joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae820
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
test esi, esi
setne dl
test ecx, ecx
je 0x4ae89d
cmp dword [ecx + 0xc], 0
mov eax, 0xffffffff
jne 0x4ae9df
mov eax, dword [ecx + 4]
xor ebx, ebx
mov bl, dl
mov ebp, dword [ecx]
mov dword [esp], ebx
cmp eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
cmovb ebx, eax
test ebx, ebx
je 0x4ae8a7
xor eax, eax
mov edx, esi
nop dword [eax + eax]
mov ecx, dword [ebp]
mov esi, ecx
mov edi, ecx
sub esi, edx
xor edi, edx
xor esi, ecx
or esi, edi
xor esi, ecx
mov ecx, edi
dec edi
sar esi, 0x1f
xor ecx, 0x80000000
or esi, 1
test edi, ecx
cmovns eax, esi
add ebp, 4
dec ebx
jne 0x4ae870
jmp 0x4ae8ab
mov eax, 1
jmp 0x4ae9df
xor eax, eax
mov edx, esi
mov ecx, dword [esp + 8]
mov ebx, dword [esp]
mov ebp, ecx
sub ebp, ebx
jae 0x4ae8c8
sub ebx, ecx
xor edi, edi
cmp ebx, 7
ja 0x4ae8dd
mov esi, edx
mov edx, dword [esp]
jmp 0x4ae92e
jbe 0x4ae9df
xor esi, esi
cmp ebp, 7
ja 0x4ae948
mov edi, dword [esp]
jmp 0x4ae9b4
mov edi, ebx
mov esi, edx
pxor xmm1, xmm1
and edi, 0xfffffff8
movd xmm0, esi
pshufd xmm2, xmm0, 0
add ecx, edi
mov edx, edi
pxor xmm0, xmm0
nop dword [eax]
por xmm0, xmm2
por xmm1, xmm2
add edi, 0xfffffff8
jne 0x4ae900
por xmm1, xmm0
cmp ebx, edx
mov edx, dword [esp]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x4ae935
sub edx, ecx
or edi, esi
dec edx
jne 0x4ae930
mov ecx, edi
dec edi
not ecx
and edi, ecx
sar edi, 0x1f
not edi
or eax, edi
jmp 0x4ae9df
mov edx, dword [esp]
mov edi, dword [esp + 4]
mov ebx, ebp
pxor xmm0, xmm0
xor esi, esi
pxor xmm1, xmm1
and ebx, 0xfffffff8
lea ecx, [ebx + edx]
mov dword [esp + 0xc], ecx
nop word cs:[eax + eax]
nop
mov ecx, esi
add esi, 8
or ecx, edx
cmp ebx, esi
movdqu xmm2, xmmword [edi + ecx*4]
movdqu xmm3, xmmword [edi + ecx*4 + 0x10]
por xmm0, xmm2
por xmm1, xmm3
jne 0x4ae970
por xmm1, xmm0
mov ecx, dword [esp + 8]
mov edi, dword [esp + 0xc]
cmp ebp, ebx
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd esi, xmm1
je 0x4ae9c8
mov edx, dword [esp + 4]
sub ecx, edi
lea edx, [edx + edi*4]
nop dword [eax]
or esi, dword [edx]
add edx, 4
dec ecx
jne 0x4ae9c0
mov ecx, esi
dec esi
not ecx
and esi, ecx
sar esi, 0x1f
mov ecx, esi
and esi, eax
not ecx
and ecx, 1
or ecx, esi
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aec00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor edi, edi
mov ebx, dword [eax + 4]
mov edx, dword [ecx + 4]
mov eax, ebx
sub eax, edx
mov dword [esp], eax
jge 0x4aec99
mov eax, dword [esp + 0x20]
mov ecx, edx
xor edi, edi
mov esi, ebx
sub ecx, ebx
cmp ecx, 7
mov ebp, dword [eax]
jbe 0x4aec90
mov eax, ecx
lea edi, [ebp + ebx*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and eax, 0xfffffff8
lea esi, [ebx + eax]
mov dword [esp + 4], eax
nop dword [eax + eax]
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add eax, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4aec50
por xmm1, xmm0
cmp ecx, dword [esp + 4]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x4aec99
nop dword [eax]
or edi, dword [ebp + esi*4]
inc esi
cmp esi, edx
jl 0x4aec90
cmp edx, ebx
jge 0x4aed18
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp]
mov esi, dword [eax]
cmp ecx, 7
ja 0x4aecaf
mov ebp, edx
jmp 0x4aed08
and ecx, 0xfffffff8
movd xmm1, edi
lea edi, [esi + edx*4 + 0x10]
pxor xmm0, xmm0
lea ebp, [edx + ecx]
mov eax, ecx
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add eax, 0xfffffff8
por xmm1, xmm2
por xmm0, xmm3
jne 0x4aecd0
por xmm0, xmm1
cmp dword [esp], ecx
pshufd xmm1, xmm0, 0x4e
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd edi, xmm0
je 0x4aed18
mov eax, ebx
lea ecx, [esi + ebp*4]
sub eax, ebp
nop
or edi, dword [ecx]
add ecx, 4
dec eax
jne 0x4aed10
mov ebp, dword [esp + 0x1c]
cmp ebx, edx
cmovle edx, ebx
test edx, edx
jle 0x4aed7e
mov eax, dword [esp + 0x20]
mov esi, dword [ebp]
xor ebx, ebx
cmp edx, 3
mov eax, dword [eax]
jbe 0x4aed71
mov ebx, edx
movd xmm0, edi
xor ecx, ecx
and ebx, 0xfffffffc
movdqu xmm1, xmmword [esi + ecx*4]
movdqu xmm2, xmmword [eax + ecx*4]
add ecx, 4
cmp ebx, ecx
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x4aed40
pshufd xmm1, xmm0, 0x4e
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd edi, xmm0
jmp 0x4aed7a
mov ecx, dword [eax + ebx*4]
xor ecx, dword [esi + ebx*4]
inc ebx
or edi, ecx
cmp edx, ebx
jne 0x4aed71
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0xc]
xor eax, eax
xor ecx, dword [ebp + 0xc]
or ecx, edi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4b92e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [edx + 4]
test eax, eax
je 0x4b9383
mov ebp, ecx
mov ecx, dword [edx]
mov edi, edx
xor edx, edx
cmp eax, 8
mov esi, 0
jb 0x4b9357
mov edx, eax
lea esi, [ecx + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and edx, 0xfffffff8
mov ebx, edx
nop word cs:[eax + eax]
movdqu xmm2, xmmword [esi - 0x10]
movdqu xmm3, xmmword [esi]
add esi, 0x20
add ebx, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4b9320
por xmm1, xmm0
cmp eax, edx
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd esi, xmm1
je 0x4b9368
mov ebx, eax
sub ebx, edx
lea edx, [ecx + edx*4]
nop
or esi, dword [edx]
add edx, 4
dec ebx
jne 0x4b9360
test esi, esi
je 0x4b9383
test eax, eax
jle 0x4b9375
test byte [ecx], 1
jne 0x4b93a5
push 0xa9
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x68
jmp 0x4b938f
push 0xa5
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x69
push 0
push 3
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [edi + 0xc], 0
je 0x4b93b9
push 0xad
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x6d
jmp 0x4b938f
lea ebx, [ebp + 0x14]
cmp ebx, edi
je 0x4b93f7
push eax
push ebx
call fcn.004acc80
add esp, 8
test eax, eax
je 0x4b9446
mov eax, dword [edi + 4]
lea ecx, [eax*4]
test ecx, ecx
je 0x4b93ec
push ecx
push dword [edi]
push dword [ebx]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 4]
mov dword [ebp + 0x18], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 0x20], ecx
jmp 0x4b93fa
mov eax, dword [ebp + 0x18]
mov ecx, eax
mov edx, eax
mov dword [esp + 4], ebp
sar ecx, 0x1f
and ecx, eax
nop word [eax + eax]
test edx, edx
jle 0x4b9430
mov esi, dword [ebx]
cmp dword [esi + edx*4 - 4], 0
lea edx, [edx - 1]
je 0x4b9410
inc edx
mov dword [ebp + 0x18], edx
cmp edx, 2
mov eax, dword [esi]
jl 0x4b9457
mov ecx, dword [esi + 4]
jmp 0x4b9459
test eax, eax
mov dword [ebp + 0x18], ecx
js 0x4b943e
mov dword [ebp + 0x20], 0
mov eax, dword [ebx]
xor ecx, ecx
mov eax, dword [eax]
jmp 0x4b9459
push 0xb3
push str.external_boringssl_src_crypto_fipsmodule_bn_montgomery.c
push 0x44
jmp 0x4b938f
xor ecx, ecx
mov esi, 1
xor edi, edi
xor ebx, ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x40
mov dword [esp], 0
mov dword [esp + 0x10], ecx
mov ebp, esi
nop dword [eax + eax]
and ebp, 1
mov edx, 0
mov eax, ecx
neg ebp
sbb edx, edx
and ebp, dword [esp + 8]
and eax, edx
mov ecx, eax
and eax, edi
xor ecx, edi
mov edi, ebp
and ebp, esi
xor edi, esi
shrd edi, ecx, 1
shr ecx, 1
add ebp, edi
adc eax, ecx
shrd dword [esp], ebx, 1
and edx, 0x80000000
shr ebx, 1
mov ecx, dword [esp + 0x10]
mov esi, ebp
or ebx, edx
dec dword [esp + 0xc]
mov edi, eax
jne 0x4b9480
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
mov eax, 1
jmp 0x4b939d
Function at 0x4c6e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x20]
cmp dword [edi + 0xc], 0
je 0x4c6eb9
push 0x13c
push str.external_boringssl_src_crypto_fipsmodule_bn_bn.c
push 0x6d
push 0
push 3
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
push 0x1c
push str.external_boringssl_src_crypto_fipsmodule_ec_scalar.c
push 0x85
push 0
push 0xf
call sym.fastboot.exe_ERR_put_error
add esp, 0x14
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x18]
mov ebx, dword [edi + 4]
mov eax, dword [esi + 0xc]
mov ebp, ebx
sub ebp, eax
jbe 0x4c6f73
mov edx, dword [edi]
xor ecx, ecx
cmp ebp, 8
mov edi, eax
jb 0x4c6f3e
mov ecx, edx
mov edx, ebp
pxor xmm0, xmm0
pxor xmm1, xmm1
and edx, 0xfffffff8
mov dword [esp], ecx
lea ecx, [ecx + eax*4 + 0x10]
lea edi, [eax + edx]
mov esi, edx
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm2, xmmword [ecx - 0x10]
movdqu xmm3, xmmword [ecx]
add ecx, 0x20
add esi, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4c6f00
por xmm1, xmm0
cmp ebp, edx
mov esi, dword [esp + 0x18]
mov edx, dword [esp]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd ecx, xmm1
je 0x4c6f58
sub ebx, edi
lea edx, [edx + edi*4]
nop word cs:[eax + eax]
nop dword [eax]
or ecx, dword [edx]
add edx, 4
dec ebx
jne 0x4c6f50
mov edi, dword [esp + 0x20]
test ecx, ecx
mov ebx, eax
je 0x4c6f73
push 0x143
push str.external_boringssl_src_crypto_fipsmodule_bn_bn.c
push 0x66
jmp 0x4c6e8b
mov ecx, dword [esp + 0x1c]
shl eax, 2
test eax, eax
je 0x4c6f8e
push eax
push 0
push ecx
mov ebp, ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, ebp
add esp, 0xc
shl ebx, 2
test ebx, ebx
je 0x4c6fa5
push ebx
push dword [edi]
push ecx
mov edi, ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, edi
add esp, 0xc
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4c6e97
mov eax, dword [esi + 8]
xor esi, esi
mov dword [esp], eax
mov eax, ecx
xor ecx, ecx
nop dword [eax]
mov edi, dword [esp]
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
mov edi, ebp
sub edi, ebx
xor ebx, ebp
xor edi, ebp
or edi, ebx
xor edi, ebp
mov ebp, ebx
dec ebx
sar edi, 0x1f
xor ebp, 0x80000000
or edi, 1
test ebx, ebp
cmovns ecx, edi
inc esi
cmp edx, esi
jne 0x4c6fc0
test ecx, ecx
jns 0x4c6e97
mov eax, 1
jmp 0x4c6eb1
Function at 0x4d57a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov ecx, dword [esp + 0x4c]
xor eax, eax
cmp ecx, 0x30
ja 0x4d58e7
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
test ecx, ecx
movsd xmm0, qword [eax + 0x28]
movsd qword [esp + 0x28], xmm0
movsd xmm0, qword [eax + 0x20]
movsd qword [esp + 0x20], xmm0
movsd xmm0, qword [eax + 0x18]
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [esp + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
je 0x4d585c
mov eax, dword [esp + 0x48]
xor edx, edx
cmp ecx, 0x1f
jbe 0x4d5850
mov edx, ecx
xor edi, edi
and edx, 0xffffffe0
nop word cs:[eax + eax]
nop dword [eax]
movups xmm0, xmmword [eax + edi]
movups xmm2, xmmword [esp + edi]
movups xmm1, xmmword [eax + edi + 0x10]
movups xmm3, xmmword [esp + edi + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + edi], xmm2
movups xmmword [esp + edi + 0x10], xmm3
add edi, 0x20
cmp edx, edi
jne 0x4d5820
cmp edx, ecx
je 0x4d585c
nop dword [eax]
movzx ebx, byte [eax + edx]
xor byte [esp + edx], bl
inc edx
cmp ecx, edx
jne 0x4d5850
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
mov eax, esp
xorps xmm0, xmmword [0x532c20]
xorps xmm1, xmmword [str._M_kn_aN]
movups xmmword [esp], xmm0
movups xmmword [esp + 0x10], xmm1
movups xmm0, xmmword [esp + 0x20]
xorps xmm0, xmmword [0x532c40]
movups xmmword [esp + 0x20], xmm0
push esi
push 0x100
push eax
call fcn.004a4a40
add esp, 0xc
mov dword [esi + 0xf4], fcn.004a38e0
mov dword [esi + 0xf8], 0x4a8190
mov eax, 1
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
movsd qword [esi + 0xfc], xmm0
movsd qword [esi + 0x104], xmm1
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
add esp, 0x30
pop esi
pop edi
pop ebx
ret
Function at 0x4d58f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
test ecx, ecx
je 0x4d59cc
xor eax, eax
cmp ecx, 0x30
ja 0x4d5acc
movsd xmm1, qword [esi + 0x28]
mov eax, dword [ebp + 0x10]
xor edx, edx
cmp ecx, 0x20
movsd qword [esp + 0x28], xmm1
movsd xmm1, qword [esi + 0x20]
movsd qword [esp + 0x20], xmm1
movsd xmm1, qword [esi + 0x18]
movsd qword [esp + 0x18], xmm1
movsd xmm1, qword [esi + 0x10]
movsd qword [esp + 0x10], xmm1
movsd xmm1, qword [esi]
movsd xmm2, qword [esi + 8]
movsd qword [esp + 8], xmm2
movsd qword [esp], xmm1
jb 0x4d59b0
mov edx, ecx
xor esi, esi
and edx, 0xffffffe0
nop word [eax + eax]
movups xmm1, xmmword [eax + esi]
movups xmm3, xmmword [esp + esi]
movups xmm2, xmmword [eax + esi + 0x10]
movups xmm4, xmmword [esp + esi + 0x10]
xorps xmm3, xmm1
xorps xmm4, xmm2
movups xmmword [esp + esi], xmm3
movups xmmword [esp + esi + 0x10], xmm4
add esi, 0x20
cmp edx, esi
jne 0x4d5980
cmp edx, ecx
jne 0x4d59b0
mov esi, esp
jmp 0x4d59cc
mov esi, esp
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [eax + edx]
xor byte [esp + edx], bl
inc edx
cmp ecx, edx
jne 0x4d59c0
mov edi, dword [ebp + 8]
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
mov eax, dword [edi + 0x108]
lea ebx, [edi + 0xfc]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
lea eax, [esp + 0x30]
push edi
push eax
push ebx
call dword [edi + 0xf4]
add esp, 0xc
mov eax, dword [edi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
push edi
lea eax, [esp + 0x44]
push eax
push ebx
call dword [edi + 0xf4]
add esp, 0xc
mov eax, dword [edi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [edi + 0x108], eax
push edi
lea eax, [esp + 0x54]
push eax
push ebx
call dword [edi + 0xf4]
add esp, 0xc
movups xmm0, xmmword [esi]
xorps xmm0, xmmword [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [esi + 0x10]
xorps xmm0, xmmword [esp + 0x40]
movaps xmmword [esp + 0x40], xmm0
movups xmm0, xmmword [esi + 0x20]
xorps xmm0, xmmword [esp + 0x50]
movaps xmmword [esp + 0x50], xmm0
push edi
push 0x100
lea eax, [esp + 0x38]
push eax
call fcn.004a4a40
add esp, 0xc
mov dword [edi + 0xf4], fcn.004a38e0
mov dword [edi + 0xf8], 0x4a8190
mov eax, 1
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
movsd qword [edi + 0xfc], xmm0
movsd qword [edi + 0x104], xmm1
mov dword [edi + 0x114], 0
mov dword [edi + 0x110], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4d5ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
xor eax, eax
cmp ebx, 0x30
ja 0x4d5c23
xorps xmm0, xmm0
mov esi, ecx
mov edi, edx
add ecx, 0xfc
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esp + 0x10]
push esi
push eax
push ecx
call dword [esi + 0xf4]
add esp, 0xc
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
push esi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
call dword [esi + 0xf4]
add esp, 0xc
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
push esi
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x14]
call dword [esi + 0xf4]
add esp, 0xc
test ebx, ebx
je 0x4d5bdd
xor eax, eax
cmp ebx, 0x1f
jbe 0x4d5bd0
mov eax, ebx
xor ecx, ecx
and eax, 0xffffffe0
nop word cs:[eax + eax]
nop
movups xmm0, xmmword [edi + ecx]
movups xmm2, xmmword [esp + ecx + 0x10]
movups xmm1, xmmword [edi + ecx + 0x10]
movups xmm3, xmmword [esp + ecx + 0x20]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [esp + ecx + 0x10], xmm2
movups xmmword [esp + ecx + 0x20], xmm3
add ecx, 0x20
cmp eax, ecx
jne 0x4d5ba0
cmp eax, ebx
je 0x4d5bdd
nop
movzx ecx, byte [edi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp ebx, eax
jne 0x4d5bd0
push esi
push 0x100
lea eax, [esp + 0x18]
push eax
call fcn.004a4a40
add esp, 0xc
mov dword [esi + 0xf4], fcn.004a38e0
mov dword [esi + 0xf8], 0x4a8190
lea eax, [esp + 0x30]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0xc]
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4eee53
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x4eee66
jmp 0x4eef9a
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.005116f8
cmp eax, 1
jne 0x4eef92
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x4eeede
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x4eeef0
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x4eef0a
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x4eef18
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x4eef48
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x4eef5f
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x4eef44
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x4eef7d
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4eff26
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4efd9b
mov dword [esp], 0x54b4d4
call fcn.004ef4ed
mov eax, dword [0x549418]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4eff6d
mov eax, dword [ebp - 0x20]
jmp 0x4f00b8
call fcn.004eed5c
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4eff84
cmp dword [ebp - 0x20], 0
jne 0x4eff8e
mov eax, 0
jmp 0x4f00b8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004eee53
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4f0060
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x549418]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4f00b5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4f017c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004eff26
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.004efdbe
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4f01d5
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x549418]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4f02ff
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4f0267
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4f0224
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004eec70
mov dword [ebp - 0x10], 0
mov eax, dword [0x549418]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4f02ff
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4f0297
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4f02ff
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004eec70
mov dword [ebp - 0x10], 0
mov eax, dword [0x549418]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax