joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515670
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x6d3008]
mov edi, eax
add esp, 8
test edi, edi
je 0x5156c7
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x5156df
cmp esi, ebx
je 0x5156df
cmp esi, 0x8000
ja 0x5156df
cmp esi, ebx
jb 0x5156d8
push esi
push edi
call dword [0x6d3008]
mov edi, eax
add esp, 8
test edi, edi
jne 0x515690
push ebp
call dword [0x6d3004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x6d3004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x516b10
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0xc]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x148]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x516b5c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004fd730
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.00516730
add esp, 0x10
pop esi
pop ebx
ret
Function at 0x516cb0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x134]
mov dword [esp + 8], eax
jne 0x516e00
push esi
push edi
lea eax, [ebp + 0x1cb4]
lea edi, [ebp + 0x1eb4]
mov dword [edi], eax
cmp eax, edi
jae 0x516cfe
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516cfe
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516cfe
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x516d68
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516d68
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516d68
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516d68
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516d68
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x516d68
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1eb8], eax
lea esi, [ebp + 0x1cb4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.00516830
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x148]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x516dc0
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004fd730
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb7]
push eax
push ebx
call fcn.00516b80
add esp, 0xc
lea eax, [ebp + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x148]
call edi
test eax, eax
jns 0x516dfe
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.004fd730
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x518200
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x438]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x13c]
push 0
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x518286
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.005b2600
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x5182c1
push str.Received_too_short_packet
push ebx
call fcn.004fd730
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059a7a2
add esp, 0x88
ret
mov eax, dword [edi + 0x148]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x5182e2
jmp dword [ecx*4 + 0x518400]
cmp edx, 4
jle case.0x5182e2.4
mov esi, dword [edi + 0x148]
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x5182e2.4
lea eax, [edx - 4]
push eax
lea eax, [esi + 4]
push eax
push 1
push ebx
call fcn.004fd690
mov esi, eax
add esp, 0x10
test esi, esi
je 0x518343
push 5
push edi
call fcn.00518d00
add esp, 8
mov eax, esi
jmp 0x5182a8
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.0050bcf0
jmp 0x5183d5
mov eax, dword [edi + 0x148]
lea esi, [edx - 4]
push esi
movzx ecx, byte [eax + 2]
lea ebp, [eax + 4]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
push ebp
mov dword [edi + 8], ecx
call fcn.00518d70
add esp, 8
cmp eax, esi
jae case.0x5182e2.4
push ebp
push str.TFTP_error:__s
push ebx
call fcn.004fd800
jmp 0x5183d5
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x148]
add eax, 2
push eax
push edi
call fcn.00517f90
add esp, 0xc
test eax, eax
je case.0x5182e2.4
jmp 0x5182a8
push str.Internal_error:_Unexpected_packet
push 0x636ad4
push ebx
call fcn.004fd730
add esp, 0xc
push ebx
call fcn.0050c0f0
add esp, 4
test eax, eax
je 0x5182a6
push 5
push edi
call fcn.00518d00
add esp, 8
mov eax, 0x2a
jmp 0x5182a8
Function at 0x52f3f0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x6d35ac]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.005cd527
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x52f468
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005102f0
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.004fd730
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x52f5a7
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x52f4ba
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005102f0
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.004fd730
add esp, 0x1c
mov esi, 0x4d
jmp 0x52f5a7
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x52f4fa
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005102f0
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.004fd730
add esp, 0x1c
mov esi, 0x4d
jmp 0x52f59d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x52f528
jg 0x52f50e
cmp edi, 0x100000
jbe 0x52f528
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.004fd730
add esp, 0xc
mov esi, 0x4d
jmp 0x52f59d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x52f540
lea esi, [eax + 0x1b]
jmp 0x52f59d
test edi, edi
je 0x52f584
nop dword [eax]
nop dword [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x52f5e1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x52f5dd
add esi, eax
cmp esi, edi
jb 0x52f550
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0052f1f0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x6d3004]
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x52f5c2
push eax
call fcn.005c13b1
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059a7a2
add esp, 0x120
ret
mov edi, esi
jmp 0x52f584
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005102f0
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.004fd730
add esp, 0x1c
mov esi, 0x4d
jmp 0x52f59d
Function at 0x535580
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.004ffe40
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x5356e8
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x5355fc
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x535661
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x535620
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x53568d
mov eax, dword [esi + 4]
push 1
push 0x60a9dc
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x60a9dd
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x535666
push dword [esp + 0x28]
call fcn.004ffe40
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x5356b8
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x6d3004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x537460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1001c
call fcn.0059b4a0
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push 0x636a80
push eax
call fcn.00537d00
add esp, 8
mov dword [ebp - 0x10018], eax
test eax, eax
jne 0x5374a7
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret
push ebx
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.005c421b
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x537663
push edi
nop word [eax + eax]
test esi, esi
je 0x53763c
mov edx, dword [esi + 0x14]
mov eax, edx
mov edi, dword [esi + 0x10]
sub eax, edi
mov dword [ebp - 0x1001c], edi
mov dword [ebp - 0x1000c], edx
cmp ebx, eax
ja 0x53751d
lea eax, [edi + ebx]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0x10
jb 0x537501
mov eax, dword [esi]
add edi, eax
lea eax, [ebp - 0x10004]
push ebx
push eax
push edi
call fcn.005b2b80
add esp, 0xc
mov byte [edi + ebx], 0
jmp 0x53763c
mov eax, accept
sub eax, edi
cmp eax, ebx
jb 0x537683
lea ecx, [edi + ebx]
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x537541
mov ecx, accept
jmp 0x53756e
mov eax, edx
shr eax, 1
mov dword [ebp - 0x10008], eax
mov eax, accept
sub eax, dword [ebp - 0x10008]
cmp edx, eax
jbe 0x537561
mov ecx, accept
jmp 0x53756e
mov eax, dword [ebp - 0x10008]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x10008], ecx
push eax
mov ecx, esi
call fcn.004047a1
lea ecx, [edi + ebx]
mov dword [ebp - 0x10014], eax
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp - 0x10008]
mov dword [esi + 0x14], ecx
lea ecx, [eax + edi]
mov dword [ebp - 0x10008], ecx
add ecx, ebx
cmp dword [ebp - 0x1000c], 0x10
mov dword [ebp - 0x10010], ecx
jb 0x53760d
push dword [ebp - 0x1001c]
mov edi, dword [esi]
push edi
push eax
call fcn.005b2600
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005b2600
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov ecx, dword [ebp - 0x1000c]
inc ecx
mov byte [eax], 0
cmp ecx, 0x1000
jb 0x537601
mov edx, dword [edi - 4]
add ecx, 0x23
sub edi, edx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x537688
mov edi, edx
push ecx
push edi
call fcn.0059a7b3
add esp, 8
jmp 0x537634
push edi
push esi
push eax
call fcn.005b2600
push ebx
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call fcn.005b2600
mov eax, dword [ebp - 0x10010]
add esp, 0x18
mov byte [eax], 0
mov eax, dword [ebp - 0x10014]
mov dword [esi], eax
push dword [ebp - 0x10018]
lea eax, [ebp - 0x10004]
push 0x10000
push 1
push eax
call fcn.005c421b
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x5374d0
pop edi
push dword [ebp - 0x10018]
call fcn.005c2c80
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop ebx
pop esi
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret
call fcn.0040470b
call fcn.005b6928
int3
Function at 0x537e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f83b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6d35ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x537e70
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor esi, esi
mov dword [ebp + 8], esi
test edi, edi
je 0x537ead
lea ecx, [ebp + 8]
call fcn.00537880
cmp edi, 0xffffffff
je 0x537eaa
mov esi, edi
mov dword [ebp + 8], esi
call fcn.0053efa0
jmp 0x537ead
mov esi, dword [ebp + 8]
test esi, esi
je 0x537ed0
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x537ed0
mov esi, dword [ebp - 0x10]
cmp esi, edi
je 0x537ed3
or esi, 0xffffffff
lea ecx, [ebp + 8]
mov dword [ebp - 4], 6
call fcn.00537880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x539750
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f864f
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x6d962c], 0
je 0x53978a
xor al, al
jmp 0x539849
push 0x18
call fcn.0059a7c1
mov edi, eax
add esp, 4
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x5397da
lea eax, [ebp - 0x29]
mov ecx, edi
push eax
push 1
call fcn.00538a60
lea esi, [edi + 0xc]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x34], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040c38a
mov dword [esi], eax
mov dword [edi + 0x14], 1
jmp 0x5397dc
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [0x6d962c], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x18], 0
mov ecx, edx
mov dword [ebp - 0x14], 7
xor eax, eax
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x539810
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040b566
mov ecx, dword [0x6d962c]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 2
call fcn.00539e80
lea ecx, [ebp - 0x28]
call fcn.0040b6ac
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret
Function at 0x539e80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8758
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
push ecx
push 3
push eax
call fcn.00538640
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x539f13
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [ebp - 4], 0
push esi
push dword [ebp - 0x2c]
mov ecx, edi
call fcn.00539990
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x539f49
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x539f3f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x539f66
push edx
push ecx
call fcn.0059a7b3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret 4
call fcn.005b6928
int3
Function at 0x53f970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8d0c
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x6d35ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [0x6d9664], 1
mov esi, dword [ebp + 0xc]
jne 0x53f9ef
call fcn.0053aaf0
cmp eax, 3
jg 0x53f9ef
test esi, esi
jne 0x53f9ef
push 3
push 0x96
push str.c:usersqishaodesktop360pic_basewin_registry.cc
lea ecx, [ebp - 0xc8]
call fcn.00539f70
add eax, 8
mov dword [ebp - 4], esi
push str.Check_failed:_out_value.
mov ebx, 1
push eax
mov dword [ebp - 0x18], ebx
call fcn.0040923f
add esp, 8
test bl, 1
je 0x53f9ff
lea ecx, [ebp - 0xc8]
call fcn.0053a220
lea eax, [ebp - 0x10]
mov dword [ebp + 0xc], 4
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x53fa4b
mov ecx, dword [ebp + 0xc]
cmp ecx, 4
je 0x53fa40
cmp ecx, 3
jne 0x53fa61
cmp dword [ebp - 0x10], 4
jne 0x53fa61
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5401e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8dba
mov eax, dword fs:[0]
push eax
sub esp, 0x148
push esi
mov eax, dword [0x6d35ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x5402db
push 1
push 2
lea ecx, [ebp - 0xa4]
call fcn.00407699
push 0x668bec
push 0xffffffffffffffff
push str._vs.
push dword [esi]
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0
push 0x60ace8
push str.slot_____DWORD_0xFFFFFFFF_
push eax
call fcn.0040923f
add esp, 8
push eax
call fcn.0040923f
add esp, 8
mov ecx, eax
call fcn.0053a6d0
push eax
call fcn.0040923f
add esp, 8
mov ecx, eax
call fcn.0053a6d0
push eax
call fcn.0040923f
push 0x18
call fcn.0059a7c1
add esp, 0xc
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x5402a5
push eax
lea ecx, [ebp - 0xa4]
call fcn.00407641
mov esi, eax
jmp 0x5402a7
xor esi, esi
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0xffffffff
call fcn.00406a8f
test esi, esi
je 0x5402db
push esi
push 0x12
push str.c:usersqishaodesktop360pic_base_threading_thread_local_win.cc
lea ecx, [ebp - 0x154]
call fcn.0053a110
lea ecx, [ebp - 0x154]
call fcn.0053a220
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5403a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8e02
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x6d35ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], 0
cmp eax, 3
je 0x5403e8
test eax, eax
jne 0x5404fc
mov eax, dword [0x6d31f4]
cmp eax, 0xffffffff
je 0x5404fc
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x5404fc
lea eax, [ebp - 0x110]
mov ecx, 0x40
push eax
push dword [0x6d31f4]
mov esi, ebx
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call fcn.0059aa0f
add esp, 4
mov edi, 0x40
nop word [eax + eax]
mov esi, dword [0x6da210]
xor dl, dl
test esi, esi
jle 0x54047e
nop dword [eax]
mov ecx, dword [ebp + esi*4 - 0x110]
test ecx, ecx
je 0x540479
mov eax, dword [esi*4 + 0x6da218]
test eax, eax
je 0x540479
push ecx
mov dword [ebp + esi*4 - 0x110], 0
call eax
add esp, 4
mov dl, 1
dec esi
test esi, esi
jg 0x540450
dec edi
test edi, edi
jle 0x540489
test dl, dl
jne 0x540440
jmp 0x5404ee
cmp dword [0x6d9664], 1
jne 0x5404d8
call fcn.0053aaf0
cmp eax, 3
jg 0x5404d8
push 3
push 0x8d
push str.c:usersqishaodesktop360pic_base_threading_thread_local_storage_win.cc
lea ecx, [ebp - 0x1c4]
call fcn.00539f70
add eax, 8
mov dword [ebp - 4], 0
push str.Check_failed:_false.
mov ebx, 1
push eax
mov dword [ebp - 0x114], ebx
call fcn.0040923f
add esp, 8
jmp 0x5404de
mov ebx, dword [ebp - 0x114]
test bl, 1
je 0x5404ee
lea ecx, [ebp - 0x1c4]
call fcn.0053a220
push 0
push dword [0x6d31f4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a7a2
mov esp, ebp
pop ebp
ret 0xc