joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5535c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov dword [esp + 8], ecx
mov esi, edx
mov ecx, dword [edx + 0x10]
mov edx, dword [edx + 0x14]
push dword [esp + 0x78]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call fcn.00554f63
add esp, 0xc
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp], edx
and edx, eax
shr eax, 0x19
mov dword [esp + 4], ecx
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmmword [esp + 0x1c], xmm0
movdqu xmm0, xmmword [ecx + edx]
movdqu xmm1, xmmword [esp + 0x1c]
mov dword [esp + 0x18], edx
movdqu xmmword [esp + 0x2c], xmm0
pcmpeqb xmm0, xmm1
pmovmskb ebx, xmm0
test ebx, ebx
je 0x55369d
bsf esi, ebx
mov ebp, dword [esp + 0x78]
add esi, edx
and esi, dword [esp]
mov eax, esi
neg eax
lea edi, [eax + eax*4]
lea edx, [ecx + edi*8 - 0x28]
mov ecx, ebp
mov dword [esp + 0x14], edx
call fcn.004ca478
test al, al
je 0x553689
mov eax, dword [esp + 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
lea eax, [eax + edi*8]
push dword [eax - 0x18]
push dword [eax - 0x1c]
call fcn.004c9c8f
add esp, 8
test al, al
jne 0x5536ce
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x18]
lea eax, [ebx - 1]
and eax, ebx
test ax, ax
mov ebx, eax
jne 0x553644
movdqu xmm1, xmmword [esp + 0x2c]
pcmpeqd xmm0, xmm0
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
test eax, eax
jne 0x55375c
mov eax, dword [esp + 0xc]
lea edx, [edx + eax + 0x10]
add eax, 0x10
and edx, dword [esp]
mov dword [esp + 0xc], eax
jmp 0x553623
shl esi, 3
mov edx, dword [esp + 4]
pcmpeqd xmm1, xmm1
lea eax, [esi + esi*4]
sar eax, 3
imul eax, eax, 0xcccccccd
lea ecx, [eax - 0x10]
movdqu xmm2, xmmword [edx + eax]
mov edi, edx
and ecx, dword [esp]
pcmpeqb xmm2, xmm1
movdqu xmm0, xmmword [edx + ecx]
pmovmskb edx, xmm2
pcmpeqb xmm0, xmm1
psllw xmm0, 7
pmovmskb esi, xmm0
test esi, esi
je 0x553719
bsr si, si
xor esi, 0xf
jmp 0x55371d
mov si, 0x10
or edx, 0x10000
bsf edx, edx
add esi, edx
mov dl, 0x80
cmp si, 0xf
mov esi, dword [esp + 0x10]
ja 0x553739
inc dword [esi + 8]
mov dl, 0xff
mov byte [edi + eax], dl
mov byte [ecx + edi + 0x10], dl
dec dword [esi + 0xc]
lea esi, [esp + 0x3c]
push 0x28
push dword [esp + 0x18]
push esi
call fcn.0064a810
add esp, 0xc
mov al, byte [esi]
cmp al, 3
jne 0x553768
mov eax, dword [esp + 8]
mov dword [eax], 0
jmp 0x55379e
lea esi, [esp + 0x50]
mov ecx, dword [esp + 8]
movq xmm0, qword [esi + 4]
movq xmm1, qword [esi + 0xc]
mov edx, dword [esi - 0x10]
movq qword [ecx + 8], xmm1
movq qword [ecx], xmm0
movzx ecx, al
call fcn.004c91e0
mov eax, dword [esi - 0xc]
push dword [esi - 4]
push dword [esi - 8]
push esi
call dword [eax + 8]
add esp, 0xc
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56948a
Capabilities:
Get remote cert context via schannel

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 8]
mov esi, ecx
add edx, 0x128
mov dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x5694cb
cmp eax, 0x8009030e
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
jne 0x569500
lea eax, [esp + 0xc]
push eax
jmp 0x569515
mov ebp, dword [esp + 8]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 4]
mov ecx, edi
mov dword [esp], eax
call fcn.0059c336
mov ebx, eax
mov dword [esp + 4], edx
push edi
push dword [esp + 4]
push eax
call fcn.0064a810
add esp, 0xc
push ebp
call dword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov eax, dword [esp + 4]
jmp 0x56951f
lea ecx, [esp + 0x18]
mov dword [ecx + 4], eax
mov dword [ecx], 0
mov dword [ecx - 4], 1
push ecx
call fcn.0054fbe4
add esp, 4
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov dword [esi], 1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56b630
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x50]
mov edx, dword [edx + 0x60]
cmp edx, ecx
jb 0x56b78f
mov ebx, dword [edi + 0x58]
xor eax, eax
mov edx, esp
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx], ecx
lea ecx, [esp + 0x30]
mov dword [edx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], 4
mov dword [ecx + 8], edx
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x1c], eax
lea edx, [edi + 0x80]
push eax
push eax
push ecx
push edx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x56b71c
cmp eax, 0x80090318
je 0x56b765
test eax, eax
jne 0x56b75a
mov ecx, dword [esp + 0x14]
mov edx, dword [edi + 0x58]
mov ebp, dword [esp + 0xc]
mov eax, dword [edi + 0x60]
mov dword [edi + 0x48], 0
sub ecx, edx
mov ebx, ecx
add ebx, ebp
jb 0x56b79e
cmp eax, ebx
jb 0x56b7ac
lea eax, [edi + 0x40]
add edx, ecx
mov ecx, eax
push ebp
call fcn.0060c14c
add esp, 4
xor eax, eax
cmp dword [esp + 0x28], 5
mov dword [edi + 0x3c], eax
mov dword [edi + 0x38], eax
mov edx, dword [edi + 0x50]
jne 0x56b700
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0056b5ac
mov eax, dword [edi + 0x50]
xor ecx, ecx
or eax, dword [edi + 0x54]
sete cl
mov dword [edi + 0xa0], ecx
jmp 0x56b782
cmp eax, 0x90317
je 0x56b772
cmp eax, 0x90321
jne 0x56b75a
mov dword [edi + 0x20], 0x10000
mov byte [edi + 0x24], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x56b745
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0056b5ac
mov dword [edi + 0xa0], 0
jmp 0x56b782
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x56b787
cmp dword [esp + 0x10], 4
jne 0x56b779
mov eax, dword [esp + 0xc]
jmp 0x56b77c
mov word [esi], 0x104
jmp 0x56b787
xor eax, eax
inc eax
mov dword [edi + 0xa0], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x7b90a8
call fcn.00652260
add esp, 4
ud2
mov edx, ebx
push 0x7b90b8
call fcn.006524b0
jmp 0x56b799
mov ecx, ebx
mov edx, eax
push 0x7b90b8
jmp 0x56b794
Function at 0x56ba56
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0xf8]
mov edx, dword [edx + 0x108]
cmp edx, ecx
jb 0x56bbe6
mov ebx, dword [edi + 0x100]
xor eax, eax
mov edx, esp
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx], ecx
lea ecx, [esp + 0x30]
mov dword [edx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], 4
mov dword [ecx + 8], edx
mov dword [edx + 8], ebx
mov dword [edx + 0x10], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x1c], eax
lea edx, [edi + 0x128]
push eax
push eax
push ecx
push edx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x56bb6a
cmp eax, 0x80090318
je 0x56bbbc
test eax, eax
jne 0x56bbb1
mov ecx, dword [esp + 0x14]
mov edx, dword [edi + 0x100]
mov ebp, dword [esp + 0xc]
mov eax, dword [edi + 0x108]
mov dword [edi + 0xf0], 0
sub ecx, edx
mov ebx, ecx
add ebx, ebp
jb 0x56bbf5
cmp eax, ebx
jb 0x56bc03
lea eax, [edi + 0xe8]
add edx, ecx
mov ecx, eax
push ebp
call fcn.0060c14c
add esp, 4
xor eax, eax
cmp dword [esp + 0x28], 5
mov dword [edi + 0xe4], eax
mov dword [edi + 0xe0], eax
mov edx, dword [edi + 0xf8]
jne 0x56bb48
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0056b9bd
mov eax, dword [edi + 0xf8]
xor ecx, ecx
or eax, dword [edi + 0xfc]
sete cl
mov dword [edi + 0x148], ecx
jmp 0x56bbd9
cmp eax, 0x90317
je 0x56bbc9
cmp eax, 0x90321
jne 0x56bbb1
mov dword [edi + 0xc8], 0x10000
mov byte [edi + 0xcc], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x56bb9c
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0056b9bd
mov dword [edi + 0x148], 0
jmp 0x56bbd9
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x56bbde
cmp dword [esp + 0x10], 4
jne 0x56bbd0
mov eax, dword [esp + 0xc]
jmp 0x56bbd3
mov word [esi], 0x104
jmp 0x56bbde
xor eax, eax
inc eax
mov dword [edi + 0x148], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x7b90a8
call fcn.00652260
add esp, 4
ud2
mov edx, ebx
push 0x7b90b8
call fcn.006524b0
jmp 0x56bbf0
mov ecx, ebx
mov edx, eax
push 0x7b90b8
jmp 0x56bbeb
Function at 0x56c93c
Capabilities:
Get remote cert context via schannel

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
lea eax, [esp + 8]
mov esi, ecx
sub edx, 0xffffff80
mov dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x56c97a
cmp eax, 0x8009030e
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
jne 0x56c9af
lea eax, [esp + 0xc]
push eax
jmp 0x56c9c4
mov ebp, dword [esp + 8]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 4]
mov ecx, edi
mov dword [esp], eax
call fcn.0059c336
mov ebx, eax
mov dword [esp + 4], edx
push edi
push dword [esp + 4]
push eax
call fcn.0064a810
add esp, 0xc
push ebp
call dword [sym.imp.crypt32.dll_CertFreeCertificateContext]
mov eax, dword [esp + 4]
jmp 0x56c9ce
lea ecx, [esp + 0x18]
mov dword [ecx + 4], eax
mov dword [ecx], 0
mov dword [ecx - 4], 1
push ecx
call fcn.0054fbe4
add esp, 4
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
mov dword [esi], 1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x57e8cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov eax, dword [ecx]
xor edx, edx
inc edx
lea esi, [eax - 6]
cmp esi, 3
cmovb edx, esi
test edx, edx
je 0x57e8f0
cmp edx, 1
jne 0x57e8ee
cmp eax, 5
jne 0x57e8f9
cmp byte [ecx + 0x3c], 3
jne 0x57e8ff
pop esi
ret
add ecx, 8
pop esi
jmp fcn.0057e908
pop esi
jmp fcn.0057e9a0
add ecx, 4
pop esi
jmp 0x57eae9

Function at 0x57e9a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
mov esi, ecx
xor ecx, ecx
lea edx, [eax - 3]
lea edi, [eax - 2]
cmp edx, 2
cmovb ecx, edi
test ecx, ecx
je 0x57ea12
cmp ecx, 1
jne 0x57eae6
movzx eax, byte [esi + 0x3c]
cmp eax, 3
je 0x57eae6
add esi, 4
cmp eax, 4
jne 0x57ea38
mov edi, dword [esi]
movzx eax, byte [edi + 0xad]
test eax, eax
je 0x57ea41
cmp eax, 3
je 0x57ea66
cmp eax, 4
jne 0x57ead7
movzx eax, byte [edi + 0xc8]
test eax, eax
je 0x57ea73
cmp eax, 3
jne 0x57ea7e
cmp byte [edi + 0xb8], 2
je 0x57ea7e
lea ecx, [edi + 0xb0]
jmp 0x57ea79
cmp eax, 2
je 0x57eae6
cmp dword [esi + 0x98], 3
je 0x57ea2f
lea ecx, [esi + 0x98]
call fcn.0056491d
mov ecx, esi
pop esi
pop edi
jmp fcn.0056496d
mov ecx, esi
pop esi
pop edi
jmp 0x57eae9
mov eax, dword [edi + 0x50]
test eax, eax
je 0x57ea55
lock dec dword [eax]
jne 0x57ea55
lea ecx, [edi + 0x50]
call fcn.00568449
lea eax, [edi + 0x80]
push eax
call fcn.0054fc0b
add esp, 4
jmp 0x57ea92
lea ecx, [edi + 0xb0]
call fcn.0057eafd
jmp 0x57ea7e
lea ecx, [edi + 0xbc]
call fcn.00551f98
mov eax, dword [edi + 0x50]
test eax, eax
je 0x57ea92
lock dec dword [eax]
jne 0x57ea92
lea ecx, [edi + 0x50]
call fcn.00568449
mov eax, dword [edi + 0x78]
test eax, eax
je 0x57eaa6
lock dec dword [eax]
jne 0x57eaa6
lea ecx, [edi + 0x78]
call fcn.00568449
mov eax, dword [edi + 0xa8]
test eax, eax
je 0x57eac0
lock dec dword [eax]
jne 0x57eac0
lea ecx, [edi + 0xa8]
call fcn.00552f78
lea ecx, [edi + 0x8c]
call fcn.005649bf
add edi, 0x68
mov ecx, edi
call fcn.004cb243
mov edi, dword [esi]
push edi
push 0
push dword [0x8032a8]
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop edi
ret
cmp byte [ecx + 0x38], 2
jne fcn.00551d76
push ecx
call fcn.00550364
add esp, 4
ret
Function at 0x588b16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov eax, dword [ecx]
xor edx, edx
lea esi, [eax - 0xb]
lea edi, [eax - 0xa]
cmp esi, 2
cmovb edx, edi
test edx, edx
je 0x588b4c
cmp edx, 1
jne 0x588b54
mov eax, dword [ecx + 8]
or eax, dword [ecx + 0xc]
je 0x588b54
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x588b54
mov edx, dword [ecx + 0x14]
mov ecx, eax
call fcn.0042d8db
jmp 0x588b54
add eax, 0xfffffff7
cmp eax, 2
jae 0x588b57
pop esi
pop edi
ret
pop esi
pop edi
jmp fcn.0057e8cb

Function at 0x58d144
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x20], 9
jne 0x58d14b
ret
push esi
lea esi, [ecx + 0x20]
call fcn.0058d15c
mov ecx, esi
pop esi
jmp fcn.0057e8cb
Function at 0x58ff2d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
lea ebp, [esp + 0xc]
mov edi, edx
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1c]
mov dword [ebp], 1
mov edx, ebp
mov dword [ebp + 4], eax
add eax, 0xb
mov dword [ebp + 8], eax
mov word [ebp + 0xc], 0
call fcn.00618d31
mov eax, esp
mov ecx, 0x800
xor esi, esi
mov dword [eax], 0x800
lea eax, [esp + 8]
mov dword [eax], esi
call fcn.0059c336
lea ecx, [esp + 0x1c]
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov dword [ebp + 8], esi
mov ebp, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
mov esi, dword [ecx]
mov eax, esp
push eax
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push esi
push edi
call ebp
cmp eax, 0xea
jne 0x58ffce
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp]
sub ecx, edx
cmp ecx, eax
jae 0x58ff94
lea ecx, [esp + 0xc]
push eax
call fcn.00652a6b
add esp, 4
mov ebx, dword [esp + 0xc]
jmp 0x58ff94
test eax, eax
jne 0x58ffe7
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
jbe 0x59000e
mov eax, 0xde
xor ecx, ecx
mov edx, dword [esp + 4]
cmp dword [esp + 0x10], 0
mov dword [edx], ecx
mov dword [edx + 4], eax
mov byte [edx + 0xc], 0xc
je 0x590026
push ebx
push 0
push dword [0x8032a8]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x590026
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
movsd xmm0, qword [esp + 0xc]
mov dword [edx + 8], ecx
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
cmp dword [esp + 0x20], 0
je 0x59003f
push dword [esp + 0x1c]
push 0
push dword [0x8032a8]
call dword [sym.imp.kernel32.dll_HeapFree]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5a285b
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push 4
push eax
push dword [esp + 0x10]
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5a287f
mov byte [esi], 4
jmp 0x5a288e
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
ret
Function at 0x5a2d40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x6271b0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x8032c0]
test al, al
je 0x5a2f11
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5a2d8c
cmp eax, 3
jne 0x5a2f0a
mov ebx, dword [0x8032c4]
test ebx, ebx
je 0x5a2f0a
mov dword [ebp - 0x20], 0
jmp 0x5a2db7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a2de8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a2f5b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x5a2db0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a2db0
test byte [ebp - 0x20], 1
je 0x5a2f0a
mov ebx, dword [0x8032c4]
test ebx, ebx
je 0x5a2f0a
mov dword [ebp - 0x20], 0
jmp 0x5a2e17
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a2e48
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a2f5b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x5a2e10
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a2e10
test byte [ebp - 0x20], 1
je 0x5a2f0a
mov ebx, dword [0x8032c4]
test ebx, ebx
je 0x5a2f0a
mov dword [ebp - 0x20], 0
jmp 0x5a2e77
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a2ea8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a2f5b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x5a2e70
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a2e70
test byte [ebp - 0x20], 1
je 0x5a2f0a
mov ebx, dword [0x8032c4]
test ebx, ebx
je 0x5a2f0a
mov dword [ebp - 0x20], 0
jmp 0x5a2ed7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a2f04
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a2f5b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x5a2ed0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a2ed0
test byte [ebp - 0x20], 1
jne 0x5a2f24
movzx eax, byte [0x7fc380]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x8032c4]
jmp 0x5a2f2f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a2f0a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a2f5b
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x5a2f2c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x5a2f2c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_src_syncmpmclist.rs
mov edx, 0x2b
push 0x7c1504
call fcn.006522d0
add esp, 4
ud2
Function at 0x5a3d70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x8021d0]
test eax, eax
je 0x5a3e28
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x5a3d9c
cmp dword [eax + 4], 0
mov edi, eax
je 0x5a3d9c
add edi, 8
jmp 0x5a3e23
mov eax, dword [0x8021d0]
test eax, eax
je 0x5a3e37
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5a3e21
mov esi, eax
test eax, eax
jne 0x5a3df7
movzx eax, byte [0x803894]
mov ecx, 0xc
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x5a3e52
mov dword [eax], 0x8021d0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x8021d0]
test eax, eax
je 0x5a3e46
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x5a3e23
test ecx, ecx
je 0x5a3e23
lock dec dword [ecx]
jne 0x5a3e23
call fcn.005a38f0
jmp 0x5a3e23
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x8021d0
call fcn.00659cf0
jmp 0x5a3d80
mov ecx, 0x8021d0
call fcn.00659cf0
jmp 0x5a3daa
mov ecx, 0x8021d0
call fcn.00659cf0
jmp 0x5a3def
mov ecx, 4
mov edx, 0xc
call fcn.00651860
ud2

Function at 0x5a43a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x8021e0]
test eax, eax
je 0x5a4424
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x5a43bf
cmp byte [eax + 4], 0
mov esi, eax
jne 0x5a4419
mov eax, dword [0x8021e0]
test eax, eax
je 0x5a4433
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5a441e
mov esi, eax
test eax, eax
jne 0x5a4413
movzx eax, byte [0x803894]
mov ecx, 8
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x5a444b
mov dword [eax], 0x8021e0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x8021e0]
test eax, eax
je 0x5a443f
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x5a4420
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x8021e0
call fcn.00659cf0
jmp 0x5a43ab
mov ecx, 0x8021e0
call fcn.00659cf0
jmp 0x5a43c9
mov ecx, 0x8021e0
call fcn.00659cf0
jmp 0x5a440b
mov ecx, 4
mov edx, 8
call fcn.00651860
ud2
Function at 0x5a4b60
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x5a4bb4
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x5a4bd7
test eax, eax
js 0x5a4bc3
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x5a4bcf
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x7c0dc4
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.005a3390
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.005a34f0
mov ecx, 7
int 0x29
ud2
Function at 0x5a51a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x8021c0]
test eax, eax
je 0x5a5238
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x5a51c6
cmp dword [eax + 4], 0
je 0x5a51c6
add eax, 8
pop esi
ret
mov eax, dword [0x8021c0]
test eax, eax
je 0x5a5247
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x5a5234
mov esi, eax
test eax, eax
jne 0x5a521d
movzx eax, byte [0x803894]
mov ecx, 0x10
mov edx, 4
call fcn.004889b0
test eax, eax
je 0x5a5262
mov dword [eax], 0x8021c0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x8021c0]
test eax, eax
je 0x5a5256
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x8021c0
call fcn.00659cf0
jmp 0x5a51af
mov ecx, 0x8021c0
call fcn.00659cf0
jmp 0x5a51d0
mov ecx, 0x8021c0
call fcn.00659cf0
jmp 0x5a5215
mov ecx, 4
mov edx, 0x10
call fcn.00651860
ud2

Function at 0x5a62b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x627340
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x5a63c8
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.005a6660
mov ecx, eax
or ecx, edx
je 0x5a63af
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.00649b60
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.00649b60
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.00649b60
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zeroreentrant_init
mov edx, 0x19
push 0x7c066c
call fcn.006522d0
add esp, 4
ud2
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x7c1600
push 0x7bf308
push eax
call fcn.006525c0
add esp, 0xc
ud2