mov byte [esi + 0x1d], 1
mov dword [eax], ebx
call fcn.005a079c
test al, al
je 0x59e6d4
cmp dword [esi + 8], 0x1000
jne 0x59e6d4
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 4]
call fcn.005a073e
jmp 0x59e6eb
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebx
je 0x59e72f
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.0059ca52
test eax, eax
je 0x59e723
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.0059f91b
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x59e742
cmp dword [esi + 8], 0xc00
je 0x59e73c
or byte [esi + 0x1f], 2
mov dword [ebp - 0x218], ebx
pop edi
push 0x72db00
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], ebx
pop esi
pop ebx
je 0x59e764
lea eax, [ebp - 0x23c]
push eax
call fcn.0059c68c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.0066d880
leave
ret 4
Function at 0x5a079c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x72db4b], 0
jne 0x5a07f6
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5a07ef
cmp dword [ebp - 0x110], 2
jne 0x5a07ef
cmp dword [ebp - 0x11c], 6
jb 0x5a07ef
call fcn.005a0651
mov byte [0x72db4a], al
mov byte [0x72db4b], 1
mov ecx, dword [ebp - 4]
mov al, byte [0x72db4a]
xor ecx, ebp
call fcn.0066d880
leave
ret

Function at 0x5a2a69
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push 1
push 0
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push 0
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push dword [esi + 0x114]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
cmp esi, 0x20
ja 0x5a2ae5
mov ecx, dword [ebp + 0xc]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp + 8]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x43c4bc
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.005287fb
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
pop esi
leave
ret 8
Function at 0x5a2e77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x14]
mov esi, ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
je 0x5a2f25
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push dword [ebp + 0x10]
push dword [esi + 0x114]
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, ebx
mov dword [ebp - 0x128], eax
jge 0x5a2f25
mov ecx, edi
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x43c5b0
push dword [ebp - 0x128]
lea eax, [ebp - 0x360]
push eax
call fcn.00520ba2
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x6c2560
lea eax, [ebp - 0x254]
lea edi, [ebp - 0x254]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0066dd58
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x148]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x114]
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x148], eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x138], 0x271
mov dword [ebp - 0x144], eax
call fcn.00576275
test al, al
jne 0x5a2f8f
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x134], 0x5a2d59
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
cmp esi, ebx
jne 0x5a2fb6
push 2
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0066d880
leave
ret 0x10
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x50b3f4
push esi
call dword [sym.imp.SHELL32.dll_SHBindToParent]
test eax, eax
jl 0x5a3043
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
lea edx, [ebp - 0x10c]
push edx
push 0x8000
push dword [ebp - 0x120]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x110]
push 0x104
call fcn.005765be
mov ecx, dword [ebp - 0x110]
call fcn.0057605c
mov ecx, dword [ebp - 0x110]
push eax
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
inc eax
jmp 0x5a2fa5
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x118]
call sym.osetup.dll_public:_struct_FlexUI::IDataSource____thiscall_FlexUI::FlexValue::GetDataSource_void_const
push eax
push 0x43c580
call fcn.005a2c0e
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.005287fb
jmp 0x5a2f04
Function at 0x5a3cca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x43cab0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5a3d20
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x42c4c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5a3d13
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x5a3d22
xor eax, eax
pop esi
leave
ret 4

Function at 0x5a5167
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea ebx, [esi + 4]
push ebx
push 0x413c94
call edi
test eax, eax
jne 0x5a5277
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [esi + 0x20c]
push ebx
call edi
mov esi, eax
add esi, 3
cmp dword [ebp + 0xc], 0
je 0x5a51b3
push dword [ebp + 0xc]
call edi
lea esi, [esi + eax + 1]
push esi
lea eax, [ebp - 4]
push eax
call fcn.005a52b2
mov edi, eax
test edi, edi
jl 0x5a529b
push ebx
push 0x43cc64
push esi
push dword [ebp - 4]
call fcn.0056ab76
mov edi, eax
add esp, 0x10
test edi, edi
jl 0x5a529b
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x5a5218
push 0x405924
push esi
push dword [ebp - 4]
call fcn.005a50cc
mov edi, eax
cmp edi, ebx
jl 0x5a529b
push dword [ebp + 0xc]
push esi
push dword [ebp - 4]
call fcn.005a50cc
mov edi, eax
test edi, edi
jl 0x5a529b
push 0x44
pop esi
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.0066e181
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x5a525d
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor edi, edi
jmp 0x5a529b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
jle 0x5a529b
and edi, 0xffff
or edi, 0x80070000
jmp 0x5a529b
push ebx
push 0x43cc5c
call edi
test eax, eax
jne 0x5a5296
push dword [ebp + 0xc]
add esi, 0x20c
push esi
call fcn.005a5595
mov edi, eax
jmp 0x5a529b
mov edi, 0x81000004
cmp dword [ebp - 4], 0
je 0x5a52a9
push dword [ebp - 4]
call fcn.006a56fd
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x5a5400
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x5a544c
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x5a5445
jbe 0x5a546e
cmp eax, 3
jbe 0x5a5435
cmp eax, 4
je 0x5a5445
jbe 0x5a546e
cmp eax, 6
ja 0x5a5440
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5a5409
cmp eax, 7
jne 0x5a546e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x5a546e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x5a545e
call esi
mov esi, eax
jmp 0x5a546e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
leave
ret 8

Function at 0x5a5624
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x72acfc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x214]
push eax
push 1
xor ebx, ebx
push ebx
push 0x43ccc0
push reloc.OLEAUT32.dll_SysReAllocString
mov word [ebp - 0x210], bx
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5a5669
xor eax, eax
jmp 0x5a56e4
cmp byte [ebp + 8], bl
je 0x5a5673
xor eax, eax
inc eax
jmp 0x5a56e4
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push 0x43cc88
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x208
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
pop esi
jne 0x5a5665
cmp dword [ebp - 0x218], 1
je 0x5a56d4
push ebx
push 0x37733964
call fcn.00652d6d
jmp 0x5a5665
lea eax, [ebp - 0x210]
push eax
mov word [ebp - 8], bx
call fcn.00652c51
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0066d880
leave
ret 4
Function at 0x5adec9
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x717aec]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x5adeda
ret
mov eax, dword [eax + 0xc]
ret

Function at 0x5adfc4
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x72dbfc], 0
jbe 0x5adfd6
inc dword [0x72dbfc]
xor eax, eax
ret
call fcn.005f8a4f
call fcn.005f8825
test eax, eax
jne 0x5adfea
mov eax, 0x80004005
ret
push esi
mov dword [0x717d24], 2
mov dword [0x717d28], 0x8d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x717aec], eax
jne 0x5ae016
mov esi, 0x80040001
jmp 0x5ae05b
call fcn.005f7bf6
call fcn.005f1973
mov esi, eax
test esi, esi
jl 0x5ae05b
call fcn.005bddf0
mov esi, eax
test esi, esi
jl 0x5ae05b
call fcn.005f1b2f
mov esi, eax
test esi, esi
jl 0x5ae05b
call fcn.0063ad57
mov esi, eax
test esi, esi
jl 0x5ae05b
push 0x72dc00
push 0x40
push 0x18
call fcn.005f1a11
mov esi, eax
test esi, esi
jge 0x5ae081
call fcn.005f1845
call fcn.005be51a
mov eax, dword [0x717aec]
cmp eax, 0xffffffff
je 0x5ae07d
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
or dword [0x717aec], 0xffffffff
mov eax, esi
pop esi
ret
mov dword [0x72dbfc], 1
xor eax, eax
pop esi
ret

Function at 0x5ae390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x72dc10], esi
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
jne 0x5ae3bb
mov esi, 0x80004005
lea ecx, [ebp - 8]
call fcn.005ae08f
pop edi
mov eax, esi
pop esi
leave
ret
push dword [0x717aec]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
cmp edi, esi
jne 0x5ae3d4
mov esi, 0x8000ffff
jmp 0x5ae3ad
lea ecx, [ebp - 8]
call fcn.005ae301
cmp dword [edi + 0x20], esi
jne 0x5ae3ad
call fcn.005b2e2c
test eax, eax
je 0x5ae42c
push ebx
mov dword [ebp - 4], esi
call fcn.005b2e2c
mov ecx, dword [ebp - 4]
cmp ecx, esi
mov ebx, eax
mov dword [ebp - 4], esi
je 0x5ae404
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
mov eax, dword [ebx]
lea ecx, [ebp - 4]
push ecx
push esi
mov ecx, ebx
call dword [eax]
cmp dword [edi + 0x20], esi
pop ebx
jne 0x5ae41d
push dword [ebp - 4]
call fcn.005b32c2
mov ecx, dword [ebp - 4]
cmp ecx, esi
mov dword [ebp - 4], esi
je 0x5ae42c
call sym.osetup.dll_public:_void___thiscall_NetUI::BaseValue::Release_void_
cmp dword [edi + 0x20], esi
jne 0x5ae439
call fcn.005ae325
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
jmp 0x5ae3ad
Function at 0x5ae5ed
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [0x72dc10], ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jne 0x5ae61a
mov ebx, 0x80004005
lea ecx, [ebp - 4]
call fcn.005ae08f
mov eax, ebx
jmp 0x5ae75c
lea ecx, [ebp - 4]
call fcn.005ae301
mov eax, dword [0x717aec]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x5ae639
push eax
call esi
cmp eax, ebx
jne 0x5ae64f
call fcn.005adfc4
mov edi, eax
cmp edi, ebx
jl 0x5ae732
mov dword [ebp - 8], 1
push dword [0x717aec]
call esi
cmp eax, ebx
je 0x5ae660
inc dword [eax + 4]
jmp 0x5ae60b
push 0x34
call fcn.005ac602
mov esi, eax
cmp esi, ebx
jne 0x5ae674
mov edi, 0x8007000e
jmp 0x5ae6ec
push esi
push dword [0x717aec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 8]
push eax
call fcn.005ba22c
mov edi, eax
cmp edi, ebx
jl 0x5ae6ec
lea eax, [esi + 0xc]
push eax
push 8
call fcn.005fc5e3
mov edi, eax
cmp edi, ebx
jl 0x5ae6ec
mov dword [esi + 4], 1
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
lea eax, [ebp - 0x1c]
inc edi
push eax
mov dword [ebp - 0x1c], 0x14
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call fcn.005fa7c0
cmp eax, ebx
mov dword [esi], eax
jne 0x5ae73e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebx
je 0x5ae728
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x5ae6fc
call fcn.005fc30d
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x5ae709
push eax
call fcn.005ae4a8
mov eax, dword [esi]
cmp eax, ebx
je 0x5ae715
push eax
call fcn.005f956c
push esi
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
push ebx
push dword [0x717aec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebp - 8], ebx
je 0x5ae732
call fcn.005ae541
lea ecx, [ebp - 4]
call fcn.005ae08f
mov eax, edi
jmp 0x5ae75c
cmp dword [0x72dbfc], edi
jne 0x5ae752
mov eax, dword [0x72dc14]
cmp eax, ebx
je 0x5ae752
push ebx
call eax
lea ecx, [ebp - 4]
call fcn.005ae08f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5ae761
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x72dc10], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
jne 0x5ae783
call fcn.005ae08f
mov eax, 0x80004005
pop ebx
leave
ret
push esi
call fcn.005ae301
mov eax, dword [0x717aec]
cmp eax, 0xffffffff
jne 0x5ae7a5
mov ebx, 0x80004005
lea ecx, [ebp - 4]
call fcn.005ae08f
mov eax, ebx
pop esi
jmp 0x5ae780
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
jne 0x5ae7b9
mov ebx, 0x8004000a
jmp 0x5ae798
dec dword [esi + 4]
cmp dword [esi + 4], ebx
jg 0x5ae798
push ebx
lea ecx, [esi + 0x20]
call fcn.005ae441
push ebx
lea ecx, [esi + 0x24]
call fcn.005ae441
push ebx
lea ecx, [esi + 0x28]
call fcn.005ae441
push ebx
lea ecx, [esi + 0x2c]
call fcn.005ae441
push ebx
lea ecx, [esi + 0x30]
call fcn.005b6274
cmp dword [0x72dbfc], 1
jne 0x5ae804
mov eax, dword [0x72dc14]
cmp eax, ebx
je 0x5ae804
push 1
call eax
push dword [esi]
call fcn.005f956c
cmp byte [esi + 0x10], bl
je 0x5ae816
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [esi + 0x11], bl
je 0x5ae821
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esi + 0xc]
call fcn.005fc30d
push dword [esi + 8]
call fcn.005ae4a8
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x5ae83e
push eax
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
push esi
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
push ebx
push dword [0x717aec]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.005ae541
jmp 0x5ae798

Function at 0x5b470b
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
call fcn.0064a4a6
movzx ebx, ax
test bx, bx
jne 0x5b472b
xor al, al
jmp 0x5b47a1
push edi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_VkKeyScanExW]
call esi
movzx edi, ax
cmp di, 0xffff
movzx eax, di
mov dword [ebp + 8], eax
je 0x5b474d
and edi, 0xff
movzx eax, bx
imul eax, eax, 0x10001
push eax
push dword [ebp + 0xc]
call esi
movzx ebx, ax
cmp bx, 0xffff
je 0x5b479e
mov al, bl
and ax, 0xff
cmp ax, di
jne 0x5b479e
cmp word [ebp + 0xc], 0x7f
ja 0x5b479a
push dword [ebp + 0xc]
call fcn.00662713
push dword [ebp + 0xc]
mov si, ax
call fcn.00662700
cmp si, ax
jne 0x5b479a
xor eax, eax
cmp word [ebp + 8], bx
sete al
jmp 0x5b47a0
mov al, 1
jmp 0x5b47a0
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x5bb034
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
xor esi, esi
cmp dword [ebp + 8], eax
push edi
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
mov edi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 3
mov byte [ebp - 2], bl
je 0x5bb090
cmp eax, ebx
je 0x5bb090
test byte [eax + 0x7d], 0x80
jne 0x5bb076
mov dword [ebp - 0x14], ebx
jmp 0x5bb080
mov eax, ecx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x5bb074
mov dword [ebp - 0x14], eax
call fcn.005cac15
push eax
mov ecx, edi
call fcn.005bcb0e
mov byte [ebp - 2], al
cmp dword [ebp + 8], ebx
je 0x5bb146
cmp byte [ebp - 1], bl
je 0x5bb0df
push dword [0x717aec]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax + 8]
push 1
push ebx
push edi
lea ecx, [esi + 0x64]
call fcn.005b889e
push 1
push ebx
push edi
lea ecx, [esi + 0x58]
call fcn.005b889e
mov eax, dword [ebp + 8]
test byte [eax + 0x7d], 0x80
jne 0x5bb0d5
mov dword [ebp - 8], ebx
jmp 0x5bb0df
mov eax, ecx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x5bb0d3
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x3c]
cmp esi, ebx
je 0x5bb146
cmp dword [edi + 0xc], ebx
je 0x5bb146
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x5bb0fa
cmp dword [eax + 0xc], ebx
jne 0x5bb0fc
xor eax, eax
cmp eax, ebx
je 0x5bb13f
test byte [eax + 0x32], 2
jne 0x5bb118
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x5bb112
cmp dword [eax + 0xc], ebx
jne 0x5bb114
xor eax, eax
cmp eax, ebx
jne 0x5bb100
cmp eax, ebx
je 0x5bb13f
mov eax, dword [eax + 0x3c]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x5bb146
push ebx
push eax
call fcn.005fba33
cmp eax, esi
je 0x5bb136
mov dword [ebp - 0xc], ebx
jmp 0x5bb146
mov dword [ebp - 0x10], 1
jmp 0x5bb146
mov dword [ebp - 0x10], 4
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push esi
push dword [edi + 0x3c]
call fcn.005fb8d9
cmp byte [ebp - 2], bl
je 0x5bb16b
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x5bb16b
push 1
push 0xb
push ebx
call fcn.005c4b76
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
je 0x5bb197
cmp eax, ebx
je 0x5bb183
mov edx, dword [edi]
push ebx
push eax
mov ecx, edi
call dword [edx + 0xc4]
cmp dword [ebp - 8], ebx
je 0x5bb197
mov eax, dword [edi]
push 1
push dword [ebp - 8]
mov ecx, edi
call dword [eax + 0xc4]
mov edi, dword [ebp + 8]
cmp edi, ebx
mov esi, 0x1000
je 0x5bb1ca
test byte [edi + 0x7d], 0x80
je 0x5bb1ca
mov ecx, edi
call fcn.005a9fed
test al, al
je 0x5bb1b8
mov eax, edi
jmp 0x5bb1be
push edi
call fcn.0060c5ea
cmp eax, ebx
je 0x5bb1ca
push esi
mov ecx, eax
call fcn.005bcb66
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x5bb1fd
cmp byte [ebp - 1], bl
je 0x5bb1fd
test byte [edi + 0x7d], 0x80
je 0x5bb1fd
mov ecx, edi
call fcn.005a9fed
test al, al
je 0x5bb1eb
mov eax, edi
jmp 0x5bb1f1
push edi
call fcn.0060c5ea
cmp eax, ebx
je 0x5bb1fd
push esi
mov ecx, eax
call fcn.005bcb66
pop edi
pop esi
pop ebx
leave
ret 8