joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d0f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x248
mov esi, edx
mov dword [esp + 0x124], ecx
call fcn.0047d111

Function at 0x49059c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x210
mov ebx, dword [ebp + 8]
call fcn.004905b3

Function at 0x491c11
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
lea eax, [esi + 0x30]
mov dword [esi + 0xc], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5e6c30
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword fs:[0], eax
mov edi, dword [ecx + 8]
cmp dword [ecx], edi
mov ecx, dword [ecx + 4]
jbe 0x491c85
test edi, edi
mov dword [esi + 4], edx
je 0x491c89
push edi
push ecx
push 0
push dword [0x7f5050]
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [esi + 4]
mov ebx, eax
test eax, eax
jne 0x491c96
and dword [esi + 0x38], 0
xor ecx, ecx
mov edx, edi
inc ecx
call fcn.0062d0a0
ud2
mov ebx, ecx
jmp 0x491c96
xor ebx, ebx
inc ebx
mov edx, ebx
call fcn.004533f0
mov edx, dword [esi + 4]
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x10]
mov dword [ecx + 0xc], edx
mov dword [ecx + 8], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edi
and word [ecx], 0
call fcn.00480fbb
mov ecx, dword [esi + 0x30]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ba0ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x670
cmp byte [edx + 0x10], 0
call fcn.004ba0c4
Function at 0x50e7dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x130
mov edi, dword [esp + 0x148]
mov ebx, dword [esp + 0x144]
call fcn.0050e7f9
Function at 0x516353
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
cmp word [edx], 0
mov esi, ecx
push 2
pop eax
push 0x17
pop ebx
mov ecx, dword [0x7f4fd8]
cmove ebx, eax
cmp ecx, 3
jne 0x5163d5
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_socket]
cmp eax, 0xffffffff
je 0x5163ba
mov edi, eax
lea eax, [esp + 4]
mov dword [eax], 1
push eax
push 0x8004667e
push edi
call dword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x5163c7
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
and dword [esi], 0
mov dword [esi + 4], ebx
jmp 0x5163cd
call sub.KERNEL32.dll_GetLastError
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x5163cd
mov dword [esi + 4], edi
mov byte [esi], 4
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 3]
lea ebp, [esp + 8]
mov ecx, 0x7f4fd8
xor edx, edx
mov byte [eax], 1
mov dword [ebp], eax
push 0x764a40
push 0x7642b4
push ebp
call fcn.00633120
add esp, 0xc
jmp 0x516378

Function at 0x51646a
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebx, esp
mov esi, ecx
mov edi, edx
mov ecx, ebx
call fcn.005162f7
cmp byte [ebx], 4
jne 0x516489
mov ebp, dword [esp + 4]
jmp 0x516494
mov eax, dword [esp]
mov ebp, dword [esp + 4]
cmp al, 4
jne 0x516502
mov ebx, esp
mov edx, edi
mov ecx, ebx
call fcn.00516300
mov eax, dword [ebx + 0x18]
movsd xmm0, qword [ebx + 0x10]
movsd xmm2, qword [ebx]
movsd xmm1, qword [ebx + 8]
lea ecx, [esp + 0x20]
mov dword [ecx + 0x18], eax
movsd qword [ecx + 0x10], xmm0
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm2
push dword [ebx + 0x1c]
push ecx
push ebp
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5164f6
call sub.KERNEL32.dll_GetLastError
mov ecx, esp
mov edi, eax
and dword [ecx], 0
mov dword [ecx + 4], eax
call fcn.00412758
cmp al, 0xd
jne 0x516510
xor ecx, ecx
mov edx, edi
call fcn.00514289
mov dword [esi + 4], ebp
and dword [esi + 8], 0
and dword [esi], 0
jmp 0x51652b
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
mov dword [esi], 1
jmp 0x51652b
and dword [esi + 4], 0
xor ecx, ecx
mov dword [esi + 8], edi
mov dword [esi], 1
call fcn.0051624f
push ebp
call dword [sym.imp.ws2_32.dll_closesocket]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x516598
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov ebp, dword [esp + 0x60]
mov esi, ecx
movzx eax, word [ebp]
cmp eax, 2
je 0x5165c5
mov ebx, dword [ebp + 4]
mov edi, dword [ebp + 8]
cmp eax, 3
jne 0x5165dd
mov dword [esp], ebx
mov dword [esp + 4], edi
jmp 0x51669c
mov byte [esp], 2
mov dword [esp + 4], 0x7642a8
mov bl, 2
mov edi, 0x7642a8
jmp 0x5166a1
movzx ecx, word [ebp + 2]
mov dword [esp + 8], esi
mov esi, dword [esp + 0x5c]
movsd xmm0, qword [ebp + 0xc]
mov word [esp + 0x10], cx
mov dword [esp + 0x16], edi
mov edi, dword [ebp + 0x18]
mov ecx, 0x7fffffff
mov dword [esp + 0x12], ebx
movsd qword [esp + 0x1a], xmm0
cmp esi, ecx
cmovb ecx, esi
test ax, ax
mov dword [esp + 0xc], edi
je 0x51662c
mov eax, dword [ebp + 0x14]
movzx ebx, word [ebp + 0x1c]
push 0x1c
pop ebp
movups xmm0, xmmword [esp + 0x12]
mov si, 0x17
jmp 0x51663d
shr ebx, 0x10
push 0x10
pop ebp
mov eax, dword [esp + 0x10]
mov si, 2
xorps xmm0, xmm0
lea edi, [esp + 0x24]
rol bx, 8
mov word [edi], si
mov word [edi + 2], bx
mov dword [edi + 4], eax
mov eax, dword [esp + 0xc]
movups xmmword [edi + 8], xmm0
mov dword [edi + 0x18], eax
push ebp
push edi
push 0
push ecx
push dword [esp + 0x68]
push edx
call dword [sym.imp.ws2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x51667d
mov edi, eax
mov bl, 4
mov dword [esp + 4], eax
mov byte [esp], 4
jmp 0x516698
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ebx, ebx
mov edi, eax
mov byte [esp], bl
and word [esp + 1], 0
mov byte [esp + 3], bl
mov dword [esp + 4], eax
mov esi, dword [esp + 8]
cmp bl, 4
je 0x516713
mov ecx, esp
call fcn.00412758
cmp al, 0xd
jne 0x516713
mov eax, dword [esp + 0x54]
test eax, eax
je 0x516706
mov ebp, esi
mov esi, dword [eax + 4]
mov edx, dword [eax]
lock inc dword [esi]
jle 0x516724
add edx, 8
lea ecx, [esp + 0x24]
push dword [eax + 0xc]
push dword [eax + 8]
push esi
call fcn.00515b68
add esp, 0xc
push 4
pop ecx
call fcn.00514b36
lea eax, [esp + 0x24]
mov esi, ebp
cmp byte [eax], 4
je 0x516713
mov eax, dword [esp + 0x24]
cmp al, 4
je 0x516713
mov ecx, dword [esp + 0x28]
mov edx, edi
mov dword [esi], eax
mov dword [esi + 4], ecx
movzx ecx, bl
call fcn.00514b36
jmp 0x51671c
and dword [esp + 0x28], 0
mov dword [esp + 0x24], 4
movsd xmm0, qword [esp]
movsd qword [esi], xmm0
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x51886e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [0x7f4fe4]
mov esi, ecx
test ebp, ebp
jne 0x518965
push str.api_ms_win_core_synch_l1_2_0.dll
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x5188c0
mov ebx, eax
push str.WaitOnAddress
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x5188c0
mov edi, eax
push str.WakeByAddressSingle
push ebx
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x5188c0
mov ebx, eax
mov dword [esp], 0
jmp 0x518926
push 0x765728
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x518973
mov edi, eax
push str.NtCreateKeyedEvent
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x518973
mov ebp, eax
push str.NtReleaseKeyedEvent
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x518973
mov ebx, eax
push str.NtWaitForKeyedEvent
push edi
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x518973
mov edi, eax
mov dword [esp], ebx
lea eax, [esp + 4]
push 0
push 0
push 0xc0000000
push eax
call ebp
test eax, eax
jne 0x518973
mov ebx, dword [esp + 4]
push 0xc
pop ecx
call fcn.00514028
mov ebp, eax
mov eax, dword [esp]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ebx
xor eax, eax
lock cmpxchg dword [0x7f4fe4], ebp
je 0x518965
cmp dword [ebp], 0
mov edi, eax
je 0x518959
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
pop edx
mov ecx, ebp
call fcn.004533f0
mov ebp, edi
and dword [esi + 4], 0
mov dword [esi], ebp
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5b
pop edx
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users9B6E629E7D13D387.cargo_registry_src_rsproxy.cn_0dccff568467c15bparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
push 0x765830
call fcn.0062fc73
Function at 0x54cc12
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x220
xorps xmm0, xmm0
lea esi, [esp + 0x10]
mov dword [esp + 0xc], ecx
movaps xmmword [esi + 0x30], xmm0
movaps xmmword [esi + 0x20], xmm0
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
call fcn.005585dc
mov edi, eax
push 0x40
pop ebx
mov ecx, eax
mov edx, esi
push ebx
call fcn.0055877f
pop eax
mov ecx, edi
call fcn.005564c3
call fcn.0055b384
call fcn.0055b384
push 0x10
pop eax
lea edx, [esp + 0x50]
mov ecx, eax
mov esi, 0x772cb8
movaps xmm0, xmmword [0x636230]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x772cb8
mov esi, 0x772cb8
and dword [edx + 0x44], 0
and dword [edx + 0x40], 0
mov dword [edx + 0x48], ecx
lea edx, [esp + 0xa0]
mov ecx, eax
mov eax, 0x772cb8
mov edi, edx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xf0]
and dword [edx + 0x44], 0
and dword [edx + 0x40], 0
mov dword [edx + 0x48], eax
movaps xmmword [ecx + 0x70], xmm0
movaps xmmword [ecx + 0x60], xmm0
movaps xmmword [ecx + 0x50], xmm0
movaps xmmword [ecx + 0x40], xmm0
movaps xmmword [ecx + 0x30], xmm0
movaps xmmword [ecx + 0x20], xmm0
movaps xmmword [ecx + 0x10], xmm0
movaps xmmword [ecx], xmm0
mov edx, ebx
push 0x773694
call fcn.00454ef0
pop ecx
cmp edx, ebx
mov esi, eax
mov edi, edx
cmovb ebx, edx
xor eax, eax
cmp ebx, eax
je 0x54ccf8
mov cl, byte [esp + eax + 0x10]
xor byte [esi + eax], cl
inc eax
jmp 0x54ccea
lea ecx, [esp + 0x50]
mov edx, esi
push edi
call fcn.0055b2f3
pop eax
xor eax, eax
cmp edi, eax
je 0x54cd12
xor byte [esi + eax], 0x6a
inc eax
jmp 0x54cd07
lea ecx, [esp + 0xa0]
mov edx, esi
push edi
call fcn.0055b2f3
pop eax
mov ebx, 0xa0
lea edi, [esp + 0x178]
push ebx
lea eax, [esp + 0x54]
push eax
push edi
call fcn.00616830
add esp, 0xc
push 8
pop edx
mov ecx, 0xa8
call fcn.005086b2
xor esi, esi
mov dword [esp + 8], eax
lea ecx, [eax + 8]
inc esi
mov dword [eax], esi
mov dword [eax + 4], esi
push ebx
push edi
push ecx
call fcn.00616830
add esp, 0xc
push 0xc
pop ecx
push 4
pop edx
call fcn.005086b2
mov dword [eax], esi
mov dword [eax + 4], esi
mov ebx, eax
mov dword [eax + 8], 0x54cb68
push 7
pop esi
mov ecx, esi
xor edx, edx
call fcn.005614f0
mov ecx, esi
mov esi, 0x76a6b0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov dword [ecx], esi
mov dword [ecx + 4], 0x76a6e4
and dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0x5c0
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0x76a698
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], 7
mov byte [ecx + 0x24], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5627f2
Capabilities:
Hash data using sha512

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x128
cmp dword [esp + 0x13c], 0x20
mov esi, ecx
jne 0x56294c
mov eax, edx
push 0x20
pop ebp
lea ecx, [esp + 0x44]
mov edx, 0x774b88
push ebp
push eax
call fcn.00562644
pop eax
pop ecx
lea ecx, [esp + 0x48]
mov eax, dword [ecx - 4]
mov edx, dword [eax + 0x48]
push 0x777ce0
call fcn.00560816
pop ecx
lea ebx, [esp + 0x88]
mov edi, edx
mov edx, eax
mov ecx, ebx
push 0x774c74
push ebp
push edi
call fcn.00492c02
add esp, 0xc
cmp dword [ebx + 4], ebp
jne 0x562969
lea edx, [esp + 0x88]
lea edi, [esp + 0x24]
mov eax, dword [edx]
mov ebx, dword [edx + 8]
mov ebp, dword [edx + 0xc]
mov ecx, edi
movsd xmm0, qword [eax + 0x18]
movsd qword [edx + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [edx + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
call fcn.0055e888
call fcn.0055dd98
lea ecx, [esp + 0x88]
mov edx, edi
call fcn.005626cf
movsd xmm1, qword [edi + 0x10]
movsd xmm0, qword [edi + 0x18]
movsd xmm2, qword [edi]
cmp ebp, 0x20
movsd qword [esp + 0x14], xmm1
movsd xmm1, qword [edi + 8]
movsd qword [esp + 0x1c], xmm0
movsd qword [esp + 4], xmm2
movsd qword [esp + 0xc], xmm1
jne 0x56297c
movsd xmm0, qword [ebx + 0x18]
lea ecx, [esi + 0x41]
lea edx, [esp + 0x88]
lea edi, [esi + 1]
movsd qword [esi + 0x39], xmm0
movsd xmm0, qword [ebx + 0x10]
movsd qword [esi + 0x31], xmm0
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
movsd qword [esi + 0x29], xmm1
movsd qword [esi + 0x21], xmm0
call fcn.0056270f
movsd xmm1, qword [esp + 0x14]
movsd xmm0, qword [esp + 0x1c]
movsd xmm2, qword [esp + 4]
xor eax, eax
movsd qword [edi + 0x10], xmm1
movsd xmm1, qword [esp + 0xc]
movsd qword [edi + 0x18], xmm0
movsd qword [edi], xmm2
movsd qword [edi + 8], xmm1
jmp 0x56295c
mov al, 1
mov dword [esi + 4], 0x775b7e
mov dword [esi + 8], 0xf
mov byte [esi], al
add esp, 0x128
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 3]
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x774c84
jmp 0x56298d
lea eax, [esp + 3]
push 0x2b
pop edx
mov ecx, str.called__Result::unwrap____on_an__Err__value
push 0x774c94
push 0x773a64
push eax
call fcn.0062d770
Function at 0x562c3c
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1d0
xorps xmm0, xmm0
lea eax, [esp + 0x90]
mov dword [esp + 0xc], ecx
movaps xmmword [eax - 0x10], xmm0
movaps xmmword [eax - 0x20], xmm0
movaps xmmword [eax - 0x30], xmm0
movaps xmmword [eax - 0x40], xmm0
movaps xmmword [eax - 0x50], xmm0
movaps xmmword [eax - 0x60], xmm0
movaps xmmword [eax - 0x70], xmm0
movaps xmmword [eax - 0x80], xmm0
push 0x10
pop ecx
mov esi, 0x774b88
mov edi, eax
mov ebx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x44], 0
and dword [eax + 0x40], 0
mov dword [eax + 0x48], 0x774b88
and dword [eax + 0x50], 0
push 0x20
pop edi
lea esi, [esp + 0x10]
mov ecx, esi
push edi
call fcn.00560d85
pop eax
mov ecx, esi
mov edx, ebx
push edi
call fcn.00560d85
pop eax
mov edx, dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 0x10]
call fcn.00560d85
pop eax
lea edi, [esp + 0xf0]
push 0xd8
push esi
push edi
call fcn.00616830
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, edi
call fcn.00560f2c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5a8220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x5e6c60
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x7f5068]
test al, al
je 0x5a83f1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x5a826c
cmp eax, 3
jne 0x5a83ea
mov ebx, dword [0x7f506c]
test ebx, ebx
je 0x5a83ea
mov dword [ebp - 0x20], 0
jmp 0x5a8297
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a82c8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a843b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a8290
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a8290
test byte [ebp - 0x20], 1
je 0x5a83ea
mov ebx, dword [0x7f506c]
test ebx, ebx
je 0x5a83ea
mov dword [ebp - 0x20], 0
jmp 0x5a82f7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a8328
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a843b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a82f0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a82f0
test byte [ebp - 0x20], 1
je 0x5a83ea
mov ebx, dword [0x7f506c]
test ebx, ebx
je 0x5a83ea
mov dword [ebp - 0x20], 0
jmp 0x5a8357
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a8388
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a843b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a8350
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a8350
test byte [ebp - 0x20], 1
je 0x5a83ea
mov ebx, dword [0x7f506c]
test ebx, ebx
je 0x5a83ea
mov dword [ebp - 0x20], 0
jmp 0x5a83b7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a83e4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a843b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a83b0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x5a83b0
test byte [ebp - 0x20], 1
jne 0x5a8404
movzx eax, byte [0x7ec400]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x7f506c]
jmp 0x5a840f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x5a83ea
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x5a843b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5a840c
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x5a840c
mov ecx, 0x7868b4
mov dword [ebp - 0x10], 0
call fcn.0062d7f0
ud2
Function at 0x5a9120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x7f316c]
test eax, eax
je 0x5a91d5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x5a914c
cmp dword [eax + 4], 0
mov edi, eax
je 0x5a914c
add edi, 8
jmp 0x5a91d0
mov eax, dword [0x7f316c]
test eax, eax
je 0x5a91e4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x5a91ce
mov esi, eax
test eax, eax
jne 0x5a91a4
movzx eax, byte [0x7f50e0]
xor ecx, ecx
mov edx, 0xc
call fcn.005bfb70
test eax, eax
je 0x5a91ff
mov dword [eax], 0x7f316c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x7f316c]
test eax, eax
je 0x5a91f3
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x5a91d0
test ecx, ecx
je 0x5a91d0
lock dec dword [ecx]
jne 0x5a91d0
call fcn.005a8cb0
jmp 0x5a91d0
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x7f316c
call fcn.006334f0
jmp 0x5a9130
mov ecx, 0x7f316c
call fcn.006334f0
jmp 0x5a915a
mov ecx, 0x7f316c
call fcn.006334f0
jmp 0x5a919c
mov ecx, 4
mov edx, 0xc
call fcn.0062d0a0
int3

Function at 0x5a96e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x7f317c]
test eax, eax
je 0x5a9761
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x5a96ff
cmp byte [eax + 4], 0
mov esi, eax
jne 0x5a9756
mov eax, dword [0x7f317c]
test eax, eax
je 0x5a9770
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x5a975b
mov esi, eax
test eax, eax
jne 0x5a9750
movzx eax, byte [0x7f50e0]
xor ecx, ecx
mov edx, 8
call fcn.005bfb70
test eax, eax
je 0x5a9788
mov dword [eax], 0x7f317c
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x7f317c]
test eax, eax
je 0x5a977c
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x5a975d
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x7f317c
call fcn.006334f0
jmp 0x5a96eb
mov ecx, 0x7f317c
call fcn.006334f0
jmp 0x5a9709
mov ecx, 0x7f317c
call fcn.006334f0
jmp 0x5a9748
mov ecx, 4
mov edx, 8
call fcn.0062d0a0
int3
Function at 0x5a9e50
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x5a9ea4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x5a9ec7
test eax, eax
js 0x5a9eb3
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x5a9ebf
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x786118
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.005a87f0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.005a8920
mov ecx, 7
int 0x29
ud2
Function at 0x5aa520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x7f315c]
test eax, eax
je 0x5aa5b5
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x5aa546
cmp dword [eax + 4], 0
je 0x5aa546
add eax, 8
pop esi
ret
mov eax, dword [0x7f315c]
test eax, eax
je 0x5aa5c4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x5aa5b1
mov esi, eax
test eax, eax
jne 0x5aa59a
movzx eax, byte [0x7f50e0]
xor ecx, ecx
mov edx, 0x10
call fcn.005bfb70
test eax, eax
je 0x5aa5dc
mov dword [eax], 0x7f315c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x7f315c]
test eax, eax
je 0x5aa5d0
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x7f315c
call fcn.006334f0
jmp 0x5aa52f
mov ecx, 0x7f315c
call fcn.006334f0
jmp 0x5aa550
mov ecx, 0x7f315c
call fcn.006334f0
jmp 0x5aa592
mov ecx, 4
mov edx, 0x10
call fcn.0062d0a0
int3