joyce8/EMBER2024-capa huggingface dataset:
Function at 0x547e10
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0xc]
mov ebp, dword [edi + 0x114]
mov eax, dword [edi + 0xc]
mov dword [esp + 0xc], eax
cmp ebp, 0xffffffff
je 0x548024
cmp dword [esp + 0x1c], 0
je 0x548024
cmp dword [esp + 0x18], 0
push ebx
push esi
mov esi, dword [esp + 0x1c]
je 0x547e6c
test esi, esi
je 0x547e61
lea ecx, [esi + 1]
push ecx
call fcn.00548ff0
mov eax, dword [edi + eax*4 + 0x40]
mov edx, dword [edi + 0x3c]
add edx, eax
add esp, 4
add edx, esi
jmp 0x547e9f
mov edx, dword [edi + 0x3c]
xor eax, eax
add edx, eax
add edx, esi
jmp 0x547e9f
mov ecx, esi
shr ecx, 0xb
mov ebx, 1
shl ebx, cl
lea edx, [ebx - 1]
test edx, edx
je 0x547e8e
push ebx
call fcn.00548ff0
mov eax, dword [edi + eax*4 + 0x40]
add esp, 4
jmp 0x547e90
xor eax, eax
and esi, 0x7ff
add esi, dword [edi + 0x3c]
add esi, ebx
lea edx, [esi + eax - 1]
mov ecx, dword [edi + 0x10]
shl edx, cl
push 0
push edx
push ebp
call fcn.00547b80
add esp, 0xc
cmp eax, 0xffffffff
je 0x547f10
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push ebx
push esi
push ebp
call fcn.00416712
add esp, 0xc
cmp eax, 0xffffffff
je 0x547f10
test eax, eax
jne 0x547f01
mov word [esi], ax
mov ebp, dword [esp + 0x28]
test ebp, ebp
jne 0x547f18
cmp word [esi], bp
jne 0x547f18
xor ecx, ecx
mov word [esi], cx
mov dx, word [edi + 0xc]
sub dx, 6
mov word [esi + 2], dx
mov ax, word [edi + 0xc]
mov word [esi + 4], ax
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
cmp eax, ebx
je 0x547ed4
call fcn.0040c58d
mov dword [eax], 0x16
pop esi
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
ret
cmp dword [edi + 8], 0x4d2
je 0x547f5b
test ebp, ebp
je 0x547fd3
mov edi, dword [edi + 0xc]
sar edi, 2
test edi, edi
jle 0x547f5b
lea eax, [esi + 2]
mov ecx, dword [eax - 2]
mov edx, ecx
shr edx, 0x18
mov byte [eax - 2], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 4
sub edi, 1
jne 0x547f36
test ebp, ebp
jne 0x547efa
movzx eax, word [esi]
test ax, ax
je 0x547efa
mov ecx, dword [esp + 0x14]
movzx ebx, ax
movzx eax, ax
mov edx, ecx
shr edx, 1
cmp eax, edx
ja 0x54801a
movzx eax, word [esi + eax*2 + 2]
cmp eax, ecx
ja 0x54801a
movzx edi, cx
mov ecx, 1
mov edx, ecx
cmp dx, bx
ja 0x547efa
lea ecx, [ecx]
movzx eax, cx
lea edx, [esi + eax*2]
movzx eax, word [edx + 2]
cmp ax, 4
jb 0x547efa
movzx edx, word [edx]
cmp dx, di
ja 0x54801a
cmp ax, dx
ja 0x54801a
add ecx, 2
movzx edi, ax
cmp cx, bx
jbe 0x547fa0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
mov ecx, eax
shr ecx, 8
mov byte [esi], cl
mov byte [esi + 1], al
movzx ecx, word [esi]
add ecx, 2
shr ebx, 1
cmp ecx, ebx
ja 0x54801a
mov eax, 1
cmp ecx, eax
jl 0x547f5f
lea esp, [esp]
movzx edx, word [esi + eax*2]
mov ebx, edx
shr ebx, 8
mov byte [esi + eax*2], bl
mov byte [esi + eax*2 + 1], dl
inc eax
cmp eax, ecx
jle 0x548000
jmp 0x547f5f
pop esi
pop ebx
pop edi
mov eax, 0xfffffc19
pop ebp
ret
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax], cx
mov dx, word [edi + 0xc]
sub dx, 6
mov word [eax + 2], dx
mov cx, word [edi + 0xc]
pop edi
mov word [eax + 4], cx
xor eax, eax
pop ebp
ret
Function at 0x549920
Capabilities:
Resolve dns

Disassembly:
push esi
or esi, 0xffffffff
cmp dword [0x5a2d88], 0
jne 0x549932
call fcn.005493a0
mov eax, dword [esp + 8]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x549958
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xffffe8ab
call fcn.0054b4e0
add esp, 8
mov eax, esi
pop esi
ret
mov ecx, dword [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.00549650
mov esi, eax
add esp, 0x14
test esi, esi
je 0x549989
push 0
push 0xffffe8aa
call fcn.0054b4e0
mov eax, esi
add esp, 8
pop esi
ret

Function at 0x54b200
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x5a2d88], 0
jne 0x54b20e
call fcn.005493a0
jmp fcn.0054ee50

Function at 0x54b220
Capabilities:
Get thread local storage value

Disassembly:
push esi
xor esi, esi
push edi
cmp dword [0x5a2d88], esi
jne 0x54b231
call fcn.005493a0
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x54b261
cmp dword [0x5a2d88], esi
jne 0x54b246
call fcn.005493a0
call fcn.0054ee50
mov eax, dword [0x5a74c4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
call fcn.0054ee40
pop edi
mov eax, esi
pop esi
ret
push ebx
push ebp
call fcn.0054b2e0
mov ecx, dword [0x5a74e4]
push ecx
mov ebp, eax
call fcn.0054b180
mov edx, dword [0x5a74e4]
push edx
mov ebx, eax
call fcn.0054af30
add esp, 8
call fcn.0054b2e0
sub eax, ebp
cmp eax, edi
ja 0x54b2a6
mov ecx, edi
sub ecx, eax
push ecx
push ebx
call fcn.0054b0f0
mov esi, eax
add esp, 8
test esi, esi
je 0x54b287
mov edx, dword [0x5a74e4]
push edx
call fcn.0054af50
push ebx
call fcn.0054b1d0
add esp, 8
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x54d6a0
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0054eb20
mov edi, eax
call fcn.00552990
call fcn.0054af80
push eax
mov dword [0x5a74c8], eax
call fcn.0054b180
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 4
push 0xfffffffffffffff6
mov dword [0x5a74cc], eax
call ebx
mov ebp, eax
call fcn.00552830
mov esi, eax
test esi, esi
je 0x54d6f2
mov eax, dword [esi + 4]
mov dword [esi], edi
mov dword [eax], 0xaaaaaaaa
mov ecx, dword [esi + 4]
mov dword [ecx + 0x18], ebp
jmp 0x54d701
push 0
push 0xffffe890
call fcn.0054b4e0
add esp, 8
push 0xfffffffffffffff5
mov dword [0x5a74fc], esi
call ebx
mov ebp, eax
call fcn.00552830
mov esi, eax
test esi, esi
je 0x54d72b
mov edx, dword [esi + 4]
mov dword [esi], edi
mov dword [edx], 0xaaaaaaaa
mov eax, dword [esi + 4]
mov dword [eax + 0x18], ebp
jmp 0x54d73a
push 0
push 0xffffe890
call fcn.0054b4e0
add esp, 8
push 0xfffffffffffffff4
mov dword [0x5a74f0], esi
call ebx
mov ebx, eax
call fcn.00552830
mov esi, eax
test esi, esi
je 0x54d764
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov dword [ecx], 0xaaaaaaaa
mov edx, dword [esi + 4]
mov dword [edx + 0x18], ebx
jmp 0x54d773
push 0
push 0xffffe890
call fcn.0054b4e0
add esp, 8
mov eax, dword [0x5a74fc]
push 1
push eax
mov dword [0x5a74e0], esi
call fcn.0054f3f0
mov ecx, dword [0x5a74f0]
push 1
push ecx
call fcn.0054f3f0
mov edx, dword [0x5a74e0]
push 1
push edx
call fcn.0054f3f0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
jmp 0x54ee70
sub esp, 0x194
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
call fcn.00552f70
call fcn.00551c90
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00409b58
add esp, 0x194
ret

Function at 0x54d9d0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
cmp dword [0x5a2dfc], 0
je 0x54da58
cmp dword [0x5a2e00], 0
je 0x54da58
mov eax, dword [0x5a2df0]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5a2df4]
mov ecx, dword [0x5a2dfc]
cmp eax, ecx
jbe 0x54da48
mov edx, dword [0x5a2e00]
cmp edx, 0xfffffffe
jne 0x54da23
push ebx
mov bl, byte [eax]
push ecx
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [0x5a2df4]
mov byte [ecx], bl
pop ebx
jmp 0x54da3e
push edx
sub eax, ecx
push eax
push 1
push ecx
call fcn.0040b251
mov edx, dword [0x5a2e00]
push edx
call fcn.004115be
add esp, 0x14
mov eax, dword [0x5a2dfc]
mov dword [0x5a2df4], eax
mov ecx, dword [0x5a2df0]
add ecx, 0x1c
push ecx
call fcn.00551810
pop ecx
ret
Function at 0x54de60
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x58
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
call fcn.0054af80
push str.NSPR_LOG_MODULES
mov dword [0x5a2df0], eax
call fcn.00549c70
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x54e090
cmp byte [ebx], 0
je 0x54e090
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x54dea5
sub eax, edx
xor ebp, ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x4000
test eax, eax
jle 0x54e014
jmp 0x54deca
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
mov edx, eax
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [ebx + ebp]
push str._63_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789____n:_d_n
mov esi, 1
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 0
call fcn.0040a67f
add ebp, dword [esp + 0x28]
add esp, 0x18
test eax, eax
je 0x54e014
lea edx, [esp + 0x24]
push str.sync
push edx
call fcn.00419585
add esp, 8
test eax, eax
jne 0x54df29
mov dword [esp + 0x18], esi
jmp 0x54dfe7
lea eax, [esp + 0x24]
push str.bufsize
push eax
call fcn.00419585
add esp, 8
test eax, eax
jne 0x54df57
mov eax, dword [esp + 0x14]
cmp eax, 0x200
jl 0x54dfe7
mov dword [esp + 0x1c], eax
jmp 0x54dfe7
lea ecx, [esp + 0x24]
push str.timestamp
push ecx
call fcn.00419585
add esp, 8
test eax, eax
jne 0x54df75
mov dword [0x5a2e04], esi
jmp 0x54dfe7
lea edx, [esp + 0x24]
push str.append
push edx
call fcn.00419585
add esp, 8
test eax, eax
jne 0x54df93
mov dword [0x5a2e08], esi
jmp 0x54dfe7
mov edi, dword [0x5a2df8]
lea eax, [esp + 0x24]
push 0x565794
push eax
call fcn.00419585
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
inc esi
test edi, edi
je 0x54dfe7
test esi, esi
je 0x54dfc3
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], ecx
jmp 0x54dfd7
mov edx, dword [edi]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00419585
add esp, 8
test eax, eax
je 0x54dfe0
mov edi, dword [edi + 8]
test edi, edi
jne 0x54dfb6
jmp 0x54dfe7
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], ecx
lea edx, [esp + 0x10]
push edx
lea eax, [ebx + ebp]
push str.____n
push eax
call fcn.0040a67f
add ebp, dword [esp + 0x1c]
add esp, 0xc
cmp eax, 0xffffffff
je 0x54e010
cmp ebp, dword [esp + 0x20]
jl 0x54dec6
mov edi, dword [esp + 0x18]
neg edi
sbb edi, edi
not edi
and edi, dword [esp + 0x1c]
push edi
call fcn.0054da60
push str.NSPR_LOG_FILE
call fcn.00549c70
mov esi, eax
add esp, 8
test esi, esi
je 0x54e080
cmp byte [esi], 0
je 0x54e080
push esi
call fcn.0054d910
add esp, 4
test eax, eax
jne 0x54e08d
push esi
push str.Unable_to_create_nspr_log_file__s_n
call fcn.0054ae80
mov esi, eax
add esp, 8
test esi, esi
je 0x54e08d
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.0054acd0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00409b58
add esp, 0x58
ret
call fcn.0040d9bf
add eax, 0x40
mov dword [0x5a2e00], eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x58]
pop ebx
xor ecx, esp
call fcn.00409b58
add esp, 0x58
ret
Function at 0x54ed60
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
add esp, 0x24
ret
jmp 0x549550

Function at 0x54ee50
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x5a74c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x54ee6d
push eax
push eax
push 1
push eax
call fcn.0054f7c0
add esp, 0x10
ret

Function at 0x54ee70
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0054eb20
mov edi, eax
call fcn.00552990
call fcn.0054af80
push eax
mov dword [0x5a74c8], eax
call fcn.0054b180
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 4
push 0xfffffffffffffff6
mov dword [0x5a74cc], eax
call ebx
mov ebp, eax
call fcn.00552830
mov esi, eax
test esi, esi
je 0x54d6f2
mov eax, dword [esi + 4]
mov dword [esi], edi
mov dword [eax], 0xaaaaaaaa
mov ecx, dword [esi + 4]
mov dword [ecx + 0x18], ebp
jmp 0x54d701
push 0
push 0xffffe890
call fcn.0054b4e0
add esp, 8
push 0xfffffffffffffff5
mov dword [0x5a74fc], esi
call ebx
mov ebp, eax
call fcn.00552830
mov esi, eax
test esi, esi
je 0x54d72b
mov edx, dword [esi + 4]
mov dword [esi], edi
mov dword [edx], 0xaaaaaaaa
mov eax, dword [esi + 4]
mov dword [eax + 0x18], ebp
jmp 0x54d73a
push 0
push 0xffffe890
call fcn.0054b4e0
add esp, 8
push 0xfffffffffffffff4
mov dword [0x5a74f0], esi
call ebx
mov ebx, eax
call fcn.00552830
mov esi, eax
test esi, esi
je 0x54d764
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov dword [ecx], 0xaaaaaaaa
mov edx, dword [esi + 4]
mov dword [edx + 0x18], ebx
jmp 0x54d773
push 0
push 0xffffe890
call fcn.0054b4e0
add esp, 8
mov eax, dword [0x5a74fc]
push 1
push eax
mov dword [0x5a74e0], esi
call fcn.0054f3f0
mov ecx, dword [0x5a74f0]
push 1
push ecx
call fcn.0054f3f0
mov edx, dword [0x5a74e0]
push 1
push edx
call fcn.0054f3f0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
jmp 0x54ee70
sub esp, 0x194
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
call fcn.00552f70
call fcn.00551c90
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.00409b58
add esp, 0x194
ret

Function at 0x54f060
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x54f0a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x54f094
xor eax, eax
ret
push eax
call fcn.00550aa0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret
Function at 0x54f0b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [esp + 0xc]
push 0
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x54f0e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00550aa0
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x54f260
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x54f272
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00550aa0
add esp, 4
or eax, 0xffffffff
ret

Function at 0x54f420
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x54f437
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00550aa0
add esp, 4
or eax, 0xffffffff
ret

Function at 0x54f4c0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x54f4d4
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00550aa0
add esp, 4
or eax, 0xffffffff
ret
Function at 0x54f580
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
push ebp
mov ebp, 1
shl ebp, cl
push edi
lea eax, [ebp - 1]
shl eax, 4
add eax, 0x14
push eax
push 1
call fcn.0054b490
mov edi, eax
add esp, 8
test edi, edi
jne 0x54f5b3
pop edi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
push ebx
push esi
xor esi, esi
test ebp, ebp
jbe 0x54f5d3
lea ebx, [edi + 0xc]
mov edi, edi
call fcn.0054b5c0
mov dword [ebx], eax
test eax, eax
je 0x54f5d3
inc esi
add ebx, 0x10
cmp esi, ebp
jb 0x54f5c0
cmp esi, ebp
je 0x54f608
test esi, esi
jne 0x54f5ef
push edi
call fcn.0054b4b0
add esp, 4
pop esi
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 8
ret
lea eax, [esi - 1]
shl eax, 4
add eax, 0x14
push eax
push edi
call fcn.0054b4a0
add esp, 8
test eax, eax
je 0x54f608
mov edi, eax
lea ecx, [esi - 1]
lea edx, [edi + 4]
mov eax, edx
test ecx, ecx
jbe 0x54f622
mov ebx, ecx
sub ebx, 1
lea ecx, [eax + 0x10]
mov dword [eax], ecx
mov eax, ecx
jne 0x54f616
mov ecx, dword [0x5a377c]
add dword [0x5a376c], esi
mov dword [eax], ecx
lea eax, [ebp*4]
mov dword [0x5a377c], edx
mov edx, dword [0x5a3768]
push eax
push 1
mov dword [edi], edx
mov dword [0x5a3768], edi
call fcn.0054b490
add esp, 8
test eax, eax
jne 0x54f681
mov ecx, dword [0x5a74d8]
cmp dword [ecx + 4], 3
jl 0x54f721
push str.unable_to_grow_monitor_cache_hash_buckets
call fcn.0054dab0
add esp, 4
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 8
ret
mov edx, dword [0x5a3774]
xor ecx, ecx
lea ebx, [ebp - 1]
mov dword [0x5a3780], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
cmp dword [0x5a3784], ecx
jbe 0x54f6e0
mov edx, dword [0x5a3774]
mov edx, dword [edx + ecx*4]
test edx, edx
je 0x54f6d3
nop
mov edi, dword [edx + 4]
mov esi, dword [edx]
mov ecx, edi
shr ecx, 8
xor ecx, edi
shr ecx, 2
and ecx, ebx
mov edi, dword [eax + ecx*4]
mov dword [edx], edi
mov dword [eax + ecx*4], edx
mov edx, esi
test esi, esi
jne 0x54f6b0
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [0x5a3784]
jb 0x54f6a2
mov ecx, dword [esp + 0x14]
mov dword [0x5a3774], eax
mov eax, dword [esp + 0x1c]
push ecx
mov dword [0x5a3784], ebp
mov dword [0x5a3778], eax
call fcn.0054b4b0
mov edx, dword [0x5a74d8]
add esp, 4
cmp dword [edx + 4], 4
jl 0x54f721
mov eax, dword [0x5a376c]
push ebp
push eax
push str.expanded_monitor_cache_to__d__buckets__d_
call fcn.0054dab0
add esp, 0xc
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x54f7c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x5a74c0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x54f8fc
mov ecx, dword [0x5a74c0]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push eax
push ecx
call edi
mov edx, dword [0x5a74c4]
push 0
push edx
call edi
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ebx
call fcn.0054f750
mov esi, eax
add esp, 4
test esi, esi
je 0x54f8f7
mov eax, dword [0x5a74c0]
push esi
push eax
call edi
mov ecx, dword [esp + 0x1c]
or ecx, 0x84
test ebx, ebx
mov dword [esi + 0xe0], ecx
mov ebx, 1
jne 0x54f84e
push 0x2c
push ebx
call fcn.0054b490
add esp, 8
mov dword [esi + 0x10], eax
test eax, eax
jne 0x54f847
lea edx, [esi + 0x40]
push edx
jmp 0x54f881
mov dword [eax + 0x1c], 0
lea eax, [esi + 0xb8]
push esi
mov dword [eax], eax
mov dword [esi + 0xbc], eax
call fcn.0054edd0
add esp, 4
cmp eax, 0xffffffff
jne 0x54f896
mov eax, dword [esi + 0x10]
push eax
call fcn.0054b4b0
add esp, 4
lea ecx, [esi + 0x40]
mov dword [esi + 0x10], 0
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push esi
call fcn.0054b4b0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [0x5a74c4]
push 0
push edx
call edi
mov eax, dword [0x5a74c4]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call edi
test eax, eax
je 0x54f8c2
mov ecx, dword [0x5a74b0]
push ecx
call fcn.0054af30
add esp, 4
cmp dword [esp + 0x10], ebx
jne 0x54f8d6
or dword [esi + 0xe0], ebx
add dword [0x5a7514], ebx
jmp 0x54f8dc
add dword [0x5a74f8], ebx
mov edx, dword [0x5a74c4]
push edx
call edi
test eax, eax
je 0x54f8f7
mov eax, dword [0x5a74b0]
push eax
call fcn.0054af50
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x54f900
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
call fcn.0054af80
mov dword [0x5a7504], eax
call fcn.0054af80
push 0x2c
mov ebx, 1
push ebx
mov dword [0x5a74b0], eax
call fcn.0054b490
mov ecx, dword [0x5a7480]
lea edx, [esp + ecx + 0x17]
mov ecx, dword [0x5a747c]
sar edx, cl
push eax
shl edx, cl
mov dword [eax + 0x18], edx
mov eax, dword [esp + 0x20]
call fcn.0054f750
mov esi, eax
xor edi, edi
add esp, 0xc
cmp esi, edi
je 0x54f99f
mov eax, dword [0x5a74c0]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esp + 0x10], ebx
jne 0x54f977
mov dword [esi + 0xe0], ebx
add dword [0x5a7514], ebx
mov dword [0x5a74b4], edi
jmp 0x54f983
add dword [0x5a74f8], ebx
mov dword [0x5a74b4], ebx
mov dword [esi + 0xe4], ebx
mov ecx, dword [0x5a74b0]
push ecx
call fcn.0054b180
add esp, 4
mov dword [0x5a74a8], eax
jmp 0x54f9a4
call fcn.0054de40
or dword [esi + 0xe0], 0x88
push esi
call fcn.0054edd0
mov dword [esi + 0xb0], 0x59d0b4
mov edx, dword [0x59d0b8]
lea eax, [esi + 0xb0]
mov dword [esi + 0xb4], edx
mov ecx, dword [0x59d0b8]
mov dword [ecx], eax
add dword [0x5a7498], ebx
add esp, 4
mov dword [0x59d0b8], eax
mov dword [0x5a2da4], edi
call fcn.0054af80
mov dword [0x5a74ac], eax
mov eax, 0x5a74a0
mov dword [0x5a748c], edi
mov dword [0x5a7488], edi
pop edi
mov dword [0x5a74a0], eax
mov dword [0x5a74a4], eax
mov eax, 0x5a7490
pop esi
mov dword [0x5a7490], eax
mov dword [0x5a7494], eax
pop ebx
ret

Function at 0x5504b0
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x5a7480]
sub esp, 0x28
test eax, eax
jne 0x5504f5
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 8]
mov dword [0x5a7480], eax
cmp eax, 1
ja 0x5504e3
mov dword [0x5a747c], 0
add esp, 0x28
ret
lea ecx, [eax - 1]
bsr edx, ecx
mov ecx, edx
inc ecx
mov dword [esp], edx
mov dword [0x5a747c], ecx
add esp, 0x28
ret

Function at 0x551c90
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.00412eb0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 4], 5
jne 0x551ce1
mov eax, 1
cmp dword [esp + 8], eax
jne 0x551ce1
mov dword [0x5a38e0], eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00409b58
add esp, 0x98
ret
Function at 0x551d00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
push eax
push ecx
push edi
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x551d3e
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.00550aa0
add esp, 4
pop edi
or eax, esi
pop esi
add esp, 0xc
ret
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push esi
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x551d74
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0xffffe896
call fcn.0054b4e0
add esp, 8
push esi
call sub.WS2_32.dll_closesocket
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
cmp edi, 0x17
jne 0x551dc9
cmp dword [0x5a38e0], 0
je 0x551dc9
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x1002
mov edi, 0xffff
push edi
push esi
mov dword [esp + 0x20], 4
call sub.WS2_32.dll_getsockopt
test eax, eax
jne 0x551dc9
cmp dword [esp + 8], edi
jle 0x551dc9
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1002
push edi
push esi
mov dword [esp + 0x1c], edi
call sub.WS2_32.dll_setsockopt
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x551e10
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 4]
lea eax, [esp + 4]
push eax
mov eax, dword [edx + 0x18]
push 0x4004667f
push eax
call sub.WS2_32.dll_ioctlsocket
test eax, eax
jge 0x551e45
call sub.WS2_32.dll_WSAGetLastError
push eax
push 0xffffe891
call fcn.0054b4e0
add esp, 8
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x551ef0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [eax + 0x18]
push ecx
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x551f0f
ret
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.00550ba0
add esp, 4
or eax, 0xffffffff
ret

Function at 0x551fb0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [ecx + 4]
push eax
mov eax, dword [edx + 0x18]
push eax
call sub.WS2_32.dll_setsockopt
test eax, eax
jne 0x551fd9
ret
call sub.WS2_32.dll_WSAGetLastError
push eax
call fcn.00550aa0
add esp, 4
or eax, 0xffffffff
ret