joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdc30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4bdc87
nop dword [eax]
add ecx, ecx
movsx eax, byte [ecx + esi + 2]
movd xmm1, eax
movsx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x4bdc50
cmp ecx, edi
jne 0x4bdc9a
test bl, 1
jne 0x4bdc9a
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4bdcd9
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movsx eax, bl
movd xmm1, eax
movsx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x4bdccf
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x4bdca2
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret

Function at 0x4bdcf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4bdd47
nop dword [eax]
add ecx, ecx
movzx eax, byte [ecx + esi + 2]
movd xmm1, eax
movzx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x4bdd10
cmp ecx, edi
jne 0x4bdd5a
test bl, 1
jne 0x4bdd5a
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4bdd99
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movzx eax, bl
movd xmm1, eax
movzx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x4bdd8f
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x4bdd62
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
Function at 0x4bddb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4bde09
nop dword [eax]
add ecx, ecx
movsx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movsx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x4bddd0
cmp ecx, edi
jne 0x4bde1e
test bl, 1
jne 0x4bde1e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4bde61
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
movzx edi, word [esi + ecx*2]
movsx eax, di
movd xmm1, eax
movsx eax, word [ebx]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x4bde55
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x4bde26
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret

Function at 0x4bde80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4bded9
nop dword [eax]
add ecx, ecx
movzx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movzx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x4bdea0
cmp ecx, edi
jne 0x4bdeee
test bl, 1
jne 0x4bdeee
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4bdf2e
mov ebx, dword [esp + 0x20]
movzx eax, word [ebx]
lea ecx, [edx - 1]
sar ecx, 1
movd xmm0, eax
movzx edi, word [esi + ecx*2]
cvtdq2pd xmm0, xmm0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x4bdf22
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x4bdef6
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
Function at 0x4bdf40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x4bdf95
nop
add ecx, ecx
xor eax, eax
movd xmm1, dword [esi + ecx*4 + 8]
movd xmm0, dword [esi + ecx*4 + 4]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x4bdf60
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x4bdfa6
test al, 1
jne 0x4bdfa6
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x4bdfe1
mov edi, dword [esp + 0x20]
nop
movd xmm0, dword [edi]
lea eax, [edx - 1]
sar eax, 1
cvtdq2pd xmm0, xmm0
mov ecx, dword [esi + eax*4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x4bdfd7
mov dword [esi + edx*4], ecx
mov edx, eax
cmp ebx, eax
jl 0x4bdfb0
mov eax, dword [edi]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x4bdff0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x4be05d
nop dword [eax]
add ecx, ecx
mov eax, dword [esi + ecx*4 + 8]
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x71a1f0]
mov eax, dword [esi + ecx*4 + 4]
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x71a1f0]
xor eax, eax
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x4be010
cmp ecx, edi
jne 0x4be070
test bl, 1
jne 0x4be070
mov eax, dword [esi + ebx*4 - 4]
mov dword [esi + edx*4], eax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x4be0c5
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov edi, dword [esi + ecx*4]
mov eax, edi
shr eax, 0x1f
movd xmm1, edi
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x71a1f0]
mov eax, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x71a1f0]
comisd xmm1, xmm0
jbe 0x4be0bb
mov dword [esi + edx*4], edi
mov edx, ecx
cmp ebp, ecx
jl 0x4be078
mov eax, dword [ebx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4be0e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x4be133
nop
add ecx, ecx
xor eax, eax
movss xmm1, dword [esi + ecx*4 + 8]
movss xmm0, dword [esi + ecx*4 + 4]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x4be100
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x4be144
test al, 1
jne 0x4be144
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x4be17f
mov ecx, dword [esp + 0x20]
nop dword [eax]
movss xmm0, dword [ecx]
lea eax, [edx - 1]
sar eax, 1
cvtps2pd xmm0, xmm0
movss xmm2, dword [esi + eax*4]
cvtps2pd xmm1, xmm2
comisd xmm1, xmm0
jbe 0x4be175
movss dword [esi + edx*4], xmm2
mov edx, eax
cmp ebx, eax
jl 0x4be150
mov eax, dword [ecx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x4be190
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, edx
push edi
lea edi, [ecx - 1]
sar edi, 1
cmp edx, edi
jge 0x4be1de
nop dword [eax]
lea ecx, [eax + eax]
xor eax, eax
movsd xmm0, qword [esi + ecx*8 + 0x10]
comisd xmm0, xmmword [esi + ecx*8 + 8]
seta al
xor eax, 1
inc eax
add eax, ecx
movsd xmm0, qword [esi + eax*8]
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp eax, edi
jl 0x4be1b0
mov ecx, dword [esp + 0x18]
cmp eax, edi
jne 0x4be1f5
test cl, 1
jne 0x4be1f5
movsd xmm0, qword [esi + ecx*8 - 8]
movsd qword [esi + edx*8], xmm0
lea edx, [ecx - 1]
cmp ebx, edx
jge 0x4be228
mov ecx, dword [esp + 0x1c]
nop dword [eax]
lea eax, [edx - 1]
sar eax, 1
movsd xmm0, qword [esi + eax*8]
comisd xmm0, xmmword [ecx]
jbe 0x4be21b
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp ebx, eax
jl 0x4be200
movsd xmm0, qword [ecx]
pop edi
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
movsd xmm0, qword [eax]
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
Function at 0x4fe680
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x18
test eax, eax
je 0x4fe85e
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
cmp edx, 1
jne 0x4fe6ad
cmp eax, 2
jne 0x4fe6a4
xor ecx, ecx
jmp 0x4fe6b7
cmp eax, 1
jne 0x4fe6b7
mov ecx, eax
jmp 0x4fe6b7
cmp edx, 2
jne 0x4fe6b7
cmp eax, edx
cmove ecx, edx
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
cmp eax, 5
jne 0x4fe772
mov ebp, dword [esp + 0x30]
xor edx, edx
cmp ecx, 2
sete dl
xor eax, eax
inc edx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x4fe85a
mov esi, dword [esp + 0x34]
nop word [eax + eax]
mov ebx, edx
cmp edx, eax
ja 0x4fe758
lea ecx, [esi - 1]
mov dword [esp + 0x18], ecx
nop dword [eax]
mov eax, ecx
cmp eax, ebx
jl 0x4fe743
mov edi, dword [ebp + eax*4]
mov esi, edi
mov ecx, dword [ebp + eax*4 - 4]
sub edi, dword [ebp + eax*4 - 4]
and ecx, 0xff800000
sub esi, ecx
xor edi, esi
and edi, 0x7fffff
xor edi, esi
mov dword [ebp + eax*4], edi
dec eax
cmp eax, ebx
jge 0x4fe716
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jle 0x4fe710
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
lea ebx, [esi*4]
add ebp, ebx
sub ecx, 1
mov dword [esp + 0x3c], ecx
jne 0x4fe700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp eax, 6
jne 0x4fe85a
mov edx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, 2
mov dword [esp + 0x3c], edx
sete bl
xor eax, eax
inc ebx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x24], ebx
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x4fe85a
mov esi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov ebp, ebx
cmp ebx, eax
ja 0x4fe840
lea ecx, [esi - 1]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jl 0x4fe827
nop
mov esi, dword [edx + ecx*8 - 4]
mov eax, esi
mov edi, dword [edx + ecx*8]
and eax, 0xfffff
mov ebx, dword [edx + ecx*8 + 4]
mov edx, edi
mov ebp, dword [esp + 0x3c]
sub edx, dword [ebp + ecx*8 - 8]
mov ecx, ebx
sbb ecx, eax
and esi, 0xfff00000
sub edi, 0
sbb ebx, esi
xor eax, eax
xor ebx, ecx
xor eax, edx
and ebx, 0xfff00000
mov edx, ebp
mov ebp, dword [esp + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], ebx
dec ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jge 0x4fe7d0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x4fe7c6
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
lea ebp, [esi*8]
add edx, ebp
sub ecx, 1
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], ecx
jne 0x4fe7b1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x503db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x168
call fcn.006d75c0
mov eax, dword [0x7c2580]
xor eax, esp
mov dword [esp + 0x164], eax
mov eax, dword [esp + 0x170]
push ebp
mov ebp, dword [esp + 0x17c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x178]
mov dword [esp + 0x10], eax
push edi
mov edi, dword [esp + 0x174]
test ebp, ebp
je 0x503fc9
push ebx
mov ebx, edi
mov eax, edi
push esi
shr ebx, 0x17
mov esi, 2
test edi, edi
push 0x503650
cmovs ebx, esi
shr eax, 0x17
push 0x7c5eb4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], eax
call fcn.0050aa80
add esp, 8
neg eax
sbb eax, eax
test dword [0x7c5ec0], eax
je 0x503e86
mov eax, dword [esp + 0x10]
test edi, edi
push dword [0x7c5eb8]
cmovs eax, esi
movzx eax, al
shl eax, 0x17
mov dword [esp + 0x30], eax
call fcn.0050aa70
add esp, 4
test eax, eax
je 0x503e86
lea eax, [esp + 0x2c]
push eax
push dword [0x7c5ebc]
call fcn.0050e160
push dword [0x7c5eb8]
mov esi, eax
call fcn.0050aaf0
add esp, 0xc
test esi, esi
je 0x503e86
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x503ea3
push ebx
push str.lib__lu_
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.0050c600
lea eax, [esp + 0x44]
add esp, 0x10
mov dword [esp + 0x14], eax
mov esi, edi
test edi, edi
jns 0x503ed1
push 0x100
lea eax, [esp + 0x78]
and esi, 0x7fffffff
push eax
push esi
call fcn.0050b900
add esp, 0xc
lea ecx, [esp + 0x74]
neg eax
sbb eax, eax
and eax, ecx
jmp 0x503f55
push 0x503650
push 0x7c5eb4
and esi, 0x7fffff
call fcn.0050aa80
add esp, 8
neg eax
sbb eax, eax
test dword [0x7c5ec0], eax
je 0x503f59
mov eax, dword [esp + 0x10]
push dword [0x7c5eb8]
movzx eax, al
shl eax, 0x17
or eax, esi
mov dword [esp + 0x28], eax
call fcn.0050aa70
add esp, 4
test eax, eax
je 0x503f3b
lea eax, [esp + 0x24]
push eax
push dword [0x7c5ebc]
call fcn.0050e160
push dword [0x7c5eb8]
mov ebx, eax
call fcn.0050aaf0
add esp, 0xc
test ebx, ebx
jne 0x503f52
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
push eax
call fcn.00503c10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x503f59
mov eax, dword [ebx + 4]
test eax, eax
jne 0x503f7c
mov eax, esi
and eax, 0xff83ffff
push eax
push str.reason__lu_
lea eax, [esp + 0x7c]
push 0x100
push eax
call fcn.0050c600
add esp, 0x10
lea eax, [esp + 0x74]
mov ebx, dword [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push str.error:_08lX:_s:_s:_s
push ebp
push ebx
call fcn.0050c600
mov ecx, ebx
add esp, 0x1c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x503fa0
sub ecx, edx
lea eax, [ebp - 1]
cmp ecx, eax
jne 0x503fc7
push esi
push 0
push dword [esp + 0x28]
push edi
push str.err:_lx:_lx:_lx:_lx
push ebp
push ebx
call fcn.0050c600
add esp, 0x1c
pop esi
pop ebx
mov ecx, dword [esp + 0x16c]
pop edi
pop ebp
xor ecx, esp
call fcn.006d66cb
add esp, 0x168
ret
Function at 0x50ac80
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x7c5fcc], 2
push esi
push edi
mov edi, 1
je 0x50acd7
mov edx, 0x7c5fcc
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x50acb1
cmp eax, 1
je 0x50ac95
cmp dword [0x7c5fcc], 2
jne 0x50acf1
jmp 0x50acd7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x50abd0
push 0
push 0
mov dword [0x7c5fc8], eax
call fcn.0050e920
add esp, 0xc
mov dword [0x7c5fcc], 2
push 0x97
push str.crypto_threads_win.c
push 0x34
call fcn.0050bc40
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x50acf6
pop edi
xor eax, eax
pop esi
ret
push ebx
push ebp
lea ebx, [esi + 0x20]
call fcn.0051e2c0
mov dword [ebx], eax
call fcn.0051e000
mov dword [esi + 0x28], eax
call fcn.0051e000
mov dword [esi + 0x30], eax
call fcn.0051e2c0
mov dword [esi + 0x24], eax
lea ebp, [esi + 0x2c]
call fcn.0051e2c0
mov dword [ebp], eax
call fcn.0051e2c0
cmp dword [esp + 0x14], edi
push 0x85
cmovge edi, dword [esp + 0x18]
inc edi
mov dword [ebx], eax
push str.crypto_threads_win.c
lea eax, [edi*8]
push eax
call fcn.0050bc40
add esp, 0xc
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
lea edi, [esi + 0x24]
test eax, eax
je 0x50ad79
cmp dword [esi + 0x28], 0
je 0x50ad79
cmp dword [esi + 0x30], 0
je 0x50ad79
cmp dword [ebx], 0
je 0x50ad79
cmp dword [edi], 0
je 0x50ad79
cmp dword [ebp], 0
jne 0x50adc2
push 0xa9
push str.crypto_threads_win.c
push eax
call fcn.0050ba40
lea eax, [esi + 0x28]
push eax
call fcn.0051dfa0
lea eax, [esi + 0x30]
push eax
call fcn.0051dfa0
push edi
call fcn.0051e280
push ebp
call fcn.0051e280
push ebx
call fcn.0051e280
push 0xaf
push str.crypto_threads_win.c
push esi
call fcn.0050ba40
add esp, 0x2c
xor esi, esi
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x50add0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x10
call fcn.006d75c0
push ebx
push ebp
or ebp, 0xffffffff
push esi
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x7c5fc8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push esi
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x50ae4b
push 0xde
push str.crypto_threads_win.c
push 0x78
call fcn.0050bc40
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x50ae3e
push 0xdf
push str.crypto_threads_win.c
push str.assertion_failed:_data___NULL
call fcn.0050e980
add esp, 0xc
push ebx
push dword [0x7c5fc8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x20]
xor ecx, ecx
mov eax, ebx
cmp dword [eax], 0
jne 0x50ae62
cmp ebp, 0xffffffff
cmove ebp, ecx
mov dword [esp + 0x10], ebp
cmp dword [eax + 8], edx
je 0x50af31
inc ecx
add eax, 0xc
cmp ecx, 0xa
jl 0x50ae53
lea ebx, [edx + 0x14]
mov dword [esp + 0xc], ebx
push edi
nop dword [eax]
xor esi, esi
mov eax, dword [ebx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [ebx], ecx
jne 0x50ae84
mov ebp, dword [edx + 8]
mov dword [esp + 0x1c], eax
shl eax, 3
add ebp, eax
nop word [eax + eax]
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
add ebx, 1
mov ecx, edi
mov eax, esi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x50aea0
cmp edx, edi
jne 0x50aea0
mov edx, dword [esp + 0x10]
xor esi, esi
mov eax, dword [edx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x50aec9
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov edx, dword [esi + 8]
cmp edi, eax
je 0x50af13
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov ebx, edi
mov esi, dword [ebp + 4]
sub ebx, 1
mov ecx, esi
mov eax, edi
sbb ecx, 0
mov edx, esi
lock cmpxchg8b qword [ebp]
cmp eax, edi
jne 0x50aee5
cmp edx, esi
jne 0x50aee5
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
jmp 0x50ae80
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
lea eax, [edx + edi*8]
mov dword [ecx + 4], 1
mov dword [ecx], eax
mov dword [ecx + 8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x50af40
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 8
call fcn.006d75c0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x7c5fc8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x14]
lea edx, [edi + 8]
xor ecx, ecx
cmp dword [edx], esi
je 0x50af85
inc ecx
add edx, 0xc
cmp ecx, 0xa
jl 0x50af72
pop edi
pop esi
add esp, 8
ret
lea eax, [ecx + ecx*2]
add dword [edi + eax*4 + 4], 0xffffffff
push ebx
lea ebx, [edi + eax*4]
jne 0x50b004
mov eax, dword [ebx]
mov dword [esp + 0xc], eax
push ebp
nop word [eax + eax]
mov esi, dword [eax]
mov ebp, esi
mov edi, dword [eax + 4]
sub ebp, 1
mov ecx, edi
mov dword [esp + 0x14], edi
mov edx, edi
sbb ecx, 0
mov edi, dword [esp + 0x10]
mov eax, esi
push ebx
mov ebx, ebp
lock cmpxchg8b qword [edi]
mov ebp, ebx
pop ebx
mov edi, dword [esp + 0x14]
cmp eax, esi
mov eax, dword [esp + 0x10]
jne 0x50afa0
cmp edx, edi
jne 0x50afa0
test ecx, ecx
jg 0x50aff6
jl 0x50afdf
test ebp, ebp
jae 0x50aff6
push 0x10c
push str.crypto_threads_win.c
push str.assertion_failed:_ret___0
call fcn.0050e980
add esp, 0xc
mov dword [ebx], 0
mov dword [ebx + 8], 0
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret

Function at 0x50e1d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.006d75c0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x50e250
mov cl, byte [edi]
test cl, cl
je 0x50e250
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x50e200
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x50e300
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.006d75c0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x50e383
mov cl, byte [edi]
test cl, cl
je 0x50e383
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x50e330
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret