joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7457c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x34], str.USERNAME
mov dword [esp + 0x38], 8
sub esp, 0xc
movsd xmm0, qword [esp + 0x40]
movsd qword [esp + 4], xmm0
lea edi, [esp + 0x2c]
mov dword [esp], edi
call fcn.00745580
add esp, 0xc
cmp byte [esp + 0x2c], 0
je 0x745832
movzx eax, byte [esp + 0x20]
test al, 1
je 0x74582c
mov eax, dword [esp + 0x24]
test eax, eax
je 0x745832
mov ecx, esi
push edi
call fcn.0051f860
jmp 0x7458df
shr eax, 1
test eax, eax
jne 0x74581f
lea edi, [esp + 0x3e]
push 0x202
push 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x202
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x7458a2
cmp dword [esp + 0xc], 0
je 0x7458a2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004bc1c0
add esp, 8
test al, al
je 0x7458b8
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0x10]
movsd qword [esi], xmm0
jmp 0x7458df
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
jmp 0x7458df
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
test byte [esp + 0x10], 1
je 0x7458df
push dword [esp + 0x18]
call fcn.0051c570
add esp, 4
cmp byte [esp + 0x2c], 0
je 0x7458f9
test byte [esp + 0x20], 1
je 0x7458f9
push dword [esp + 0x28]
call fcn.0051c570
add esp, 4
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x758120
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x104
mov edi, dword [esp + 0x118]
mov ebx, esp
push 0x104
push 0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x758164
push str.program_assertion_failed___could_not_get_system_directory
jmp 0x758185
mov ebp, dword [esp + 0x11c]
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, esi
add eax, 6
cmp eax, 0x104
jb 0x758199
push str.program_assertion_failed___library_path_buffer_overflow
push str.load_system_library
push 1
push edi
call fcn.005fe840
add esp, 0x10
xor eax, eax
jmp 0x7581b2
lea eax, [esp + esi]
push ebp
push str._s.dll
push eax
call fcn.007580d0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x104
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7581c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x75821e
movzx edx, byte [eax]
test dl, dl
je 0x758225
inc eax
mov ecx, 0x1505
nop word [eax + eax]
movsx edx, dl
mov esi, ecx
shl esi, 5
add ecx, esi
add ecx, edx
movzx edx, byte [eax]
inc eax
test dl, dl
jne 0x7581e0
test ecx, ecx
je 0x75822c
mov edx, 0xc0906d
mov eax, ecx
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
sub ecx, eax
mov edi, 1
cmovne edi, ecx
jmp 0x758231
xor esi, esi
jmp 0x758377
mov edi, 0x114
jmp 0x758231
mov edi, 1
push 0x9b75a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x9b75bc]
mov ecx, dword [eax + edi*8]
mov esi, edi
test ecx, ecx
mov edx, edi
je 0x7582fd
mov esi, dword [eax + edx*8 + 4]
cmp ecx, edx
mov edi, dword [esp + 0x18]
mov ebx, edx
jne 0x758270
push esi
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x75836a
push esi
push edi
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.005fe840
add esp, 0x18
movzx eax, bx
imul eax, eax, 0x80a1
shr eax, 0x19
imul eax, eax, 0x3fb
neg eax
add eax, ebx
inc eax
movzx edi, ax
mov ebp, dword [0x9b75bc]
mov esi, ebx
mov edx, ebx
mov dword [esp], edi
jmp 0x7582c4
test ebx, ebx
je 0x7582fd
lea eax, [esi + 0x3fd]
cmp esi, edi
cmovbe esi, eax
sub esi, edi
cmp esi, edx
je 0x7582fb
mov ebx, dword [ebp + esi*8]
cmp ebx, edx
jne 0x7582c0
push dword [ebp + esi*8 + 4]
push dword [esp + 0x1c]
mov edi, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov edx, edi
mov edi, dword [esp + 8]
add esp, 8
test eax, eax
jne 0x7582c0
jmp 0x75836c
mov esi, edx
cmp dword [0x9b75c0], 0x3fd
jb 0x758328
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.005fe840
add esp, 0x14
xor esi, esi
jmp 0x75836c
mov edi, edx
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup_1]
add esp, 4
mov ecx, dword [0x9b75bc]
mov dword [ecx + esi*8 + 4], eax
test eax, eax
je 0x758350
mov dword [ecx + esi*8], edi
inc dword [0x9b75c0]
jmp 0x75836c
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push 0
call fcn.005fe840
add esp, 0x10
xor esi, esi
jmp 0x75836c
mov esi, ebx
push 0x9b75a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x759a40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x18]
mov dword [esp], 0
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 4]
push dword [eax + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, 0xfffffffa
test eax, eax
jne 0x759b61
push 0
call fcn.00602d70
mov edi, 0xfffffff5
test eax, eax
je 0x759b61
mov esi, eax
movzx ebp, word [esp + 0x30]
lea eax, [ebp + 8]
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je case.0x759b4b.2
mov ebx, eax
mov edi, dword [esp + 0x34]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x24]
movzx edx, byte [esp + 0x20]
mov dh, byte [esp + 0x1c]
mov byte [ebx], dh
mov byte [ebx + 1], dl
mov word [ebx + 2], cx
mov word [ebx + 4], ax
movzx eax, word [esp + 0x30]
mov word [ebx + 6], ax
test dh, dh
js 0x759ae4
mov eax, ebx
add eax, 8
push ebp
push dword [esp + 0x30]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov ebp, dword [esp + 0x18]
mov dword [esi], ebp
mov word [esi + 5], 0
mov dword [esi + 8], edi
mov dword [esi + 0x20], ebx
movzx eax, word [ebx + 6]
add eax, 8
mov dword [esi + 0x10], eax
mov eax, esp
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], 0x759bb0
mov byte [esi + 4], 2
push esi
call fcn.00602e50
test eax, eax
js 0x759b59
mov ecx, esi
call fcn.00759bf0
cmp byte [esp + 0x1c], 0
jns 0x759b3e
mov eax, dword [esi + 0x20]
add eax, 8
push dword [esi + 0x14]
push eax
push dword [esp + 0x34]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0xc]
cmp eax, 6
ja case.default.0x759b4b
mov edi, 0xfffffff9
jmp dword [eax*4 + 0x929008]
mov edi, 0xffffffff
jmp case.0x759b4b.2
mov edi, eax
push esi
call fcn.00602dd0
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x24]
push eax
push str.unrecognised_status_code__d
push str.libusb_control_transfer
push 2
push dword [ecx + 4]
call fcn.005fe840
add esp, 0x14
mov edi, 0xffffff9d
jmp case.0x759b4b.2
mov edi, dword [esi + 0x14]
jmp case.0x759b4b.2
mov edi, 0xfffffff7
jmp case.0x759b4b.2
mov edi, 0xfffffffc
jmp case.0x759b4b.2
mov edi, 0xfffffff8
jmp case.0x759b4b.2

Function at 0x759eb0
Capabilities:
Print debug messages

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
mov dword [esp], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
sub esp, 0x1c
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
movaps xmm0, xmmword [0x929110]
movups xmmword [esp], xmm0
mov dword [esp + 0x14], 0
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
add esp, 0x1c
inc eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x759f21
mov edi, eax
push dword [esp]
push ebx
push eax
call fcn.00761bb0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x75a2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov ebx, dword [esp + 0x30]
xor ecx, ecx
test ebx, ebx
je 0x75a3dd
mov ebp, edx
jmp 0x75a2e4
test ebx, ebx
je 0x75a33a
mov dword [esp + 8], ebx
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x75a320
je 0x75a341
mov eax, ebx
sub eax, edi
jl 0x75a341
add ebp, edi
mov ebx, eax
jmp 0x75a2e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
jne 0x75a387
mov dword [esp + 4], str.dnssd_clientstub_read_all:_EINTR_continue
call fcn.00759eb0
jmp 0x75a2e0
xor ecx, ecx
jmp 0x75a3dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0xffffffff
cmp eax, 0x2733
je 0x75a3dd
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 0x18], 0x92956d
mov dword [esp + 0x14], 0
mov dword [esp + 4], str.dnssd_clientstub_read_all__d__failed__ld__ld__d__s
call fcn.00759eb0
mov ecx, 0xffffffff
jmp 0x75a3dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x75a3cb
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebp
mov ecx, ebp
mov ebp, eax
call ecx
mov dword [esp], eax
call fcn.007eea30
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str.dnssd_clientstub_read_all__d__failed__ld__ld__d__s
call fcn.00759eb0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
cmp eax, 0x2733
sete cl
not ecx
mov eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x786ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x786d4e
cmp byte [ebx], 0
je 0x786d18
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x786d30
test al, 0x10
je 0x786d18
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x786c04
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
mov esi, eax
je 0x786d3f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x786c93
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x786c93
cmp al, 0x5c
je 0x786c93
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x786c95
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x786d10
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x786d10
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x786d10
Function at 0x7893ff
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x789412
jmp 0x789546
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.007fda44
cmp eax, 1
jne 0x78953e
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x78948a
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x78949c
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x7894b6
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x7894c4
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x7894f4
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x78950b
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x7894f0
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x789529
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x78a4d2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x78a347
mov dword [esp], 0x9b7754
call fcn.00789a99
mov eax, dword [0x99d1e8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x78a519
mov eax, dword [ebp - 0x20]
jmp 0x78a664
call fcn.00789308
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x78a530
cmp dword [ebp - 0x20], 0
jne 0x78a53a
mov eax, 0
jmp 0x78a664
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.007893ff
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x78a60c
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x99d1e8]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x78a661
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x78a728
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0078a4d2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0078a36a
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x78a781
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x99d1e8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x78a8ab
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x78a813
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x78a7d0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0078921c
mov dword [ebp - 0x10], 0
mov eax, dword [0x99d1e8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x78a8ab
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x78a843
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x78a8ab
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0078921c
mov dword [ebp - 0x10], 0
mov eax, dword [0x99d1e8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x7a69e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x1b0
xorps xmm0, xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
lea esi, [esp + 0x30]
push esi
push 0x20
push dword [ebp + 0x10]
call sym.adb.exe_SHA512
add esp, 0xc
and byte [esp + 0x30], 0xf8
movzx eax, byte [esp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x4f], al
xorps xmm0, xmm0
movaps xmmword [esp + 0x190], xmm0
movaps xmmword [esp + 0x180], xmm0
movaps xmmword [esp + 0x170], xmm0
movaps xmmword [esp + 0x160], xmm0
movaps xmmword [esp + 0x150], xmm0
movaps xmmword [esp + 0x140], xmm0
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
lea edi, [esp + 0x100]
push 0x932608
push esi
push edi
call fcn.007a3700
add esp, 0xc
xorps xmm0, xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf0], 0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc0], 0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
mov dword [esp + 0x94], 0
mov dword [esp + 0x90], 0
movsd xmm0, qword [esp + 0x170]
movsd qword [esp + 0x20], xmm0
movaps xmm0, xmmword [esp + 0x150]
movaps xmm1, xmmword [esp + 0x160]
movaps xmmword [esp + 0x10], xmm1
movaps xmmword [esp], xmm0
lea esi, [esp + 0xd0]
mov edx, esp
mov ecx, esi
call fcn.007accb0
lea ebx, [esp + 0xa0]
mov ecx, ebx
mov edx, edi
push esi
call fcn.007ad050
add esp, 4
lea edx, [esp + 0x128]
lea edi, [esp + 0x70]
mov ecx, edi
push esi
call fcn.007ad050
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.007a1e10
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov ecx, esp
mov edx, ebx
call fcn.007a1e10
movzx eax, byte [esp]
shl al, 7
xor byte [esi + 0x1f], al
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov eax, dword [ebp + 0xc]
movups xmmword [eax + 0x10], xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x30], xmm1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x7abf30
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp], xmm0
and byte [esp], 0xf8
movups xmmword [esp + 0x10], xmm1
movzx eax, byte [esp + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x1f], al
xorps xmm0, xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
mov eax, esp
lea ecx, [esp + 0x50]
push 0x932608
push eax
push ecx
call fcn.007a3700
add esp, 0xc
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
movdqa xmm1, xmmword [esp + 0xa0]
movdqu xmm4, xmmword [esp + 0x78]
movdqu xmm0, xmmword [esp + 0x88]
movdqa xmm2, xmm4
paddd xmm2, xmm1
movdqu xmmword [esp + 0x118], xmm2
movdqa xmm3, xmmword [esp + 0xb0]
movdqa xmm2, xmm0
paddd xmm2, xmm3
movdqu xmmword [esp + 0x128], xmm2
movq xmm2, qword [esp + 0xc0]
movq xmm5, qword [esp + 0x98]
movdqa xmm6, xmm5
paddd xmm6, xmm2
movq qword [esp + 0x138], xmm6
psubd xmm1, xmm4
paddd xmm1, xmmword [0x932530]
movdqu xmmword [esp + 0xf0], xmm1
psubd xmm3, xmm0
paddd xmm3, xmmword [0x932540]
movdqu xmmword [esp + 0x100], xmm3
psubd xmm2, xmm5
paddd xmm2, xmmword [0x932550]
movq qword [esp + 0x110], xmm2
lea edi, [esp + 0x20]
lea edx, [esp + 0xf0]
mov ecx, edi
call fcn.007accb0
lea edx, [esp + 0x118]
mov ecx, edi
push edi
call fcn.007ad050
add esp, 4
mov ecx, esi
mov edx, edi
call fcn.007a1e10
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret