joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5603f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], edx
sub eax, 0x106
mov edx, dword [esi + 0x6c]
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x560494
push dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push edx
call fcn.00577220
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edx
add esp, 0xc
sub dword [esi + 0x6c], edx
lea eax, [eax + ecx*2]
sub dword [esi + 0x5c], edx
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x560466
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x560453
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x560488
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x560475
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x56054c
mov edx, dword [esi + 0x6c]
mov edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x38]
add dword [ebp - 0x18], edx
mov edx, dword [esi + 0x74]
add dword [ebp - 0x18], edx
cmp eax, dword [ebp - 0x10]
jbe 0x5604bd
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x56050b
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5604e0
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00562530
jmp 0x5604f0
cmp eax, 2
jne 0x5604f6
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0055ed1a
add esp, 0xc
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.00577220
add dword [ebx], edi
add dword [ebx + 8], edi
add esp, 0xc
mov edx, edi
mov eax, dword [esi + 0x74]
add eax, edx
mov dword [esi + 0x74], eax
cmp eax, 2
jbe 0x560537
mov ebx, dword [esi + 0x6c]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + ebx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x56054c
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x560409
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x560e1f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
or eax, 0xffffffff
cmp dword [ebx + 0x3c], 0
jne 0x560e89
cmp dword [ebx + 4], 0
jne 0x560e7c
call sub.msvcrt.dll__errno
mov dword [eax], 0
push dword [ebx + 0x40]
push 0x4000
push 1
push dword [ebx + 0x44]
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov dword [ebx + 4], eax
jne 0x560e77
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x3c], 1
test byte [eax + 0xc], 0x20
je 0x560e72
mov dword [ebx + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x560e89
mov eax, dword [ebx + 0x44]
mov dword [ebx], eax
dec dword [ebx + 4]
mov eax, dword [ebx]
movzx edx, byte [eax]
inc eax
mov dword [ebx], eax
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x560e8e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [eax + 4]
mov esi, eax
cmp ebx, 1
ja 0x560f01
test ebx, ebx
je 0x560eab
mov edx, dword [esi]
mov eax, dword [eax + 0x44]
mov dl, byte [edx]
mov byte [eax], dl
call sub.msvcrt.dll__errno
mov cl, bl
add ebx, dword [esi + 0x44]
mov dword [eax], 0
mov eax, 0x4000
push dword [esi + 0x40]
sar eax, cl
push eax
push 1
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x560ee7
mov eax, dword [esi + 0x40]
test byte [eax + 0xc], 0x20
je 0x560ee7
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x44]
add edx, ebx
mov dword [esi], eax
mov dword [esi + 4], edx
cmp edx, 1
ja 0x560f01
mov dword [esi + 0x58], edx
jmp 0x560fd2
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x560f0e
cmp byte [eax + 1], 0x8b
je 0x560f1a
mov dword [esi + 0x58], 1
jmp 0x560fd2
sub dword [esi + 4], 2
add eax, 2
mov dword [esi], eax
mov eax, esi
call fcn.00560e1f
mov ebx, eax
mov eax, esi
call fcn.00560e1f
cmp ebx, 8
mov edi, eax
jne 0x560f40
mov bl, 5
test al, 0xe0
je 0x560f4c
mov dword [esi + 0x38], 0xfffffffd
jmp 0x560fd2
mov eax, esi
call fcn.00560e1f
dec ebx
jns 0x560f4c
test edi, 4
je 0x560f83
mov eax, esi
call fcn.00560e1f
mov ebx, eax
mov eax, esi
call fcn.00560e1f
shl eax, 8
add ebx, eax
dec ebx
cmp ebx, 0xffffffff
je 0x560f83
mov eax, esi
call fcn.00560e1f
inc eax
jne 0x560f73
test edi, 8
je 0x560f99
mov eax, esi
call fcn.00560e1f
test eax, eax
je 0x560f99
inc eax
jmp 0x560f89
test edi, 0x10
je 0x560faf
mov eax, esi
call fcn.00560e1f
test eax, eax
je 0x560faf
inc eax
jmp 0x560f9f
and edi, 2
je 0x560fc2
mov eax, esi
call fcn.00560e1f
mov eax, esi
call fcn.00560e1f
mov eax, dword [esi + 0x3c]
cmp eax, 1
sbb eax, eax
not eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x561696
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
test ebx, ebx
je 0x5616af
cmp byte [ebx + 0x5c], 0x77
je 0x5616c2
mov eax, 0xfffffffe
jmp 0x56173a
mov dword [ebx + 0x38], 0xffffffff
jmp 0x561728
mov dword [ebx], edi
mov dword [ebx + 4], esi
test esi, esi
je 0x561728
cmp dword [ebx + 0x10], 0
jne 0x5616f8
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0xc], eax
push dword [ebx + 0x40]
push 0x4000
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
jne 0x5616b9
mov dword [ebx + 0x10], 0x4000
mov eax, dword [ebx + 4]
add dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x10]
add dword [ebx + 0x68], eax
push 0
push ebx
call fcn.0055f3c0
mov edx, dword [ebx + 0x68]
mov ecx, dword [ebx + 4]
sub dword [ebx + 0x64], ecx
mov dword [ebx + 0x38], eax
sub edx, dword [ebx + 0x10]
test eax, eax
mov dword [ebx + 0x68], edx
pop edx
pop edx
jne 0x561728
test ecx, ecx
jmp 0x5616c9
push esi
push edi
push dword [ebx + 0x4c]
call fcn.0055ed1a
mov dword [ebx + 0x4c], eax
mov eax, esi
sub eax, dword [ebx + 4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5617e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
test eax, eax
push ebx
push ebx
mov ebx, eax
mov dword [ebp - 0x10], edx
je 0x5617f8
cmp byte [eax + 0x5c], 0x77
je 0x561802
mov eax, 0xfffffffe
jmp 0x561894
mov dword [eax + 4], 0
mov eax, 0x4000
mov esi, eax
sub esi, dword [ebx + 0x10]
je 0x561837
push dword [ebx + 0x40]
push esi
push 1
push dword [ebx + 0x48]
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x561886
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x10], 0x4000
mov dword [ebx + 0xc], eax
test edi, edi
jne 0x56187c
mov eax, dword [ebx + 0x10]
push dword [ebp - 0x10]
add dword [ebx + 0x68], eax
push ebx
call fcn.0055f3c0
mov edx, dword [ebx + 0x10]
sub dword [ebx + 0x68], edx
pop edi
mov dword [ebx + 0x38], eax
pop ecx
test esi, esi
jne 0x561865
cmp eax, 0xfffffffb
jne 0x561865
mov dword [ebx + 0x38], 0
xor edi, edi
test edx, edx
jne 0x561871
cmp dword [ebx + 0x38], 1
jne 0x561876
mov edi, 1
cmp dword [ebx + 0x38], 1
jbe 0x561809
mov eax, dword [ebx + 0x38]
cmp eax, 1
jne 0x561894
jmp 0x561892
or eax, 0xffffffff
mov dword [ebx + 0x38], 0xffffffff
jmp 0x561894
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5670dc
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa0
lea ebx, [ebp - 0xa4]
push 0x94
push 0x5ec810
push ebx
call fcn.00577220
add esp, 0xc
cmp dword [0x697860], 0
jne 0x567168
push ebx
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x567125
cmp dword [ebp - 0x94], 2
jne 0x567125
mov dword [0x697820], 1
mov dword [0x697890], 1
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x697840], eax
push eax
push 0
push 0x566da5
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x697830], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x566c2b
call fcn.004012d0
mov dword [0x697860], 1
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x56716d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
jmp 0x567250
mov ecx, dword [ebp - 0x20]
sub ecx, 0x100
cmp ecx, 5
ja 0x56720d
mov eax, 1
shl eax, cl
test al, 0x33
je 0x56720d
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x56720d
cmp eax, 0x12
jbe 0x5671ab
sub eax, 0x5b
cmp eax, 1
ja 0x56720d
mov dword [0x697850], 0
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x5671c8
or dword [0x697850], 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x5671db
or dword [0x697850], 2
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x5671ee
or dword [0x697850], 4
push 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x567206
push 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x56720d
or dword [0x697850], 8
mov eax, dword [ebp - 0x24]
call fcn.00566c4a
test eax, eax
je 0x567241
push dword [ebp - 0x24]
jmp 0x56721f
push ebx
call sub.USER32.dll_GetParent
mov ebx, eax
test eax, eax
je 0x567241
call fcn.00566c4a
test eax, eax
jne 0x56721e
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
jne 0x567250
lea ebx, [ebp - 0x24]
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
lea eax, [ebp - 0x24]
push 1
push 0
push 0
push 0
push eax
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x567179
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x56726e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
leave
jmp fcn.0056716d

Function at 0x567786
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x697820], 0
mov eax, dword [ebp + 8]
je 0x5677af
push 0xa
push 0
push 0
push eax
call fcn.0056ad7e
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteW
jmp 0x5677c7
push 0xa
push 0
push 0
push eax
call fcn.0056ad64
mov dword [esp], eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
leave
setg al
movzx eax, al
ret

Function at 0x567a96
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x6a71f0], 0
mov eax, dword [ebp + 8]
je 0x567abd
push eax
call fcn.0056ad7e
mov dword [esp], eax
call sub.msvcrt.dll__wgetenv
pop edx
mov dword [ebp + 8], eax
leave
jmp fcn.00569f6a
push eax
call fcn.0056ad64
mov dword [esp], eax
call sub.msvcrt.dll_getenv
pop ecx
mov dword [ebp + 8], eax
leave
jmp fcn.00569ef5
Function at 0x568034
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.0056ad64
mov dword [esp], eax
call sub.WS2_32.DLL_gethostbyname
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x568064
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret

Function at 0x568066
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x5680b4
cld
xor eax, eax
lea edi, [ebp - 0x14]
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0x18]
mov word [ebp - 0x14], 2
push eax
call sub.WS2_32.DLL_htons
push dword [ebp + 0x14]
push dword [ebp + 0xc]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
call fcn.00577220
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call sub.WS2_32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret

Function at 0x568452
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WS2_32.DLL_WSAStartup
push 0x568449
call fcn.004012d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x6a71c0], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x6a71e0], edx
mov dword [0x6a71d0], eax
leave
ret

Function at 0x56c097
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x6a7200
call sub.KERNEL32.DLL_InitializeCriticalSection
call sub.KERNEL32.DLL_TlsAlloc
push 0xb8
mov dword [0x6a2010], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [eax + 4], 0
lea eax, [eax + 8]
push pe_nt_image_headers32
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
push 2
push 0
mov dword [ebx + 0xb4], eax
lea eax, [ebx + 0xb0]
push 0
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_DuplicateHandle
add esp, 0x10
test eax, eax
jne 0x56c122
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
push ebx
push dword [0x6a2010]
call sub.KERNEL32.DLL_TlsSetValue
mov eax, dword [0x6a1fe0]
mov dword [ebx], eax
mov dword [0x6a1fe0], ebx
mov dword [0x6a2000], ebx
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x56c146
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x2d0
lea ebx, [ebp - 0x2d8]
push 0xb8
call sub.msvcrt.dll_malloc
mov esi, eax
mov eax, dword [ebp + 8]
push pe_nt_image_headers32
push 0
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x88], 0
mov dword [esi + 8], eax
lea eax, [esi + 0xb4]
push eax
push 4
push esi
push 0x56c000
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push 0x2cc
mov dword [esi + 0xb0], eax
push 0x5eec70
push ebx
call fcn.00577220
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_GetThreadContext
mov eax, dword [ebp - 0x214]
add esp, 0x1c
mov dword [esi + 0x8c], eax
cmp dword [0x6a7220], 0
je 0x56c1e5
push 0x6a7200
call sub.KERNEL32.DLL_EnterCriticalSection
mov ebx, 0x6a1ff0
mov edx, dword [0x6a1ff0]
test edx, edx
je 0x56c210
cmp dword [edx + 0x88], 0
je 0x56c20a
mov eax, dword [edx]
mov dword [ebx], eax
push edx
call fcn.005770f0
pop ecx
jmp 0x56c20c
mov ebx, edx
mov edx, dword [ebx]
jmp 0x56c1f0
mov eax, dword [0x6a1fe0]
mov dword [0x6a1fe0], esi
mov dword [esi], eax
cmp dword [0x6a7220], 0
je 0x56c230
push 0x6a7200
call sub.KERNEL32.DLL_LeaveCriticalSection
mov eax, esi
mov dword [0x6a7220], 1
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x56c2b8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0xb0]
call sub.KERNEL32.DLL_ResumeThread
leave
ret

Function at 0x56c2cb
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2d0
call fcn.0056c295
mov esi, dword [0x6a1fe0]
mov edi, eax
test esi, esi
je 0x56c38b
cmp esi, edi
je 0x56c384
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_SuspendThread
lea ebx, [ebp - 0x2dc]
push 0x2cc
push 0x5eef3c
push ebx
call fcn.00577220
push ebx
push dword [esi + 0xb0]
call sub.KERNEL32.DLL_GetThreadContext
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x94], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x98], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x9c], eax
mov eax, dword [ebp - 0x234]
mov dword [esi + 0xa0], eax
mov eax, dword [ebp - 0x230]
mov dword [esi + 0xa4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esi + 0xa8], eax
mov eax, dword [ebp - 0x228]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x218]
mov dword [esi + 0x90], eax
add esp, 0xc
mov esi, dword [esi]
jmp 0x56c2e4
mov eax, dword [0x6a1fe0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x56c398
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
call fcn.0056c295
mov ebx, dword [0x6a1fe0]
mov esi, eax
test ebx, ebx
je 0x56c3c1
cmp ebx, esi
je 0x56c3bd
push dword [ebx + 0xb0]
call sub.KERNEL32.DLL_ResumeThread
mov ebx, dword [ebx]
jmp 0x56c3aa
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x56d3c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x78
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
cmp eax, dword [ebp - 4]
jbe 0x56d47a
sub esp, 8
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
lea ecx, [eax*4]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
push eax
call sub.KERNEL32.DLL_lstrcmpA
add esp, 8
test eax, eax
jne 0x56d473
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x18]
mov ax, word [edx + eax]
and eax, 0xffff
lea ecx, [eax*4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [ecx + edx]
mov dword [ebp - 0x24], eax
jmp 0x56d481
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x56d41b
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
leave
ret

Function at 0x56fd20
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x56fd56
mov dword [0x6a6100], eax
mov edx, 0x56fd00
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.005757b0
test eax, eax
sete al
movzx eax, al
mov dword [0x5ef6e0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x5ef6e0], eax
leave
ret
Function at 0x56fe40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x56f0e0
mov dword [ebp - 0x24], 0x578df8
mov dword [ebp - 0x1c], 0x56ff00
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.005762d0
cmp dword [0x5ef6e0], 0
mov dword [ebp - 0x44], 0x6a6110
je 0x56fee0
jl 0x56ff20
mov dword [ebp - 0x3c], 1
mov eax, dword [0x6a6100]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x56ffc3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.005763b0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x6a6ae0]
mov eax, 0xffffffff
test edx, edx
je 0x56ff3a
mov eax, dword [0x5ef6e4]
test eax, eax
je 0x56ff7a
xor eax, eax
test eax, eax
jne 0x56ff70
mov edi, dword [0x5ef6e0]
test edi, edi
js 0x56ff70
mov dword [ebp - 0x44], 0x6a6110
mov ebx, dword [0x5ef6e0]
test ebx, ebx
je 0x56fee0
jmp 0x56fe8e
xor esi, esi
mov dword [0x5ef6e0], esi
jmp 0x56ff48
mov dword [esp], 0x5ef6e8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x570001
mov eax, dword [0x5ef6e4]
test eax, eax
jne 0x56ff38
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x5ef6e4]
test eax, eax
je 0x56ff9d
jmp 0x56ff38
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x56fff5
mov dword [esp + 4], eax
mov eax, dword [0x6a6100]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x57002a
test edx, edx
je 0x570015
mov dword [ebp - 0x3c], 1
call fcn.0056fc70
call fcn.0056fd20
mov eax, 1
mov dword [0x5ef6e4], eax
jmp 0x56ff38
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x56fed6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x56fff1
Function at 0x5761c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x6a7340]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x576200
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.005757b0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x5765b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x6a7340]
mov edi, dword [ebp + 8]
test eax, eax
je 0x57668c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x5766a1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x576660
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x5765f8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x576608
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x576653
test edx, edx
jne 0x576646
test ecx, ecx
je 0x5765f0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x5766b0
cmp eax, 8
je 0x5765f0
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x5765e2
call fcn.00575880
mov eax, dword [0x6a7340]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x5765d4
call fcn.00576220
mov eax, dword [0x6a7340]
jmp 0x5765d4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.00576520
cmp eax, 7
jne 0x57664b
mov eax, dword [0x6a7340]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x576703
mov edi, dword [eax + 0x30]
test edi, edi
js 0x57672e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x57670f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.00575880
mov eax, dword [0x6a7340]
jmp 0x5766e1
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x5766f2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x5766f2
call fcn.00576220
mov eax, dword [0x6a7340]
jmp 0x5766e8