joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c0d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.00655180
mov eax, dword [0x716f80]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
mov bl, byte [esi]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov byte [esp + 0xf], bl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
push edi
test bl, 0x40
jne 0x51c125
push eax
lea eax, [esi + 0x10]
push eax
push esi
call ecx
add esp, 0xc
movzx eax, bl
mov edx, 0xf
and eax, 7
xor ecx, ecx
sub edx, eax
mov dword [esp + 0x24], eax
mov byte [esi], al
cmp edx, 0xf
jae 0x51c153
nop
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x51c140
movzx eax, byte [esi + 0xf]
mov edi, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, edi
je 0x51c17b
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0065469c
add esp, 0x2c
ret
mov ebx, edi
shr ebx, 4
test ebx, ebx
je 0x51c1b6
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x1c]
push ebx
push dword [esp + 0x28]
push ebp
call dword [esp + 0x38]
shl ebx, 4
add esp, 0x18
add dword [esp + 0x18], ebx
add ebp, ebx
sub edi, ebx
je 0x51c20e
shr ebx, 4
push ebx
push esi
call fcn.0051ca30
add esp, 8
jmp 0x51c1ba
test edi, edi
je 0x51c20e
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push ebx
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
test edi, edi
je 0x51c1fd
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x28]
mov eax, ecx
lea edx, [esi + 0x10]
sub ebp, eax
sub ebx, eax
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [ebx + ecx - 1], al
xor byte [edx - 1], al
sub edi, 1
jne 0x51c1e1
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
lea eax, [esi + 0x10]
push ebx
push eax
push eax
call ebp
add esp, 0xc
jmp 0x51c216
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov ecx, 0xf
sub ecx, dword [esp + 0x24]
cmp ecx, 0x10
jae 0x51c23a
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.00656e20
add esp, 0xc
push ebx
lea eax, [esp + 0x2c]
push eax
push esi
call ebp
mov eax, dword [esp + 0x34]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x2c]
xor dword [esi + 0x14], eax
mov eax, dword [esp + 0x30]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x38]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065469c
add esp, 0x2c
ret
Function at 0x51e010
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.00655180
mov edx, dword [esp + 0x1c]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
test edx, edx
je 0x51e164
push ebx
push edi
mov edi, dword [esp + 0x30]
cmp edx, 8
jb 0x51e147
lea eax, [ebp - 1]
lea ebx, [edi - 1]
add eax, edx
add ebx, edx
cmp edi, eax
ja 0x51e057
cmp ebx, ebp
jae 0x51e147
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x51e068
cmp ebx, esi
jae 0x51e147
cmp edx, 0x40
jb 0x51e108
mov ebx, edx
mov eax, edx
and ebx, 0x3f
mov edx, edi
sub edx, ebp
mov dword [esp + 0x1c], ebx
sub eax, ebx
mov dword [esp + 0x10], edx
mov ebx, esi
mov dword [esp + 0x18], eax
sub ebx, ebp
lea eax, [ebp + 0x10]
mov ebp, dword [esp + 0x10]
mov edx, esi
sub edx, edi
mov dword [esp + 0x14], edx
lea edx, [edi + 0x20]
movups xmm0, xmmword [eax - 0x10]
mov edi, dword [esp + 0x14]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edx, [edx + 0x40]
xorps xmm1, xmm0
movups xmmword [edx - 0x60], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax + ebp - 0x40], xmm1
movups xmm1, xmmword [edi + edx - 0x40]
mov edi, dword [esp + 0x30]
movups xmm0, xmmword [eax - 0x30]
xorps xmm1, xmm0
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [esi + ecx + 0x30]
add ecx, 0x40
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [esp + 0x18]
jb 0x51e0a0
cmp dword [esp + 0x1c], 8
mov edx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
jb 0x51e143
jmp 0x51e10c
mov ebx, esi
sub ebx, ebp
mov eax, edx
and eax, 0xfffffff8
sub edi, ebp
mov dword [esp + 0x1c], eax
lea eax, [ecx + ebp]
mov dword [esp + 0x2c], edi
nop
movq xmm1, qword [ebx + eax]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [edi + eax - 8], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x51e120
mov edi, dword [esp + 0x30]
cmp ecx, edx
jae 0x51e162
sub esi, ebp
lea eax, [ecx + ebp]
sub edi, ebp
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [edi + eax - 1], cl
sub edx, 1
jne 0x51e150
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x51e270
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.00655180
mov ecx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebp, [ecx + 0x40]
mov esi, dword [ecx + 0x14]
cmp edi, esi
ja 0x51e29e
shl edi, 4
add edi, dword [ebp]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
mov edx, dword [ecx + 0x18]
cmp edi, edx
jb 0x51e2d8
mov eax, edi
sub eax, edx
add eax, 4
and eax, 0xfffffffc
add eax, edx
push 0x71
mov dword [ecx + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp]
call fcn.0050ea60
add esp, 0x10
test eax, eax
jne 0x51e2d5
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [ebp], eax
mov eax, esi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
mov edi, dword [esp + 0x10]
sub eax, esi
mov dword [esp + 0xc], eax
push ebx
nop
mov eax, dword [ebp]
add eax, edi
mov bl, byte [eax]
lea esi, [eax + 0x10]
push esi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.0051df80
xor byte [esi + 0xf], bl
add esp, 0xc
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x51e2f0
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
pop ebx
mov dword [eax + 0x14], edi
shl edi, 4
add edi, dword [eax + 0x40]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x51f040
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00655180
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
lea edx, [eax - 1]
mov ebp, dword [esp + 0x1c]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
push esi
mov esi, dword [esp + 0x18]
dec edx
mov dword [esp + 0xc], edx
mov ecx, dword [esi + 4]
xor eax, ecx
and eax, edx
movd xmm0, edx
xor ecx, eax
pshufd xmm4, xmm0, 0
mov dword [esi + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
and eax, edx
xor ecx, eax
mov dword [esi + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [esi + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [esi + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
test ebp, ebp
jle 0x51f195
push edi
cmp ebp, 4
jb 0x51f14a
mov ecx, dword [esi]
lea edi, [ebp - 1]
mov edx, dword [ebx]
lea esi, [ebp - 1]
lea esi, [ecx + esi*4]
cmp edx, esi
lea edi, [edx + edi*4]
mov esi, dword [esp + 0x1c]
ja 0x51f0e1
cmp edi, ecx
jae 0x51f14a
cmp edx, ebx
ja 0x51f0e9
cmp edi, ebx
jae 0x51f14a
cmp edx, esi
ja 0x51f0f1
cmp edi, esi
jae 0x51f14a
lea edi, [ebp - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x51f0ff
cmp edi, ebx
jae 0x51f14a
cmp ecx, esi
ja 0x51f107
cmp edi, esi
jae 0x51f14a
mov esi, ebp
and esi, 0xfffffffc
mov dword [esp + 0x18], esi
xor esi, esi
xor edi, edi
movups xmm3, xmmword [edx + edi]
lea esi, [esi + 0x10]
movups xmm1, xmmword [ecx + esi - 0x10]
lea edi, [edi + 0x10]
movaps xmm2, xmm3
xorps xmm2, xmm1
andps xmm2, xmm4
movaps xmm0, xmm2
xorps xmm2, xmm3
xorps xmm0, xmm1
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm2
add eax, 4
cmp eax, dword [esp + 0x18]
jl 0x51f114
mov esi, dword [esp + 0x1c]
cmp eax, ebp
jge 0x51f194
lea ebp, [eax*4]
mov edi, ebp
mov dword [esp + 0x18], ebp
nop dword [eax + eax]
mov ecx, dword [ebx]
lea ebp, [ebp + 4]
mov esi, dword [esi]
mov edi, dword [ecx + edi]
mov edx, dword [esi + ebp - 4]
xor edi, edx
and edi, dword [esp + 0x10]
xor edx, edi
mov dword [esi + eax*4], edx
mov ecx, dword [ebx]
mov esi, dword [esp + 0x1c]
xor dword [ecx + eax*4], edi
inc eax
mov edi, dword [esp + 0x18]
add edi, 4
mov dword [esp + 0x18], edi
cmp eax, dword [esp + 0x24]
jl 0x51f160
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x51f830
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00655180
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push ebp
push esi
mov ebp, dword [ecx]
lea esi, [ecx + 4]
mov edx, dword [eax]
add eax, 4
test byte [ecx + 0x10], 4
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
je 0x51f913
mov ecx, dword [eax]
cmp dword [esi], ecx
jne 0x51f913
push ebx
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
test ecx, ecx
jle 0x51f90a
sub ebp, edx
push edi
mov ecx, dword [edx]
mov edx, dword [edx + ebp]
mov esi, edx
sub esi, ecx
mov eax, edx
xor esi, ecx
xor eax, ecx
or esi, eax
xor esi, edx
mov edx, dword [esp + 0x20]
shr esi, 0x1f
neg esi
mov dword [esp + 0x14], esi
not esi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [edx + ebp]
mov edx, dword [edx]
mov esi, edx
and ebx, dword [esp + 0x24]
sub esi, ecx
xor esi, ecx
mov eax, edx
xor eax, ecx
or ebx, edi
or esi, eax
xor esi, edx
mov edx, dword [esp + 0x20]
shr esi, 0x1f
add edx, 4
neg esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], esi
not esi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], esi
and ecx, 1
mov eax, dword [esp + 0x14]
and ebx, eax
mov eax, dword [esp + 0x18]
or ebx, ecx
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ecx
cmp ecx, dword [eax]
jl 0x51f880
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
add esp, 0xc
ret
mov esi, dword [esi]
mov ecx, esi
sub ecx, dword [eax]
je 0x51f923
pop esi
mov eax, ecx
pop ebp
add esp, 0xc
ret
lea ecx, [esi - 1]
test ecx, ecx
js 0x51f941
lea eax, [edx + ecx*4]
sub ebp, edx
nop
mov edx, dword [eax + ebp]
mov esi, dword [eax]
cmp esi, edx
jne 0x51f949
sub eax, 4
sub ecx, 1
jns 0x51f930
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
sbb eax, eax
and eax, 2
pop esi
dec eax
pop ebp
add esp, 0xc
ret
Function at 0x51fc00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.00655180
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call fcn.0051f4d0
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x51fc71
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x51fc69
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x51fc73
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x51fc73
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x51fcb1
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x51fd30
test esi, esi
je 0x51fdc4
push esi
push ecx
push dword [esp + 0x40]
call fcn.00656e20
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x51fc84
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x51fcf2
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x51fcee
dec ecx
test ecx, ecx
jg 0x51fce0
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call fcn.0051f4d0
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x51fc84
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x51fd40
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x51fdc3
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x51fd75
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x521a60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x10
call fcn.00655180
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
push dword [ebx + 4]
or ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
call fcn.0052d640
add esp, 4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x521af9
push 0xd2
push str.crypto_threads_win.c
push 0x78
call fcn.0050ec40
mov esi, eax
add esp, 0xc
mov dword [esp + 0x10], esi
test esi, esi
jne 0x521ade
push 0xd3
push str.crypto_threads_win.c
push str.assertion_failed:_data___NULL
call fcn.0050ecf0
add esp, 0xc
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x5218a0
push dword [ebx + 4]
push 0
call fcn.0052f010
add esp, 0xc
xor ecx, ecx
mov eax, esi
nop dword [eax]
cmp dword [eax], 0
jne 0x521b0f
cmp ebp, 0xffffffff
cmove ebp, ecx
mov dword [esp + 0x18], ebp
cmp dword [eax + 8], ebx
je 0x521bd2
inc ecx
add eax, 0xc
cmp ecx, 0xa
jl 0x521b00
lea edx, [ebx + 0x18]
mov dword [esp + 0x14], edx
xor esi, esi
mov eax, dword [edx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x521b2c
mov ebp, dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
shl eax, 3
add ebp, eax
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
add ebx, 1
mov ecx, edi
mov eax, esi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x521b42
cmp edx, edi
jne 0x521b42
mov edx, dword [esp + 0x14]
xor esi, esi
mov eax, dword [edx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x521b6b
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov edx, dword [esi + 0xc]
cmp edi, eax
je 0x521bb5
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov ebx, edi
mov esi, dword [ebp + 4]
sub ebx, 1
mov ecx, esi
mov eax, edi
sbb ecx, 0
mov edx, esi
lock cmpxchg8b qword [ebp]
cmp eax, edi
jne 0x521b87
cmp edx, esi
jne 0x521b87
mov ebx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
jmp 0x521b28
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
lea eax, [edx + edi*8]
mov dword [ecx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x521be0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 4
call fcn.00655180
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push dword [ebx + 4]
call fcn.0052d640
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ecx, ecx
lea edx, [esi + 8]
nop dword [eax]
cmp dword [edx], ebx
je 0x521c32
inc ecx
add edx, 0xc
cmp ecx, 0xa
jl 0x521c20
pop edi
pop esi
pop ebx
pop ecx
ret
lea eax, [ecx + ecx*2]
add dword [esi + eax*4 + 4], 0xffffffff
lea edi, [esi + eax*4]
mov dword [esp + 0xc], edi
jne 0x521ca8
mov eax, dword [edi]
mov edi, eax
mov dword [esp + 0x14], eax
push ebp
nop dword [eax]
mov esi, dword [edi]
mov ebp, esi
mov ebx, dword [edi + 4]
sub ebp, 1
mov ecx, ebx
mov eax, esi
sbb ecx, 0
mov edx, ebx
push ebx
mov ebx, ebp
lock cmpxchg8b qword [edi]
mov ebp, ebx
pop ebx
cmp eax, esi
jne 0x521c50
cmp edx, ebx
jne 0x521c50
mov edi, dword [esp + 0x10]
test ecx, ecx
jg 0x521c9a
jl 0x521c83
test ebp, ebp
jae 0x521c9a
push 0x102
push str.crypto_threads_win.c
push str.assertion_failed:_ret___0
call fcn.0050ecf0
add esp, 0xc
mov dword [edi], 0
mov dword [edi + 8], 0
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5223d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00655180
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x522450
mov cl, byte [edi]
test cl, cl
je 0x522450
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x522400
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x522500
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00655180
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x522583
mov cl, byte [edi]
test cl, cl
je 0x522583
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x522530
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x52cb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x168
call fcn.00655180
mov eax, dword [0x716f80]
xor eax, esp
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x170]
push ebp
mov ebp, dword [esp + 0x17c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x174]
test ebp, ebp
je 0x52cd48
push ebx
mov ebx, edi
mov eax, edi
push esi
shr ebx, 0x17
mov esi, 2
test edi, edi
push 0x52c3f0
cmovs ebx, esi
shr eax, 0x17
push 0x71852c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
call fcn.00521740
add esp, 8
neg eax
sbb eax, eax
test dword [0x718538], eax
je 0x52cbf6
mov eax, dword [esp + 0x14]
test edi, edi
push dword [0x718530]
cmovs eax, esi
movzx eax, al
shl eax, 0x17
mov dword [esp + 0x30], eax
call fcn.00521730
add esp, 4
test eax, eax
je 0x52cbf6
lea eax, [esp + 0x2c]
push eax
push dword [0x718534]
call fcn.00522360
push dword [0x718530]
mov esi, eax
call fcn.005217b0
add esp, 0xc
test esi, esi
je 0x52cbf6
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x52cc13
push ebx
push str.lib__lu_
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.005243c0
lea eax, [esp + 0x44]
add esp, 0x10
mov dword [esp + 0x1c], eax
mov esi, edi
test edi, edi
jns 0x52cc41
push 0x100
lea eax, [esp + 0x78]
and esi, 0x7fffffff
push eax
push esi
call fcn.0051ecb0
add esp, 0xc
lea ecx, [esp + 0x74]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x52cccd
push 0x52c3f0
push 0x71852c
and esi, 0x7fffff
call fcn.00521740
add esp, 8
neg eax
sbb eax, eax
test dword [0x718538], eax
jne 0x52cc69
xor eax, eax
jmp 0x52cccd
mov eax, dword [esp + 0x14]
push dword [0x718530]
movzx eax, al
shl eax, 0x17
or eax, esi
mov dword [esp + 0x28], eax
call fcn.00521730
add esp, 4
test eax, eax
je 0x52ccaf
lea eax, [esp + 0x24]
push eax
push dword [0x718534]
call fcn.00522360
push dword [0x718530]
mov ebx, eax
call fcn.005217b0
add esp, 0xc
test ebx, ebx
jne 0x52ccc6
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
push eax
call fcn.0052c9b0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x52ccc9
mov eax, dword [ebx + 4]
mov ebx, dword [esp + 0x18]
test eax, eax
jne 0x52ccf4
mov eax, esi
and eax, 0xff83ffff
push eax
push str.reason__lu_
lea eax, [esp + 0x7c]
push 0x100
push eax
call fcn.005243c0
add esp, 0x10
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x14]
push dword [esp + 0x24]
push edi
push str.error:_08lX:_s:_s:_s
push ebp
push dword [esp + 0x38]
call fcn.005243c0
mov edx, dword [esp + 0x3c]
add esp, 0x1c
mov ecx, edx
lea eax, [ecx + 1]
mov dword [esp + 0x10], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x52cd20
sub ecx, dword [esp + 0x10]
lea eax, [ebp - 1]
cmp ecx, eax
jne 0x52cd46
push esi
push 0
push ebx
push edi
push str.err:_lx:_lx:_lx:_lx
push ebp
push edx
call fcn.005243c0
add esp, 0x1c
pop esi
pop ebx
mov ecx, dword [esp + 0x16c]
pop edi
pop ebp
xor ecx, esp
call fcn.0065469c
add esp, 0x168
ret
Function at 0x52e920
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.00655180
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.0052e5f0
mov ebx, eax
push ebx
push esi
call fcn.0052e500
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x52e99f
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x52e983
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0052e590
push esi
call fcn.0052e6e0
add esp, 0x10
test eax, eax
jne 0x52ea19
push 1
push esi
call fcn.0052e5f0
mov ebx, eax
push ebx
push esi
call fcn.0052e500
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x52ea10
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x52e9f4
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0052e590
push esi
call fcn.0052e6e0
add esp, 0x10
test eax, eax
jne 0x52ea19
push esi
call fcn.0052e6e0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret