joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b030
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x602280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0054e204
mov dword [esi], vtable.boost::system::system_error.0
lea ecx, [esi + 0x18]
movq xmm0, qword [edi + 0xc]
movq qword [esi + 0xc], xmm0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov dword [ebp - 4], 0
mov byte [ecx], 0
call fcn.00420f50
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [ebp - 4], 1
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x4860ce
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x488370
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4883e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x607d58]
mov edx, eax
test cl, 1
jne 0x4883c0
or ecx, 1
mov dword [0x607d50], 0x25c5e09b
mov eax, vtable.boost::system::detail::system_error_category.0
mov dword [0x607d58], ecx
mov dword [0x607d54], 0x8fafd21e
mov dword [0x607d48], eax
jmp 0x4883c5
mov eax, dword [0x607d48]
mov eax, dword [eax + 0x18]
mov ecx, 0x607d48
push edx
mov dword [ebp - 0xc], edx
call eax
mov byte [ebp - 8], al
mov dword [ebp - 4], 0x607d48
test al, al
jne 0x4883e8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x59dcb0
lea eax, [ebp - 0xc]
push eax
call fcn.00486ec0
int3
Function at 0x4889f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
dec eax
xor ebx, ebx
push esi
bts ebx, eax
mov dword [ebp - 0x10], eax
push edi
xor edi, edi
cmp eax, 0x20
mov dword [ebp - 0xc], edi
cmovae ecx, ebx
xor ebx, ecx
cmp eax, 0x40
cmovae ecx, ebx
lea ebx, [ebx]
push 8
push edi
xor esi, esi
call fcn.00488ad0
mov word [ebp - 2], ax
lea ecx, [esi + 8]
movzx eax, ax
add esp, 8
mov dword [ebp - 8], eax
mov dx, ax
lea ecx, [ecx]
test byte [ebp - 8], 1
mov eax, 0
cmovne eax, ebx
xor esi, eax
mov eax, ebx
and eax, esi
neg eax
sbb eax, eax
add esi, esi
and eax, dword [ebp + 0x10]
shr dx, 1
xor esi, eax
mov word [ebp - 8], dx
dec ecx
jne 0x488a40
cmp byte [ebp + 0x14], cl
je 0x488aa3
mov ecx, dword [ebp - 0x10]
mov eax, 1
mov edx, eax
shl edx, cl
cmp edx, eax
jbe 0x488a9d
lea esp, [esp]
mov edi, edx
or edi, eax
mov ecx, edi
and ecx, esi
cmp ecx, edx
je 0x488a90
cmp ecx, eax
jne 0x488a92
xor esi, edi
shr edx, 1
add eax, eax
cmp edx, eax
ja 0x488a80
mov edi, dword [ebp - 0xc]
movzx eax, word [ebp - 2]
jmp 0x488aa6
movzx eax, di
movzx ecx, ax
inc edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [eax + ecx*4], esi
mov ecx, 0x100
cmp di, cx
jb 0x488a20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x489d80
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x607e1c]
sub esp, 0x400
push esi
push edi
test al, 1
jne 0x489de0
or eax, 1
mov dword [0x607e1c], eax
mov eax, dword [0x608220]
test al, 1
jne 0x489dd3
push 1
or eax, 1
push 0x4c11db7
mov dword [0x608220], eax
lea eax, [ebp - 0x400]
push 0x20
push eax
call fcn.004889f0
mov ecx, 0x100
mov esi, eax
mov edi, 0x607e20
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
mov edi, 0x607e20
mov dword [0x607e18], edi
jmp 0x489de6
mov edi, dword [0x607e18]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test edx, edx
je 0x489e06
mov esi, dword [ebp + 0xc]
mov cl, byte [esi]
lea esi, [esi + 1]
xor cl, al
shr eax, 8
movzx ecx, cl
xor eax, dword [edi + ecx*4]
dec edx
jne 0x489df3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48a000
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x48a052
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x48a06a
mov ecx, esi
jmp 0x48a06f
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x48a09c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x48a07e
mov eax, dword [eax]
jmp 0x48a062
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x48a08e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x48a0b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
cmp ecx, 0x10
jb 0x48a0d3
mov esi, dword [eax]
jmp 0x48a0d5
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x48a0f1
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x48a0e0
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x48a106
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp edi, edx
jne 0x48a12f
mov eax, edx
jmp 0x48a133
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x48a253
cmp dword [ebp - 8], 0x10
lea ecx, [esi + 8]
jb 0x48a14b
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
jmp 0x48a14e
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jb 0x48a15c
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x48a1c3
sub edx, 4
jb 0x48a181
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x48a186
add ecx, 4
add edi, 4
sub edx, 4
jae 0x48a170
cmp edx, 0xfffffffc
je 0x48a1ba
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x48a1b3
cmp edx, 0xfffffffd
je 0x48a1ba
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x48a1b3
cmp edx, 0xfffffffe
je 0x48a1ba
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x48a1b3
cmp edx, 0xffffffff
je 0x48a1ba
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x48a1ba
sbb eax, eax
or eax, 1
jmp 0x48a1bc
xor eax, eax
test eax, eax
jne 0x48a1d3
mov eax, dword [ebp - 4]
cmp eax, ebx
jb 0x48a1d3
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
test eax, eax
je 0x48a1e3
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x48a127
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x48a1f1
mov ecx, dword [ecx]
cmp dword [ebp - 8], 0x10
jb 0x48a1ff
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push dword [ebp + 0xc]
call fcn.00423250
add esp, 0xc
test eax, eax
jne 0x48a23a
cmp ebx, edi
jb 0x48a23a
cmp ebx, edi
setne al
test eax, eax
jne 0x48a23a
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x48add0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b828
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x608225], 0
mov esi, dword [ebp + 0xc]
je 0x48ae47
cmp dword [esi + 0x14], 0x10
jb 0x48ae10
mov eax, dword [esi]
jmp 0x48ae12
mov eax, esi
push eax
lea eax, [ebp - 0x28]
push str._log___s_n
push eax
call fcn.0048bba0
add esp, 0xc
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x14], 0x10
jb 0x48ae47
push dword [ebp - 0x28]
call fcn.0054b7e0
add esp, 4
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0048b590
add esp, 8
mov eax, dword [0x608230]
mov dword [ebp - 4], 0
test eax, eax
jne 0x48ae8c
push 0x18
call fcn.0054b78f
add esp, 4
mov dword [0x608230], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x608230]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00498280
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x48aeb3
push eax
push eax
call fcn.0048aa30
add esp, 8
push dword [0x608230]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00498280
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x48aee1
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x48aee1
cmp ecx, 3
ja case.default.0x48aee1
jmp dword [ecx*4 + 0x48af3c]
push esi
mov ecx, edi
call fcn.00497d60
jmp case.default.0x48aee1
push esi
mov ecx, edi
call fcn.00498350
jmp case.default.0x48aee1
push esi
mov ecx, edi
call fcn.00498820
jmp case.default.0x48aee1
push esi
mov ecx, edi
call fcn.004980a0
cmp dword [ebp - 0x2c], 0x10
jb 0x48af1f
push dword [ebp - 0x40]
call fcn.0054b7e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054bf74
mov esp, ebp
pop ebp
ret
Function at 0x48b990
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b960
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x602280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.0048c510
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x48bb6b
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00423bc0
call fcn.0048bdd0
add esp, 0x18
test al, al
je 0x48ba0f
mov bl, 1
jmp 0x48bb6d
call fcn.0048c140
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042a280
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x48ba5c
cmp dword [ebp + 0x1c], 8
jb 0x48ba3f
push dword [ebp + 8]
call fcn.0054b7e0
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.00424b10
cmp dword [ebp - 0x14], 8
jb 0x48ba6d
push dword [ebp - 0x28]
call fcn.0054b7e0
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.0048bfe0
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x48bb1d
cmp ecx, esi
jbe 0x48bb61
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x48bb14
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.00423ce0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.00423bc0
call fcn.0048bdd0
add esp, 0x18
test al, al
jne 0x48bafc
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x48bb11
push dword [ebp - 0x28]
call fcn.0054b7e0
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x48ba97
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00423bc0
call fcn.0048bdd0
add esp, 0x18
test al, al
je 0x48bb6b
mov bl, 1
jmp 0x48bb6d
push str.invalid_string_position
call fcn.005369e2
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x48bb7e
push dword [ebp + 8]
call fcn.0054b7e0
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054bf74
mov esp, ebp
pop ebp
ret
Function at 0x48bdd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b998
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x602280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.0048bfe0
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x48be2e
push dword [ebp + 8]
call fcn.0054b7e0
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b850
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58cb69
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x602280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.00420f50
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00420f50
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00420f50
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.0049d9b0
add esp, 4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.0049d7f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x49d2d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [0x608334]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x49d324
push esi
push 0x10
call fcn.0054b78f
add esp, 4
test eax, eax
je 0x49d2fa
mov ecx, eax
call fcn.0049cae0
mov esi, eax
jmp 0x49d2fc
xor esi, esi
push dword [0x608334]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49d314
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push esi
push dword [0x608334]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x4ade40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.0054da90
mov eax, dword [0x602280]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x4adea6
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.004c5060
add esp, 0xc
cmp edi, 0x40
jbe 0x4adec2
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.004c5060
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x4adee9
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x30], esi
call fcn.0054dac0
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x4adfdf
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x28], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x28]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x30]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x4adf60
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x4ae01a
mov ebp, dword [esp + 0x2c]
lea esp, [esp]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x4adff0
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054bf74
add esp, 0xa8
ret
Function at 0x4aeb00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0054da90
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
inc ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x4aeb48
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
lea eax, [ecx + ebp]
cmp eax, edx
jbe 0x4aeb3b
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x4aeb4d
cmp ebp, dword [esi + 4]
ja 0x4aeb34
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + eax - 1]
je 0x4aeba0
cmp dword [edi + 0x88], 0
jne 0x4aeba0
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x5a426c
push eax
call fcn.004c4c60
add esp, 0xc
test eax, eax
jne 0x4aeb93
test bl, 1
jne 0x4aeb93
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x4aeba0
test ebx, ebx
je 0x4aeba0
dec ebx
mov eax, dword [edi + 0x80]
push dword [eax]
call fcn.004cc880
add esp, 4
test eax, 0x200000
je 0x4aebca
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov edx, dword [esi + 4]
lea ecx, [ebx + ebp]
mov edi, edx
mov dword [esp + 0x10], edx
sub edi, ecx
mov eax, edx
xor edi, ecx
xor eax, ecx
or edi, eax
mov ecx, 0xff
xor edi, edx
lea eax, [edx - 1]
shr edi, 0x1f
dec edi
cmp eax, ecx
cmovb ecx, eax
xor ebp, ebp
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4aec4d
mov eax, dword [esi + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea esi, [edx - 1]
mov dword [esp + 0x24], ecx
add esi, eax
mov edi, edi
mov al, byte [esp + 0x24]
lea esi, [esi - 1]
mov edx, ebx
mov ecx, ebp
sub edx, ebp
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc ebp
or dl, al
movzx eax, byte [esi + 1]
xor dl, byte [esp + 0x24]
xor eax, ebx
dec dl
movzx ecx, dl
and ecx, eax
not ecx
and edi, ecx
cmp ebp, dword [esp + 0x18]
jb 0x4aec10
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
not edi
lea eax, [ebx + 1]
and edi, 0xff
pop ebx
lea ecx, [edi - 1]
not edi
shr ecx, 0x1f
shr edi, 0x1f
and ecx, edi
neg ecx
and eax, ecx
sub edx, eax
shl eax, 8
or dword [esi], eax
mov dword [esi + 4], edx
mov dword [esp + 0x20], ecx
not ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x20]
pop edi
and eax, 1
or eax, dword [esp + 0x10]
pop esi
pop ebp
pop ecx
ret