joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a093
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push r15
mov rax, 9
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14003a0ab
sub rsp, 0x28
call fcn.140061030
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140061100
add rsp, 0x10
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140061100
add rsp, 0x10
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.140061100
add rsp, 0x10
mov rdx, rsp
mov rcx, 0x3d
call fcn.140061f60
mov rcx, 0x200030a
call fcn.14004f5b3
mov rcx, 0x200030b
call fcn.14004f5b3
mov dword [rsp + 0x40], 0
mov rcx, 0x200030e
call fcn.14004f5b3
call fcn.14002a9d8
mov rcx, 0x200030e
call fcn.14004f795
and rax, rax
je 0x14003a16f
jmp 0x14003a16f
xor rax, rax
and rax, rax
je 0x14003a19a
mov rcx, 0x200030f
call fcn.14004f5b3
mov qword [rsp + 0x58], 0xf013f
mov rcx, 0x2000310
call fcn.14004f5b3
jmp 0x14003a1bb
mov rcx, 0x2000310
call fcn.14004f5b3
mov rcx, 0x2000311
call fcn.14004f5b3
mov qword [rsp + 0x58], 0xf003f
mov rcx, 0x2000312
call fcn.14004f5b3
mov rcx, 0x2000313
call fcn.14004f5b3
sub rsp, 8
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push qword [rsp + 0x68]
push 0
movabs rax, 0x1400d5206
push rax
movabs rax, 0x80000000
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegOpenKeyExW
add rsp, 0x30
mov rcx, 0x2000313
call fcn.14004f795
mov r15, rax
and r15, r15
jne 0x14003a338
mov rcx, 0x2000314
call fcn.14004f5b3
lea rax, [rsp + 0x50]
mov rax, rax
push rax
push qword [rsp + 0x30]
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_RegCreateKeyW
mov rcx, 0x2000314
call fcn.14004f795
mov r15, rax
and r15, r15
jne 0x14003a30a
mov rcx, 0x2000315
call fcn.14004f5b3
push qword [rsp + 0x38]
pop rcx
call fcn.140051bf0
mov r15, rax
inc r15
add r15, r15
mov rax, r15
push rax
push qword [rsp + 0x40]
push 2
push 0
push qword [rsp + 0x50]
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_RegSetValueExW
add rsp, 0x30
mov rcx, 0x2000315
call fcn.14004f795
mov r15, rax
and r15, r15
jne 0x14003a2dc
mov rcx, 0x2000316
call fcn.14004f5b3
mov dword [rsp + 0x40], 1
mov rcx, 0x2000317
call fcn.14004f5b3
mov rcx, 0x2000318
call fcn.14004f5b3
push qword [rsp + 0x50]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov rcx, 0x2000318
call fcn.14004f795
mov rcx, 0x2000319
call fcn.14004f5b3
mov rcx, 0x200031a
call fcn.14004f5b3
push qword [rsp + 0x48]
pop rcx
call sub.ADVAPI32.DLL_RegCloseKey
mov rcx, 0x200031a
call fcn.14004f795
mov rcx, 0x200031b
call fcn.14004f5b3
mov rcx, 0x200031c
call fcn.14004f5b3
movsxd rax, dword [rsp + 0x40]
movsxd rax, eax
jmp 0x14003a369
push rax
push rax
sub rsp, 0x20
call fcn.1400621b0
add rsp, 0x20
pop rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
pop rax
add rsp, 0x70
pop r15
ret
Function at 0x14003b8ee
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
mov rax, 0xa
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14003b8f8
sub rsp, 0x28
call fcn.140061030
mov rcx, qword [rsp + 0xb0]
call fcn.14004f864
mov rdx, rsp
mov rcx, 0x35
call fcn.140061f60
mov rcx, 0x20002a6
call fcn.14004f5b3
mov rcx, 0x20002a7
call fcn.14004f5b3
sub rsp, 0x18
mov rdx, 1
mov rcx, rdx
call fcn.14004f6db
lea rax, [rsp + 0x40]
push rax
xor r9, r9
mov r8, 0xb
mov rcx, 2
sub rsp, 0x20
call fcn.1400609dc
add rsp, 0x40
mov qword [rsp + 0x28], rax
mov rcx, 0x20002a8
call fcn.14004f5b3
push 0
push 0
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryW
mov rcx, 0x20002a8
call fcn.14004f795
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x68], eax
mov rcx, 0x20002a9
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x68]
and r15, r15
jne 0x14003ba0d
mov rcx, 0x20002aa
call fcn.14004f5b3
movabs rcx, 0x1400d5206
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
pop rax
push rax
call fcn.1400610a0
pop rdx
add rax, rdx
jmp 0x14003bba3
mov rcx, 0x20002ab
call fcn.14004f5b3
mov rcx, 0x20002ac
call fcn.14004f5b3
movsxd rax, dword [rsp + 0x68]
inc rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.14004f6db
call fcn.140060b98
mov rcx, 0x20002ad
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x68]
add r15, r15
mov rax, r15
push rax
mov rax, 0
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx - 0x10]
call fcn.14004f6ee
mov rbp, qword [rsp + 0x30]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
movabs r10, 0x140055af0
mov r11, 0
call fcn.14004f7b3
call fcn.140056080
mov rcx, 0x20002ae
call fcn.14004f5b3
movsxd rax, dword [rsp + 0x68]
mov rax, rax
push rax
mov rax, 0
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx - 0x10]
call fcn.14004f6ee
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_GetSystemDirectoryW
mov rcx, 0x20002ae
call fcn.14004f795
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x68], eax
mov rcx, 0x20002af
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push 0x19
push 0xffffffffffffffff
mov rax, 0
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx - 0x10]
call fcn.14004f6ee
mov rbp, qword [rsp + 0x50]
lea rax, [rbp]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
movabs r10, 0x140055d40
mov r11, 0
call fcn.14004f7b3
call fcn.1400561c0
add rsp, 0x28
movabs rcx, 0x1400d53d2
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
pop rax
push rax
call fcn.1400610a0
pop rdx
add rax, rdx
jmp 0x14003bba3
push rax
push rax
sub rsp, 0x20
call fcn.1400621b0
add rsp, 0x20
pop rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140060cc0
add rsp, 0x28
pop rax
add rsp, 0x78
pop r15
pop rbp
ret
Function at 0x14004f864
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x1400eac34]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x1400503c8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400ee9e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140050422
mov r8, qword [0x1400d51f8]
mov rcx, qword [0x1400ee4b8]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400ee9e8]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.14004f847
lea rcx, [0x1400503a0]
mov rdx, rbx
call fcn.140050690
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14005042c
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400ee9e8], eax
add rsp, 0x28
jmp fcn.1400503c8
Function at 0x140050690
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400ee9f0], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1400eea00]
jne 0x1400506dd
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x1400eea28], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400ee9f0], 1
mov ecx, dword [0x1400eea28]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400507b2
mov rcx, qword [0x1400ee4b8]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x1400507dd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400ee9f8]
test rax, rax
je 0x14005072d
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400ee9f8], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x1400507f8]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x1400eea28]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1400ee4b8]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400507dd
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140051064
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14005112a
lea rcx, [0x1400f4150]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400eebc8]
jmp 0x1400510ee
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400510eb
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400eebc8]
mov rdx, rsi
call fcn.1400608f8
jmp 0x1400510ee
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400510bb
mov rdx, qword [0x1400ea430]
lea rcx, [0x1400eebc8]
mov rdi, rdx
inc rdx
mov qword [0x1400ea430], rdx
lea edx, [rbx + 0x20]
call fcn.140060940
lea rcx, [0x1400f4150]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x1400517e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov ebp, r15d
cmp edx, 1
jl 0x140051944
mov qword [rsp + 0x50], rbx
test rcx, rcx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], r14
lea r14, [0x1400baae8]
mov rbx, r14
mov edi, r15d
cmovne rbx, rcx
test r8, r8
cmovne r14, r8
mov rsi, rbx
movzx ecx, word [r14]
test cx, cx
je 0x140051910
cmp word [r14 + 2], di
je 0x140051910
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r14 + rax*2], di
jne 0x140051850
movsxd r15, eax
nop dword [rax]
mov r8, r15
mov rdx, r14
mov rcx, rbx
call sub.msvcrt.dll_wcsncmp
test eax, eax
je 0x14005187d
cmp word [rbx], bp
je 0x14005187d
add rbx, 2
jmp 0x140051860
inc edi
cmp edi, r12d
je 0x140051892
cmp word [rbx], bp
je 0x14005189b
lea rbx, [rbx + r15*2]
mov rsi, rbx
jmp 0x140051860
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
xor r15d, r15d
mov rcx, rbx
call fcn.140061400
mov r14, qword [rsp + 0x20]
mov edi, eax
test eax, eax
je 0x1400518ca
mov ecx, r13d
call fcn.140061660
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
add r8, r8
call sub.msvcrt.dll_memmove
mov edx, r13d
mov ecx, ebp
call fcn.140061470
test edi, edi
mov rdi, qword [rsp + 0x60]
mov rbx, rax
jne 0x1400518ee
movsxd r8, ebp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_wcsncpy
mov rsi, qword [rsp + 0x58]
movsxd rcx, ebp
mov word [rbx + rcx*2], r15w
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
movzx eax, word [rbx]
cmp ax, cx
je 0x14005191d
test ax, ax
jne 0x140051930
inc edi
cmp edi, edx
je 0x140051936
test ax, ax
je 0x14005189e
lea rsi, [rbx + 2]
add rbx, 2
jmp 0x140051910
mov rbp, rbx
sub rbp, rsi
sar rbp, 1
jmp 0x14005189e
mov ecx, r9d
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
jmp fcn.140061690
Function at 0x140052210
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.140061470
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.1400adaa8
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140052240
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400616d0

Function at 0x1400522c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp edx, 0xd
jne 0x14005230d
mov ebx, 0x40
mov edx, r8d
mov ecx, ebx
call fcn.140061470
mov rdx, rdi
mov rcx, rax
call fcn.1400adad8
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400522f0
sub ebx, edx
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400616d0
cmp edx, 1
je 0x14005232b
cmp edx, 0x18
je 0x14005232b
cmp edx, 3
je 0x140052326
cmp edx, 0x19
je 0x140052326
cmp edx, 0xb
jne 0x14005232e
movzx edi, cx
jmp 0x14005232e
movzx edi, cl
mov ebx, 0x20
mov edx, r8d
mov ecx, ebx
call fcn.140061470
lea rdx, [0x1400baaec]
mov r8d, edi
mov rcx, rax
call fcn.1400ae840
sub ebx, eax
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400616d0

Function at 0x140052e78
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x1400f41b0]
call fcn.14005fc14
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140052f75
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x140052ecf
add rax, 2
cmp word [rax], 0x20
je 0x140052ec5
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x140052f0d
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x140052f4d
cmp cx, r9w
je 0x140052eff
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140052eed
cmp word [rax], bp
je 0x140052f4d
mov rcx, rax
add rax, 2
jmp 0x140052f55
test dx, dx
je 0x140052f52
mov rbx, rax
cmp dx, 0x20
je 0x140052eff
add rax, 2
cmp word [rax], r9w
jne 0x140052f43
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x140052f4d
cmp cx, r9w
je 0x140052f43
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140052f31
movzx edx, word [rax]
test dx, dx
jne 0x140052f15
jmp 0x140052eff
mov rcx, rax
jmp 0x140052f55
mov r8d, ebp
cmp dword [r14], esi
jne 0x140052f5f
test rdi, rdi
jne 0x140052f7f
test r8d, r8d
je 0x140052f66
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x140052ebf
test rdi, rdi
jne 0x140052f94
movsxd rax, esi
jmp 0x140052f96
test rbx, rbx
je 0x140052f94
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x140052f96
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140052fc8
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
lea rcx, [rax + 0x10]
xor ebp, ebp
mov dword [rax + 0x10], ebp
call fcn.140052e78
mov esi, dword [rsp + 0x38]
mov ecx, esi
mov edx, ebx
mov rdi, rax
call fcn.140061470
mov ecx, ebp
jmp 0x14005301e
test esi, esi
je 0x140053023
movzx edx, word [rdi]
cmp dx, 0x22
jne 0x140053011
inc ecx
jmp 0x140053018
mov word [rax], dx
add rax, 2
add rdi, 2
dec esi
cmp word [rdi], bp
jne 0x140053000
mov word [rax], bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.1400616d0
Function at 0x140053880
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400eebe8], 0
jne 0x1400538a5
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400eebe8], 1
mov dword [0x1400eebec], eax
mov rcx, qword [0x1400ee4b8]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400eebec]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x140053a60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1400eebe8], 0
mov ebx, ecx
jne 0x140053a84
call fcn.140053880
mov ecx, dword [0x1400eebec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140053aac
call fcn.140053880
mov ecx, dword [0x1400eebec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x140053ac0
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x140053b00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140053a60
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400eebe8], 0
jne 0x1400538a5
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400eebe8], 1
mov dword [0x1400eebec], eax
mov rcx, qword [0x1400ee4b8]
xor edx, edx
mov r8d, 0x90
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400eebec]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp 0x140053a60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1400eebe8], 0
mov ebx, ecx
jne 0x140053a84
call fcn.140053880
mov ecx, dword [0x1400eebec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x140053aac
call fcn.140053880
mov ecx, dword [0x1400eebec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
lea rdx, [rdi + 8]
mov r8d, 0x11
nop word [rax + rax]
imul eax, ebx, 0x53a9b4fb
mov ecx, 1
mov ebx, 1
sub ecx, eax
lea rdx, [rdx + 4]
mov dword [rdx + 0x40], ecx
imul eax, ecx, 0x53a9b4fb
sub ebx, eax
mov dword [rdx - 4], ebx
dec r8
jne 0x140053ac0
lea esi, [r8 + 0x1f]
mov dword [rdi], r8d
mov dword [rdi + 4], 0xa
lea ebp, [rsi - 0xf]
nop word [rax + rax]
movsxd r11, dword [rdi]
movsxd rbx, dword [rdi + 4]
mov r10d, dword [rdi + rbx*4 + 8]
mov r9d, dword [rdi + r11*4 + 8]
mov eax, dword [rdi + r11*4 + 0x4c]
ror r9d, 5
lea rcx, [rdi + r11*4]
lea r8, [rdi + r11*4]
ror eax, 0xd
add r9d, r10d
add eax, dword [rdi + rbx*4 + 0x4c]
dec r11d
mov dword [r8 + 0x4c], r9d
cmovs r11d, ebp
dec ebx
mov dword [rcx + 8], eax
cmovs ebx, ebp
mov dword [rdi], r11d
mov dword [rdi + 4], ebx
dec rsi
jne 0x140053b00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140053b60
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400eebe8], 0
mov rbx, rcx
jne 0x140053b77
call fcn.140053880
mov ecx, dword [0x1400eebec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
test rax, rax
jne 0x140053b9f
call fcn.140053880
mov ecx, dword [0x1400eebec]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, rax
movsxd r8, dword [r9]
movsxd rdx, dword [r9 + 4]
mov eax, 0x10
mov r10d, dword [r9 + r8*4 + 0x4c]
mov r11d, dword [r9 + r8*4 + 8]
ror r10d, 0xd
add r10d, dword [r9 + rdx*4 + 0x4c]
ror r11d, 5
add r11d, dword [r9 + rdx*4 + 8]
mov dword [r9 + r8*4 + 8], r10d
mov dword [r9 + r8*4 + 0x4c], r11d
dec r8d
mov ecx, r11d
cmovs r8d, eax
dec edx
cmovs edx, eax
mov dword [r9], r8d
mov dword [r9 + 4], edx
inc rbx
je 0x140053c18
mov edx, r10d
mov r8, rbx
mov eax, ebx
shr r8, 0x20
imul rax, rdx
shr rax, 0x20
imul rcx, r8
imul rdx, r8
shr rcx, 0x20
add rax, rcx
add rax, rdx
add rsp, 0x20
pop rbx
ret
mov eax, r10d
shl rax, 0x20
and rax, rcx
add rsp, 0x20
pop rbx
ret
Function at 0x140054bc4
Capabilities:
Create thread

Disassembly:
lea r8, str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
xor edx, edx
jmp 0x140054bc4
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, r8
mov r14d, edx
mov rbp, rcx
test rcx, rcx
je 0x140054c89
mov rcx, qword [0x1400ee4b8]
lea edx, [rbx + 8]
lea r8d, [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea esi, [rbx + 1]
mov rcx, rbp
or dword [rax + 4], 0xffffffff
mov dword [rax], esi
mov rdi, rax
call sub.msvcrt.dll__wcsdup
mov rcx, r15
mov qword [rdi + 8], rax
call sub.msvcrt.dll__wcsdup
mov dword [rdi + 0x30], r14d
mov dword [rdi + 0x68], esi
mov qword [rdi + 0x40], rax
test sil, r14b
je 0x140054c76
lea rax, [rsp + 0x50]
lea r8, [0x140054e34]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov edx, 0x10000
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140054c69
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140054c6d
mov esi, dword [rsp + 0x50]
test esi, esi
je 0x140054c81
mov rbx, rdi
jmp 0x140054c89
mov rcx, rdi
call fcn.140054ca8
mov rbx, rax
mov rcx, rdi
call fcn.140054efc
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140056560
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1c0
xor ebx, ebx
mov edi, 1
cmp dword [0x1400eec40], ebx
jne 0x14005659b
lea r8, [fcn.140056474]
lea edx, [rdi + 0xf]
lea ecx, [rdi + 0x37]
mov dword [0x1400eec40], edi
call fcn.14005ff40
mov qword [0x1400eec18], rax
cmp word [0x1400eec10], bx
jne 0x14005667c
lea rdx, [rsp + 0x20]
mov ecx, 0x101
call qword [sym.imp.WSOCK32.DLL_WSAStartup]
mov word [0x1400eec10], di
test eax, eax
je 0x1400565ca
mov word [0x1400eec10], bx
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1400eec48], rax
test rax, rax
je 0x14005667c
lea rdx, [0x1400bb410]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400eec48]
lea rdx, [0x1400bb420]
mov qword [0x1400eec20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400eec48]
lea rdx, str.getnameinfo
mov qword [0x1400eec28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400eec48]
lea rdx, str.WSAStringToAddressA
mov qword [0x1400eec30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400eec20], rbx
mov qword [0x1400eec38], rax
je 0x14005667c
cmp qword [0x1400eec28], rbx
je 0x14005667c
cmp qword [0x1400eec30], rbx
je 0x14005667c
mov ecx, dword [0x1400eec14]
test rax, rax
cmovne ecx, edi
mov dword [0x1400eec14], ecx
movsx rax, word [0x1400eec10]
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rdi
ret