joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1820
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x714dc0]
test eax, eax
je 0x5d1845
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x5d185d
cmp byte [eax + 4], 0
je 0x5d185d
add eax, 5
pop esi
pop ebp
ret
push 0x714dc0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x5d1839
mov eax, dword [0x714dc0]
test eax, eax
je 0x5d18d2
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5d18ea
mov esi, eax
test eax, eax
jne 0x5d18ad
mov eax, dword [0x6b6a34]
movzx eax, byte [eax]
push 4
push 8
call fcn.004ed010
add esp, 8
test eax, eax
je 0x5d18fe
mov dword [eax], 0x714dc0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x714dc0]
test eax, eax
je 0x5d18ef
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
je 0x5d18c5
cmp byte [eax], 0
mov byte [eax], 0
movzx eax, byte [eax + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [esi + 5]
mov byte [esi + 4], 1
mov byte [esi + 5], cl
pop esi
pop ebp
ret
push 0x714dc0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x5d1872
xor eax, eax
pop esi
pop ebp
ret
push 0x714dc0
call fcn.005c8000
add esp, 4
jmp 0x5d18a6
push 8
push 4
call fcn.004ed3a0
nop word [eax + eax]
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [0x714dd0]
test eax, eax
je 0x5d19e4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x5d193c
cmp dword [eax + 4], 0
mov esi, eax
jne 0x5d19df
mov eax, dword [0x714dd0]
test eax, eax
je 0x5d1a0c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5d1a28
mov esi, eax
test eax, eax
jne 0x5d199f
mov eax, dword [0x6b6a34]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.004ed010
add esp, 8
test eax, eax
je 0x5d1a44
mov dword [eax], 0x714dd0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x714dd0]
test eax, eax
je 0x5d1a32
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5d1a05
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
je 0x5d1a05
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x5d19df
test ecx, ecx
je 0x5d19df
lock dec dword [ecx]
jne 0x5d19df
lea ecx, [ebp - 8]
call fcn.005891d0
add esi, 8
jmp 0x5d1a2a
push 0x714dd0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x5d1930
jmp 0x5d193c
call fcn.005b3790
jmp 0x5d19b4
push 0x714dd0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x5d1959
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
push 0x714dd0
call fcn.005c8000
add esp, 4
jmp 0x5d1998
push 0xc
push 4
call fcn.004ed3a0
nop dword [eax]
Function at 0x5d1910
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x714dc0]
test eax, eax
je 0x5d1845
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x5d185d
cmp byte [eax + 4], 0
je 0x5d185d
add eax, 5
pop esi
pop ebp
ret
push 0x714dc0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x5d1839
mov eax, dword [0x714dc0]
test eax, eax
je 0x5d18d2
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5d18ea
mov esi, eax
test eax, eax
jne 0x5d18ad
mov eax, dword [0x6b6a34]
movzx eax, byte [eax]
push 4
push 8
call fcn.004ed010
add esp, 8
test eax, eax
je 0x5d18fe
mov dword [eax], 0x714dc0
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x714dc0]
test eax, eax
je 0x5d18ef
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
xor ecx, ecx
test eax, eax
je 0x5d18c5
cmp byte [eax], 0
mov byte [eax], 0
movzx eax, byte [eax + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [esi + 5]
mov byte [esi + 4], 1
mov byte [esi + 5], cl
pop esi
pop ebp
ret
push 0x714dc0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x5d1872
xor eax, eax
pop esi
pop ebp
ret
push 0x714dc0
call fcn.005c8000
add esp, 4
jmp 0x5d18a6
push 8
push 4
call fcn.004ed3a0
nop word [eax + eax]
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [0x714dd0]
test eax, eax
je 0x5d19e4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x5d193c
cmp dword [eax + 4], 0
mov esi, eax
jne 0x5d19df
mov eax, dword [0x714dd0]
test eax, eax
je 0x5d1a0c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5d1a28
mov esi, eax
test eax, eax
jne 0x5d199f
mov eax, dword [0x6b6a34]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.004ed010
add esp, 8
test eax, eax
je 0x5d1a44
mov dword [eax], 0x714dd0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x714dd0]
test eax, eax
je 0x5d1a32
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x5d1a05
mov eax, dword [ecx + 4]
cmp dword [ecx], 0
mov dword [ecx], 0
je 0x5d1a05
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
test edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov dword [esi + 4], 1
mov dword [esi + 8], eax
je 0x5d19df
test ecx, ecx
je 0x5d19df
lock dec dword [ecx]
jne 0x5d19df
lea ecx, [ebp - 8]
call fcn.005891d0
add esi, 8
jmp 0x5d1a2a
push 0x714dd0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x5d1930
jmp 0x5d193c
call fcn.005b3790
jmp 0x5d19b4
push 0x714dd0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x5d1959
xor esi, esi
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
push 0x714dd0
call fcn.005c8000
add esp, 4
jmp 0x5d1998
push 0xc
push 4
call fcn.004ed3a0
nop dword [eax]
Function at 0x5d1a50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x714de0]
mov esi, ecx
test eax, eax
je 0x5d1b29
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x5d1a7f
cmp dword [eax + 4], 0
mov edi, eax
jne 0x5d1b24
mov eax, dword [0x714de0]
test eax, eax
je 0x5d1b4a
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5d1b66
mov edi, eax
test eax, eax
jne 0x5d1ae2
mov eax, dword [0x6b6a34]
movzx eax, byte [eax]
push 4
push 0xc
call fcn.004ed010
add esp, 8
test eax, eax
je 0x5d1b83
mov dword [eax], 0x714de0
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x714de0]
test eax, eax
je 0x5d1b71
dec eax
push edi
push eax
call sub.KERNEL32.dll_TlsSetValue
test esi, esi
je 0x5d1af7
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x5d1af9
mov eax, dword [esi + 4]
jmp 0x5d1af9
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x5d1b24
test ecx, ecx
je 0x5d1b24
lock dec dword [ecx]
jne 0x5d1b24
lea ecx, [ebp - 0xc]
call fcn.00589340
add edi, 8
jmp 0x5d1b68
push 0x714de0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x5d1a73
jmp 0x5d1a7f
push 0x714de0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x5d1a9c
xor edi, edi
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebp
ret
push 0x714de0
call fcn.005c8000
add esp, 4
jmp 0x5d1adb
push 0xc
push 4
call fcn.004ed3a0
nop dword [eax]
Function at 0x5d1b90
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x714df0]
test eax, eax
je 0x5d1c8c
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x5d1bc0
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x5d1c87
mov eax, dword [0x714df0]
test eax, eax
je 0x5d1cad
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x5d1cc9
mov esi, eax
test eax, eax
jne 0x5d1c2a
mov eax, dword [0x6b6a34]
movzx eax, byte [eax]
push 8
push 0x20
call fcn.004ed010
add esp, 8
test eax, eax
je 0x5d1ce5
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x714df0
mov esi, eax
mov eax, dword [0x714df0]
test eax, eax
je 0x5d1cd3
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x5d1c49
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x5d1c76
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x5d1c68
movaps xmm0, xmmword [esp]
jmp 0x5d1c76
lea ecx, [esp + 0x10]
call fcn.005c70f0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x5d1ccb
push 0x714df0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x5d1bb3
jmp 0x5d1bc0
push 0x714df0
call fcn.005c8000
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x5d1bdd
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x714df0
call fcn.005c8000
add esp, 4
jmp 0x5d1c23
push 0x20
push 8
call fcn.004ed3a0
int3
Function at 0x5f95a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x140]
cmp eax, 1
jbe 0x5f9761
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 0x13c]
mov ecx, esp
push eax
add eax, 0x30
push eax
push ecx
call fcn.00555c50
add esp, 0xc
mov eax, dword [esp]
cmp eax, 2
jne 0x5f95ed
mov dword [esi], 2
jmp 0x5f9757
movsd xmm1, qword [esp + 0x24]
movsd xmm2, qword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 0x6c], xmm1
movsd xmm1, qword [esp + 0x14]
movsd qword [esp + 0x64], xmm2
movsd xmm2, qword [esp + 4]
mov dword [esp + 0x7c], ecx
movsd qword [esp + 0x74], xmm0
movsd qword [esp + 0x5c], xmm1
movsd xmm1, qword [esp + 0xc]
movsd qword [esp + 0x4c], xmm2
movsd qword [esp + 0x54], xmm1
mov dword [esp + 0x48], eax
movzx eax, byte [esp + 0x78]
test eax, eax
je 0x5f96bb
cmp eax, 1
jne 0x5f96cf
mov dword [esp + 0x3c], 4
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 2
mov ecx, esp
lea edx, [esp + 0x3c]
call fcn.005e4e50
mov edx, dword [esp + 8]
lea edi, [esp + 8]
nop
mov esi, dword [esp + 0x28]
mov ecx, edi
cmp esi, 5
mov ebx, esi
jb 0x5f9693
mov ebx, dword [esp + 4]
mov ecx, edx
test ebx, ebx
je 0x5f96e2
mov eax, dword [ecx + ebx*8 - 8]
or eax, dword [ecx + ebx*8 - 4]
jne 0x5f96e2
cmp esi, 5
lea ecx, [esp + 0x28]
jb 0x5f96b2
mov esi, dword [esp + 4]
lea ecx, [esp + 4]
test esi, esi
je 0x5f9680
dec esi
mov dword [ecx], esi
jmp 0x5f9680
mov dword [esi], 2
mov eax, dword [esp + 0x70]
cmp eax, 5
jae 0x5f9745
jmp 0x5f9757
mov eax, dword [esp + 0x70]
cmp eax, 4
jbe 0x5f96ed
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
jmp 0x5f96f1
movsd xmm0, qword [esp + 0x28]
mov esi, dword [ebp + 8]
jmp 0x5f9702
lea edx, [esp + 0x50]
mov ecx, esp
push eax
call fcn.005e4bc0
add esp, 4
movsd xmm0, qword [esp + 0x28]
movsd xmm1, qword [esp + 0x20]
movsd xmm2, qword [esp + 0x18]
movsd qword [esi + 0x28], xmm0
movsd qword [esi + 0x20], xmm1
movsd xmm1, qword [esp + 0x10]
movsd qword [esi + 0x18], xmm2
movsd xmm2, qword [esp]
movsd qword [esi + 0x10], xmm1
movsd xmm1, qword [esp + 8]
movsd qword [esi], xmm2
movsd qword [esi + 8], xmm1
mov eax, dword [esp + 0x70]
cmp eax, 5
jb 0x5f9757
shl eax, 3
push 8
push eax
push dword [esp + 0x58]
call fcn.004ed020
add esp, 0xc
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6e857c
push eax
push 1
call fcn.004fac30
mov esi, eax
mov eax, dword [esp + 0x70]
cmp eax, 5
jb 0x5f978b
shl eax, 3
push 8
push eax
push dword [esp + 0x58]
call fcn.004ed020
add esp, 0xc
push esi
call fcn.0050ffb0
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x60b9e0
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [esp + 4]
and eax, 0xf
jmp dword [eax*4 + 0x6e9240]

Function at 0x60de10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x60de21
jmp dword [eax*4 + 0x6e9600]
cmp dword [0x7151d0], 0
je 0x60df23
push 0x7151d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x7151ec]
test edi, edi
je 0x60df18
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x60de6b
mov edi, dword [edi + 8]
test edi, edi
je 0x60df18
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x60de60
test esi, esi
je 0x60de60
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x60de60
cmp dword [0x7151d0], 0
jne 0x60dea0
push 0x7151d4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x7151d0], 1
jmp case.default.0x60de21
call fcn.0049c980
jmp case.default.0x60de21
cmp dword [0x7151d0], 0
je case.default.0x60de21
push 0x7151d4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x7151ec]
test edi, edi
je 0x60df73
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x60def7
mov edi, dword [edi + 8]
test edi, edi
je 0x60df73
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x60def0
test esi, esi
je 0x60def0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x60def0
push 0x7151d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x7151d0]
cmp eax, 1
jne case.default.0x60de21
mov eax, dword [0x7151ec]
test eax, eax
je 0x60df52
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, esi
test esi, esi
jne 0x60df40
mov dword [0x7151ec], 0
mov dword [0x7151d0], 0
push 0x7151d4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x60de21
push 0x7151d4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x60e0a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x6af004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x60e106
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x60e106
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x60e106
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x60e106
mov edx, dword [esp + 0xc]
sub edx, dword [0x6af004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x60e0f6
add esi, 0x28
dec ecx
je 0x60e106
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x60e0f0
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x60e0f0
mov eax, esi
pop esi
pop edi
ret
Function at 0x611450
Capabilities:
Get thread local storage value
Print debug messages
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x70
call fcn.00612a50
push dword [0x714ea0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x61154b
call fcn.00612f00
mov esi, eax
xor eax, eax
cmp dword [entry4], 0
je 0x61154b
test esi, esi
je 0x61154b
mov dword [esi + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x3c], eax
sub esp, 0x10
movaps xmm0, xmmword [0x6e97b0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0xffffffff
lea eax, [esi + 0x38]
push eax
call fcn.00683dd0
add esp, 4
cmp eax, 1
je 0x611558
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x64], 0
mov ebp, esi
add ebp, 0x14
mov dword [esi + 0x14], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
call edi
push 2
push 0
push 0
push ebp
push eax
push ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x611553
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], 0
mov eax, dword [esi + 0x20]
and eax, 0xffffffcf
or eax, 0x10
mov dword [esi + 0x20], eax
push esi
push dword [0x714ea0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, eax
mov eax, esi
test ecx, ecx
je 0x611553
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.msvcrt.dll_abort
movups xmm0, xmmword [0x6e98c6]
movups xmmword [esp + 0x5f], xmm0
movups xmm0, xmmword [0x6e98bb]
movups xmmword [esp + 0x54], xmm0
movups xmm0, xmmword [0x6e98ab]
movups xmmword [esp + 0x44], xmm0
movups xmm0, xmmword [0x6e989b]
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [0x6e988b]
movups xmmword [esp + 0x24], xmm0
movups xmm0, xmmword [0x6e987b]
movups xmmword [esp + 0x14], xmm0
movups xmm0, xmmword [str.Error_cleaning_up_spin_keys_for_thread]
movups xmmword [esp + 4], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [esp + 0x2b]
push 0xa
push ecx
push eax
call dword [sym.imp.msvcrt.dll__ultoa]
add esp, 0xc
mov eax, 0x27
mov ecx, eax
inc eax
cmp ecx, 0x69
ja 0x6115d7
cmp byte [esp + ecx + 4], 0
jne 0x6115c8
cmp ecx, 0x69
ja 0x6115e3
mov word [esp + eax + 3], 0xa
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
nop word cs:[eax + eax]
Function at 0x611f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
call fcn.00611450
mov esi, eax
mov dword [eax + 4], edi
push dword [eax + 0xb4]
call fcn.00611d10
add esp, 4
test byte [esi + 0x20], 0x30
jne 0x611fb0
add esi, 0x70
push 1
push esi
call dword [sym.imp.msvcrt.dll_longjmp]
push dword [0x714ea0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x612038
mov esi, eax
cmp dword [eax + 0x14], 0
jne 0x611fe8
mov dword [esi], 0xdeadbeef
mov eax, dword [esi + 0x18]
test eax, eax
je 0x611fdc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov edi, dword [esi + 4]
jmp 0x612023
mov edi, dword [esi + 4]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x68], 1
test eax, eax
je 0x612000
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
test byte [esi + 0x24], 4
je 0x612038
mov dword [esi], 0xdeadbeef
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14], 0
mov ecx, esi
call fcn.00612040
push 0
push dword [0x714ea0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
call dword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x613a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x104
mov esi, dword [esp + 0x114]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test esi, esi
je 0x613ac4
cmp byte [esi], 0
je 0x613ab4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x613ad4
test al, 0x10
jne 0x613ae4
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
jmp 0x613ba4
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x613ba4
call sub.msvcrt.dll__errno
mov dword [eax], 2
jmp 0x613ba4
mov ebx, esp
push 0x104
push esi
push ebx
call sub.msvcrt.dll__fullpath
add esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add esp, 4
add eax, 0x233
push eax
call sub.msvcrt.dll_malloc
add esp, 4
test eax, eax
je 0x613b99
mov esi, eax
lea edi, [eax + 0x22c]
push ebx
push edi
call sub.msvcrt.dll_strcpy
add esp, 8
cmp byte [esi + 0x22c], 0
je 0x613b59
push edi
call sub.msvcrt.dll_strlen
add esp, 4
movzx eax, byte [eax + esi + 0x22b]
cmp eax, 0x2f
je 0x613b59
cmp eax, 0x5c
je 0x613b59
push edi
call sub.msvcrt.dll_strlen
add esp, 4
mov word [edi + eax], 0x5c
push edi
call sub.msvcrt.dll_strlen
add esp, 4
mov word [esi + eax + 0x22c], 0x2a
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov eax, esi
add eax, 0x118
push 0x10c
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x613ba6
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor esi, esi
mov eax, esi
add esp, 0x104
pop esi
pop edi
pop ebx
ret
Function at 0x617600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
not eax
cmp ecx, 9
jb 0x61779e
test bl, 7
je 0x6176e8
lea edx, [ebx + 1]
movzx esi, byte [ebx]
movzx edi, al
xor edi, esi
mov esi, dword [0x6ebaf8]
shr eax, 8
xor eax, dword [esi + edi*4]
test dl, 7
je 0x6176ec
lea edx, [ebx + 2]
movzx edi, byte [ebx + 1]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
test dl, 7
je 0x6176ef
lea edx, [ebx + 3]
movzx edi, byte [ebx + 2]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
test dl, 7
je 0x6176f4
lea edx, [ebx + 4]
movzx edi, byte [ebx + 3]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
test dl, 7
je 0x6176f9
lea edx, [ebx + 5]
movzx edi, byte [ebx + 4]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
test dl, 7
je 0x6176fe
lea edx, [ebx + 6]
movzx edi, byte [ebx + 5]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
test dl, 7
je 0x617703
lea edx, [ebx + 7]
movzx edi, byte [ebx + 6]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
test dl, 7
je 0x617708
movzx edx, byte [ebx + 7]
add ebx, 8
movzx edi, al
xor edi, edx
shr eax, 8
xor eax, dword [esi + edi*4]
add ecx, 0xfffffff8
mov edx, ebx
jmp 0x61770b
dec ecx
jmp 0x61770b
add ecx, 0xfffffffe
jmp 0x61770b
add ecx, 0xfffffffd
jmp 0x61770b
add ecx, 0xfffffffc
jmp 0x61770b
add ecx, 0xfffffffb
jmp 0x61770b
add ecx, 0xfffffffa
jmp 0x61770b
add ecx, 0xfffffff9
mov esi, ecx
and esi, 0xfffffff8
and ecx, 7
test esi, esi
jle 0x617810
mov dword [esp], ecx
add esi, edx
mov edi, dword [0x6ebaf8]
nop word cs:[eax + eax]
xor eax, dword [edx]
movzx ebp, al
movzx ebx, ah
mov ebx, dword [edi + ebx*4 + 0x1800]
xor ebx, dword [edi + ebp*4 + 0x1c00]
mov ebp, eax
shr ebp, 0xe
and ebp, 0x3fc
shr eax, 0x18
xor ebx, dword [edi + ebp + 0x1400]
xor ebx, dword [edi + eax*4 + 0x1000]
mov ecx, dword [edx + 4]
movzx eax, cl
xor ebx, dword [edi + eax*4 + 0xc00]
movzx eax, ch
xor ebx, dword [edi + eax*4 + 0x800]
mov eax, ecx
shr eax, 0xe
and eax, 0x3fc
xor ebx, dword [edi + eax + 0x400]
shr ecx, 0x18
mov eax, ebx
xor eax, dword [edi + ecx*4]
add edx, 8
cmp edx, esi
jb 0x617730
mov ebx, edx
mov ecx, dword [esp]
test ecx, ecx
je 0x617806
test cl, 1
jne 0x6177b0
mov edx, ecx
cmp ecx, 1
jne 0x6177d1
jmp 0x617806
lea edx, [ecx - 1]
mov edi, ecx
movzx ecx, byte [ebx]
inc ebx
movzx esi, al
xor esi, ecx
mov ecx, dword [0x6ebaf8]
shr eax, 8
xor eax, dword [ecx + esi*4]
mov ecx, edi
cmp ecx, 1
je 0x617806
xor ecx, ecx
mov esi, dword [0x6ebaf8]
nop dword [eax]
movzx edi, byte [ebx + ecx]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
movzx edi, byte [ebx + ecx + 1]
movzx ebp, al
xor ebp, edi
shr eax, 8
xor eax, dword [esi + ebp*4]
add ecx, 2
cmp edx, ecx
jne 0x6177e0
not eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edx
test ecx, ecx
jne 0x6177a2
jmp 0x617806