joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cdee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, ecx
mov ecx, dword [esp + 0x20]
cmp edx, ecx
cmovb ecx, edx
test ecx, ecx
mov dword [esp + 4], edx
je 0x4cdf4a
xor eax, eax
xor ebp, ebp
mov dword [esp], ecx
nop word cs:[eax + eax]
mov edi, dword [ebx + ebp*4]
mov ecx, ebx
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + ebp*4]
mov esi, edi
sub esi, ebx
xor ebx, edi
lea edx, [ebx - 1]
xor esi, edi
or esi, ebx
not ebx
and edx, ebx
mov ebx, ecx
mov ecx, dword [esp]
xor esi, edi
sar edx, 0x1f
sar esi, 0x1f
or esi, 1
xor eax, esi
and eax, edx
xor eax, esi
inc ebp
cmp ecx, ebp
jne 0x4cdf10
jmp 0x4cdf4c
xor eax, eax
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 4]
mov ecx, edx
mov esi, dword [esp + 0x20]
sub ecx, esi
jae 0x4cdf6d
mov ebp, esi
sub ebp, edx
xor ebx, ebx
cmp ebp, 8
jae 0x4cdf85
mov ecx, edx
jmp 0x4cdfe0
jbe 0x4ce07a
xor ebp, ebp
cmp ecx, 8
jae 0x4cdffb
mov edi, esi
jmp 0x4ce060
mov dword [esp], ebp
and ebp, 0xfffffff8
lea ecx, [edx + ebp]
lea edx, [edi + edx*4]
add edx, 0x10
pxor xmm0, xmm0
xor ebx, ebx
pxor xmm1, xmm1
nop
movdqu xmm2, xmmword [edx + ebx*4 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [edx + ebx*4]
por xmm1, xmm2
add ebx, 8
cmp ebp, ebx
jne 0x4cdfa0
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movd ebx, xmm1
cmp dword [esp], ebp
je 0x4cdfe8
nop dword [eax]
or ebx, dword [edi + ecx*4]
inc ecx
cmp esi, ecx
jne 0x4cdfe0
mov ecx, ebx
not ecx
dec ebx
and ebx, ecx
sar ebx, 0x1f
not ebx
or eax, ebx
jmp 0x4ce07a
mov ebp, ebx
mov dword [esp], ecx
mov ebx, ecx
and ebx, 0xfffffff8
lea edi, [ebx + esi]
mov ecx, ebp
lea esi, [esi*4 + 0x10]
add esi, ebp
pxor xmm0, xmm0
xor ebp, ebp
pxor xmm1, xmm1
nop dword [eax]
movdqu xmm2, xmmword [esi + ebp*4 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [esi + ebp*4]
por xmm1, xmm2
add ebp, 8
cmp ebx, ebp
jne 0x4ce020
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movd ebp, xmm1
cmp dword [esp], ebx
mov ebx, ecx
je 0x4ce068
nop dword [eax + eax]
or ebp, dword [ebx + edi*4]
inc edi
cmp edx, edi
jne 0x4ce060
mov ecx, ebp
not ecx
dec ebp
and ebp, ecx
sar ebp, 0x1f
xor eax, 1
and eax, ebp
xor eax, 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ce400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ebx, dword [eax + 4]
mov edx, dword [ecx + 4]
xor edi, edi
mov esi, ebx
sub esi, edx
mov dword [esp], esi
jge 0x4ce499
mov ebp, dword [ecx]
mov ecx, edx
sub ecx, ebx
xor edi, edi
mov esi, ebx
cmp ecx, 8
jb 0x4ce490
mov dword [esp + 4], ecx
and ecx, 0xfffffff8
lea esi, [ebx + ecx]
lea edi, [ebx*4 + 0x10]
add edi, ebp
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
nop dword [eax]
movdqu xmm2, xmmword [edi + eax*4 - 0x10]
por xmm0, xmm2
movdqu xmm2, xmmword [edi + eax*4]
por xmm1, xmm2
add eax, 8
cmp ecx, eax
jne 0x4ce450
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movd edi, xmm1
cmp dword [esp + 4], ecx
mov eax, dword [esp + 0x1c]
je 0x4ce499
nop
or edi, dword [ebp + esi*4]
inc esi
cmp edx, esi
jne 0x4ce490
cmp edx, ebx
jge 0x4ce4af
mov ebp, dword [eax]
mov esi, dword [esp]
cmp esi, 8
mov ecx, dword [esp + 0x20]
jae 0x4ce4b5
mov esi, edx
jmp 0x4ce520
mov ecx, dword [esp + 0x20]
jmp 0x4ce529
mov ecx, esi
and ecx, 0xfffffff8
lea esi, [edx + ecx]
movd xmm1, edi
lea eax, [edx*4 + 0x10]
add eax, ebp
pxor xmm0, xmm0
xor edi, edi
movdqu xmm2, xmmword [eax + edi*4 - 0x10]
por xmm1, xmm2
movdqu xmm2, xmmword [eax + edi*4]
por xmm0, xmm2
add edi, 8
cmp ecx, edi
jne 0x4ce4d0
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
je 0x4ce529
nop word cs:[eax + eax]
or edi, dword [ebp + esi*4]
inc esi
cmp ebx, esi
jne 0x4ce520
cmp ebx, edx
cmovl edx, ebx
test edx, edx
jle 0x4ce5a6
mov esi, dword [eax]
mov ebx, dword [ecx]
xor ebp, ebp
cmp edx, 8
jb 0x4ce599
mov ebp, edx
and ebp, 0xfffffff8
movd xmm1, edi
pxor xmm0, xmm0
xor eax, eax
nop dword [eax]
movdqu xmm2, xmmword [esi + eax*4]
movdqu xmm3, xmmword [esi + eax*4 + 0x10]
movdqu xmm4, xmmword [ebx + eax*4]
pxor xmm4, xmm2
por xmm1, xmm4
movdqu xmm2, xmmword [ebx + eax*4 + 0x10]
pxor xmm2, xmm3
por xmm0, xmm2
add eax, 8
cmp ebp, eax
jne 0x4ce550
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
jmp 0x4ce5a2
mov eax, dword [ebx + ebp*4]
xor eax, dword [esi + ebp*4]
or edi, eax
inc ebp
cmp edx, ebp
jne 0x4ce599
mov ecx, dword [ecx + 0xc]
mov eax, dword [esp + 0x1c]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4dcec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x4dcfd7
mov eax, dword [eax]
mov dword [esp + 4], eax
xor ebp, ebp
xor eax, eax
xor ebx, ebx
xor edi, edi
mov dword [esp + 8], ecx
nop dword [eax + eax]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp], eax
mov eax, dword [esp + 4]
mov ebp, dword [eax + edi*4]
mov ecx, ebp
shl ecx, 0x10
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
mov dword [esp + 0x10], ecx
mov ebx, ebp
shr ebx, 0x10
xor ebx, ebp
and ebx, ecx
xor ebx, ebp
mov ecx, ebx
shl ecx, 0x18
mov edx, ecx
dec ecx
not edx
and ecx, edx
sar ecx, 0x1f
mov esi, ebx
mov dword [esp + 0xc], ecx
shr esi, 8
xor esi, ebx
and esi, ecx
xor esi, ebx
mov ecx, esi
shl ecx, 0x1c
mov eax, ecx
not eax
dec ecx
and ecx, eax
sar ecx, 0x1f
mov eax, esi
shr eax, 4
mov ebx, ecx
xor eax, esi
and eax, ecx
xor eax, esi
mov edx, eax
shl edx, 0x1e
mov ecx, edx
dec edx
not ecx
and edx, ecx
mov esi, eax
shr esi, 2
sar edx, 0x1f
mov ecx, edx
xor esi, eax
and esi, edx
lea edx, [ebp - 1]
not ebp
and edx, ebp
mov ebp, dword [esp + 0x18]
xor esi, eax
shl esi, 0x1f
mov eax, esi
not eax
dec esi
and esi, eax
mov eax, dword [esp + 0x10]
and eax, 0x10
shr esi, 0x1f
or esi, eax
mov eax, dword [esp + 0xc]
and eax, 8
or esi, eax
and ebx, 4
or esi, ebx
sar edx, 0x1f
and ecx, 2
or esi, ecx
mov ecx, dword [esp + 8]
mov ebx, edx
not ebx
mov eax, dword [esp + 0x14]
or edx, eax
or ebx, eax
add esi, ebp
not edx
and edx, esi
or dword [esp], edx
mov eax, dword [esp]
inc edi
add ebp, 0x20
cmp ecx, edi
jne 0x4dcef0
jmp 0x4dcfd9
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e3600
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
mov ebx, dword [ecx + 4]
mov dword [eax], ebx
test edi, edi
je 0x4e3635
mov eax, dword [esi + 0xb8]
cmp eax, ebx
jne 0x4e3642
lea eax, [esi + 0x88]
test ebx, ebx
jne 0x4e367a
jmp 0x4e3795
mov eax, 1
add esp, 4
jmp 0x4e37a1
mov byte [esi + eax + 0xa8], 0x80
mov ecx, dword [esi + 0xb8]
mov eax, ecx
not eax
add eax, ebx
je 0x4e366c
add ecx, esi
add ecx, 0xa9
push eax
push 0
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [esi + 0x98]
test ebx, ebx
je 0x4e3795
xor ecx, ecx
cmp ebx, 8
jb 0x4e3720
mov edx, edi
sub edx, eax
cmp edx, 0x20
jb 0x4e3720
mov edx, edi
sub edx, esi
add edx, 0xffffff58
cmp edx, 0x20
jb 0x4e3720
xor ecx, ecx
cmp ebx, 0x20
jb 0x4e36ec
mov ecx, ebx
and ecx, 0xffffffe0
xor edx, edx
nop
movups xmm0, xmmword [esi + edx + 0xa8]
movups xmm1, xmmword [esi + edx + 0xb8]
movups xmm2, xmmword [eax + edx]
xorps xmm2, xmm0
movups xmm0, xmmword [eax + edx + 0x10]
xorps xmm0, xmm1
movups xmmword [edi + edx], xmm2
movups xmmword [edi + edx + 0x10], xmm0
add edx, 0x20
cmp ecx, edx
jne 0x4e36b0
cmp ebx, ecx
je 0x4e3795
test bl, 0x18
je 0x4e3720
mov edx, ecx
mov ecx, ebx
and ecx, 0xfffffff8
nop word cs:[eax + eax]
movsd xmm0, qword [esi + edx + 0xa8]
movsd xmm1, qword [eax + edx]
xorps xmm1, xmm0
movlps qword [edi + edx], xmm1
add edx, 8
cmp ecx, edx
jne 0x4e3700
cmp ebx, ecx
je 0x4e3795
mov edx, ecx
not edx
add edx, ebx
mov dword [esp], edx
mov ebp, ebx
and ebp, 3
je 0x4e3742
movzx edx, byte [eax + ecx]
xor dl, byte [esi + ecx + 0xa8]
mov byte [edi + ecx], dl
inc ecx
dec ebp
jne 0x4e3730
cmp dword [esp], 3
jb 0x4e3795
nop dword [eax + eax]
movzx edx, byte [eax + ecx]
xor dl, byte [esi + ecx + 0xa8]
mov byte [edi + ecx], dl
movzx edx, byte [eax + ecx + 1]
xor dl, byte [esi + ecx + 0xa9]
mov byte [edi + ecx + 1], dl
movzx edx, byte [eax + ecx + 2]
xor dl, byte [esi + ecx + 0xaa]
mov byte [edi + ecx + 2], dl
movzx edx, byte [eax + ecx + 3]
xor dl, byte [esi + ecx + 0xab]
mov byte [edi + ecx + 3], dl
add ecx, 4
cmp ebx, ecx
jne 0x4e3750
mov eax, dword [esi]
push ebx
push edi
push edi
push esi
call dword [eax + 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4fc7a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 0x30
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x40]
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
test ecx, ecx
je 0x4fc88c
xor eax, eax
cmp ecx, 0x30
ja 0x4fc8bd
mov eax, dword [esp + 0x44]
movups xmm0, xmmword [edx + 0x20]
movups xmmword [esp + 0x20], xmm0
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
movups xmmword [esp + 0x10], xmm1
movups xmmword [esp], xmm0
xor esi, esi
cmp ecx, 8
jb 0x4fc870
xor esi, esi
cmp ecx, 0x10
jb 0x4fc848
mov esi, ecx
and esi, 0xfffffff0
movups xmm0, xmmword [eax]
movups xmm1, xmmword [esp]
xorps xmm1, xmm0
movups xmmword [esp], xmm1
cmp esi, 0x10
je 0x4fc83f
movups xmm0, xmmword [eax + 0x10]
movups xmm1, xmmword [esp + 0x10]
xorps xmm1, xmm0
movups xmmword [esp + 0x10], xmm1
cmp esi, 0x20
je 0x4fc83f
movups xmm0, xmmword [eax + 0x20]
movups xmm1, xmmword [esp + 0x20]
xorps xmm1, xmm0
movups xmmword [esp + 0x20], xmm1
cmp esi, ecx
je 0x4fc86c
test cl, 8
je 0x4fc870
mov edx, esi
mov esi, ecx
and esi, 0xfffffff8
nop
movsd xmm0, qword [eax + edx]
movsd xmm1, qword [esp + edx]
xorps xmm1, xmm0
movlps qword [esp + edx], xmm1
add edx, 8
cmp esi, edx
jne 0x4fc850
cmp esi, ecx
jne 0x4fc870
mov edx, esp
jmp 0x4fc88c
mov edx, esp
nop word cs:[eax + eax]
movzx ebx, byte [eax + esi]
xor byte [esp + esi], bl
inc esi
cmp ecx, esi
jne 0x4fc880
mov esi, dword [esp + 0x3c]
mov ecx, esi
push 0x30
call fcn.004fc8d0
add esp, 4
test eax, eax
je 0x4fc8bb
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
mov eax, 1
jmp 0x4fc8bd
xor eax, eax
add esp, 0x30
pop esi
pop ebx
ret
Function at 0x503300
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, 1
test eax, eax
je 0x5033f3
mov esi, edx
mov edi, ecx
push eax
push ecx
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
je 0x5033f3
mov ebx, dword [esp + 0x18]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebx
push str._s_failed._nExpected:
push eax
call fcn.005172d0
add esp, 0xc
xor ebp, ebp
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[eax + eax]
push 2
call ebx
add esp, 4
movzx ecx, byte [edi + ebp]
push ecx
push str._02x
push eax
call fcn.005172d0
add esp, 0xc
inc ebp
cmp dword [esp + 0x14], ebp
jne 0x503360
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0xd
push str._nCalculated:
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
xor edi, edi
mov ebp, dword [esp + 0x14]
nop word cs:[eax + eax]
push 2
call ebx
add esp, 4
movzx ecx, byte [esi + edi]
push ecx
push str._02x
push eax
call fcn.005172d0
add esp, 0xc
inc edi
cmp ebp, edi
jne 0x5033b0
push 2
call ebx
add esp, 4
push eax
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
push 2
call ebx
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x506e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xd0
mov ecx, dword [esp + 0xe8]
mov eax, dword [esp + 0xec]
xorps xmm0, xmm0
movups xmmword [esp + 0x60], xmm0
movups xmmword [esp + 0x54], xmm0
movups xmmword [esp + 0x44], xmm0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x30], xmm0
mov eax, dword [eax + 0x10]
mov dword [esp + 0x40], eax
test ecx, ecx
je 0x506fcb
mov ebp, dword [esp + 0xe4]
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov dword [esp + 8], ecx
nop dword [eax + eax]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], ebp
xorps xmm0, xmm0
lea eax, [esp + 0x84]
movups xmmword [eax + 0x3c], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
movaps xmm0, xmmword [0x58de80]
movups xmmword [esp + 0x70], xmm0
mov dword [esp + 0x80], 0xc3d2e1f0
lea ecx, [esp + 0x70]
lea edx, [esp + 0x30]
push 1
call fcn.00505d60
add esp, 4
bswap esi
mov eax, dword [esp + 0x80]
mov dword [esp], eax
add esi, eax
setb al
inc esi
sete dl
or dl, al
bswap esi
mov dword [esp + 0x40], esi
mov eax, dword [esp + 0x10]
bswap eax
mov ecx, dword [esp + 0x7c]
add dl, 0xff
adc eax, ecx
bswap eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc]
bswap eax
mov edx, dword [esp + 0x78]
adc eax, edx
bswap eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], eax
bswap edi
mov ebp, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
adc edi, eax
bswap edi
mov dword [esp + 0x34], edi
bswap ebx
adc ebx, ebp
bswap ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], ebx
bswap eax
bswap edx
bswap ecx
mov ebx, dword [esp]
bswap ebx
mov dword [esp], ebx
bswap ebp
sub dword [esp + 8], 0x14
jb 0x506f9f
mov ebx, dword [esp + 4]
mov dword [ebx], ebp
mov ebp, ebx
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
mov eax, dword [esp]
mov dword [ebx + 0x10], eax
add ebp, 0x14
mov eax, dword [esp + 8]
mov ecx, eax
test eax, eax
mov ebx, dword [esp + 0x18]
jne 0x506ea0
jmp 0x506fcb
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
mov eax, dword [esp]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
push dword [esp + 0xc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
add esp, 0xd0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x50e390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 8], esi
jne 0x50e513
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov eax, dword [ecx]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
cmp ebx, 0x10
mov dword [esp + 4], edx
mov dword [esp], eax
jb 0x50e3fa
lea esi, [edx + 0x10]
nop dword [eax]
movups xmm0, xmmword [edi]
movaps xmmword [esp + 0x10], xmm0
movups xmm0, xmmword [esi]
xorps xmm0, xmmword [esp + 0x10]
movups xmmword [esi], xmm0
push dword [ebp + 8]
push esi
push esi
call dword [esp + 0xc]
add esp, 0xc
add edi, 0x10
add ebx, 0xfffffff0
cmp ebx, 0xf
ja 0x50e3d0
test ebx, ebx
mov esi, dword [esp + 4]
je 0x50e4b6
lea eax, [esi + 0x10]
xor ecx, ecx
cmp ebx, 8
jb 0x50e44c
lea edx, [edi + ebx]
cmp eax, edx
jae 0x50e422
mov edx, ebx
or edx, 0x10
add edx, esi
cmp edi, edx
jb 0x50e44c
mov ecx, ebx
and ecx, 8
xor edx, edx
nop dword [eax]
movsd xmm0, qword [edi + edx]
movsd xmm1, qword [eax + edx]
xorps xmm1, xmm0
movlps qword [eax + edx], xmm1
add edx, 8
cmp ecx, edx
jne 0x50e430
cmp ebx, ecx
je 0x50e4aa
mov esi, ebx
sub esi, ecx
mov edx, ecx
not edx
add edx, ebx
mov dword [esp + 8], edx
and esi, 3
je 0x50e46b
nop
movzx edx, byte [edi + ecx]
xor byte [eax + ecx], dl
inc ecx
dec esi
jne 0x50e460
cmp dword [esp + 8], 3
mov esi, dword [esp + 4]
jb 0x50e4aa
nop word cs:[eax + eax]
movzx edx, byte [edi + ecx]
xor byte [esi + ecx + 0x10], dl
movzx edx, byte [edi + ecx + 1]
xor byte [esi + ecx + 0x11], dl
movzx edx, byte [edi + ecx + 2]
xor byte [esi + ecx + 0x12], dl
movzx edx, byte [edi + ecx + 3]
xor byte [esi + ecx + 0x13], dl
add ecx, 4
cmp ebx, ecx
jne 0x50e480
push dword [ebp + 8]
push eax
push eax
call dword [esp + 0xc]
add esp, 0xc
mov edx, dword [esp + 0xc]
cmp dword [edx + 0xc], 0
je 0x50e4da
lea eax, [esi + 0xf]
xor ecx, ecx
nop word cs:[eax + eax]
mov byte [eax], 0
inc ecx
dec eax
cmp ecx, dword [edx + 0xc]
jb 0x50e4d0
lea eax, [esp + 0x10]
push dword [ebp + 8]
push eax
push esi
call dword [esp + 0xc]
add esp, 0xc
movups xmm0, xmmword [esi + 0x10]
xorps xmm0, xmmword [esp + 0x10]
movups xmmword [esi + 0x10], xmm0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x50e50e
add esi, 0x10
push eax
push esi
push dword [ebp + 0xc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x519383
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
add esp, 0xffffff80
cmp dword [ebp + 8], 0
jne 0x519396
jmp 0x5194ca
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0054d320
cmp eax, 1
jne 0x5194c2
mov dword [ebp - 0x77], 0x6f727245
mov dword [ebp - 0x73], 0x6c632072
mov dword [ebp - 0x6f], 0x696e6165
mov dword [ebp - 0x6b], 0x7520676e
mov dword [ebp - 0x67], 0x70732070
mov dword [ebp - 0x63], 0x6b5f6e69
mov dword [ebp - 0x5f], 0x20737965
mov dword [ebp - 0x5b], 0x20726f66
mov dword [ebp - 0x57], 0x65726874
mov dword [ebp - 0x53], 0x206461
lea edx, [ebp - 0x4f]
mov ebx, 0x43
mov eax, 0
mov ecx, edx
and ecx, 1
test ecx, ecx
je 0x51940e
mov byte [edx], al
add edx, 1
sub ebx, 1
mov ecx, edx
and ecx, 2
test ecx, ecx
je 0x519420
mov word [edx], ax
add edx, 2
sub ebx, 2
mov ecx, ebx
shr ecx, 2
mov edi, edx
rep stosd dword es:[edi], eax
mov edx, edi
mov ecx, ebx
and ecx, 2
test ecx, ecx
je 0x51943a
mov word [edx], ax
add edx, 2
and ebx, 1
mov ecx, ebx
test ecx, ecx
je 0x519448
mov byte [edx], al
add edx, 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov dword [esp + 8], 0xa
lea edx, [ebp - 0x77]
add edx, 0x27
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
call eax
mov dword [ebp - 0xc], 0x27
jmp 0x519478
add dword [ebp - 0xc], 1
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x51948f
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
jbe 0x519474
mov eax, dword [ebp - 0xc]
cmp eax, 0x69
ja 0x5194ad
lea edx, [ebp - 0x77]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0xa
mov eax, dword [ebp - 0xc]
add eax, 1
mov byte [ebp + eax - 0x77], 0
lea eax, [ebp - 0x77]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call eax
sub esp, 4
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x51a456
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x51a2cb
mov dword [esp], 0x5ac954
call fcn.00519a1d
mov eax, dword [0x5aa244]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x51a49d
mov eax, dword [ebp - 0x20]
jmp 0x51a5e8
call fcn.0051928c
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x51a4b4
cmp dword [ebp - 0x20], 0
jne 0x51a4be
mov eax, 0
jmp 0x51a5e8
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
lea edx, [eax + 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00519383
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x51a590
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x68], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x5aa244]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x51a5e5
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret