joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [eax]
test edi, edi
je 0x48204b
mov eax, dword [esp + 0x38]
test eax, eax
je 0x48204b
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
jmp 0x482024
test ebp, ebp
je 0x48203f
movzx eax, byte [esi + edi]
add edx, 1
add edi, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and edi, 0xf
mov byte [ecx - 1], al
jne 0x482020
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebp
cmp dword [esp + 0x38], 0xf
jbe 0x482151
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x482083
mov edx, dword [esi + eax]
xor edx, dword [edi + eax]
mov dword [ebp + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x482096
sub dword [esp + 0xc], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0xc], 0xf
ja 0x482066
mov eax, dword [esp + 0x38]
xor edi, edi
mov ebp, dword [esp + 0x38]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x34], eax
add dword [esp + 0x30], eax
test ebp, ebp
jne 0x4820ea
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x482107
mov ecx, dword [esp + 0x34]
lea ebx, [esi + edi]
mov esi, dword [esp + 0x30]
add ecx, edi
add esi, edi
lea esi, [esi]
movzx edx, byte [ebx + eax]
xor dl, byte [esi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x482130
add edi, eax
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x38]
jmp 0x4820d8
Function at 0x482bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
cmp dword [esp + 0x4c], 0xc
mov edi, dword [esp + 0x48]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x15c], 0
mov dword [ebp + 0x158], 0
je 0x482d35
mov eax, dword [esp + 0x4c]
xor edx, edx
mov ebx, edi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x50]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x482cb0
mov dword [esp + 0x48], edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x14]
nop
xor eax, eax
movzx edx, byte [esi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x482c72
mov dword [esp + 4], ebx
sub edi, 0x10
add esi, 0x10
mov dword [esp], ebp
call fcn.00482510
cmp edi, 0xf
ja 0x482c70
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
and dword [esp + 0x4c], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea edi, [edi + eax + 0x10]
mov ebx, dword [esp + 0x4c]
test ebx, ebx
je 0x482cdf
mov ecx, dword [esp + 0x4c]
xor eax, eax
nop
movzx edx, byte [edi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, ecx
jne 0x482cc0
mov eax, dword [esp + 0x14]
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00482510
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
bswap edx
bswap eax
xor dword [ebp + 0xc], eax
mov eax, dword [esp + 0x14]
xor dword [ebp + 8], edx
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00482510
mov ebx, dword [ebp + 0xc]
bswap ebx
add ebx, 1
bswap ebx
mov eax, dword [esp + 0x44]
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [ebp + 0x20]
mov dword [esp + 4], eax
call dword [ebp + 0x160]
mov dword [ebp + 0xc], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi]
mov ebx, 0x2000000
mov dword [ebp], eax
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 8]
mov byte [ebp + 0xf], 1
mov dword [ebp + 8], eax
jmp 0x482d12
Function at 0x482d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x482d95
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x482d9d
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x482e93
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x15c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x482e03
test edi, edi
jne 0x482dc4
jmp 0x482dde
test edi, edi
je 0x482dda
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x482dc0
test edx, edx
je 0x482df1
mov dword [esi + 0x15c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x50]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00482510
cmp edi, 0xf
jbe 0x482e66
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x50]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x482e26
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00482510
cmp ebx, 0xf
ja 0x482e24
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x482e80
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x482e70
mov dword [esi + 0x15c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x482da3
xor eax, eax
jmp 0x482d95
Function at 0x4839b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x40]
mov ebx, dword [eax]
test ebx, ebx
je 0x4839fa
test edx, edx
je 0x4839fa
mov edi, dword [esp + 0x30]
jmp 0x4839db
test edx, edx
je 0x4839f6
movzx eax, byte [esi + ebx]
add edi, 1
add ebx, 1
xor al, byte [edi - 1]
add ecx, 1
sub edx, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x4839d7
mov dword [esp + 0x30], edi
cmp edx, 0xf
jbe 0x483ae2
mov edi, dword [esp + 0x30]
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x38], edx
mov edx, esi
mov dword [esp + 0x34], ecx
mov esi, edi
mov edi, eax
lea esi, [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [esp + 0x48]
cmp ebx, 0xf
mov edx, dword [esp + 0xc]
ja 0x483a52
mov eax, dword [edx + ebx]
xor eax, dword [esi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x483a40
sub edi, 0x10
add ebp, 0x10
add esi, 0x10
cmp edi, 0xf
jbe 0x483a64
xor ebx, ebx
jmp 0x483a20
mov esi, edx
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov ecx, dword [esp + 0x34]
mov edi, edx
sub edx, 0x10
and edx, 0xfffffff0
and edi, 0xf
lea eax, [edx + 0x10]
add dword [esp + 0x30], eax
add ecx, eax
test edi, edi
jne 0x483a96
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp], esi
add esi, ebx
mov dword [esp + 8], eax
call dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edx, dword [esp + 0x30]
add ecx, ebx
lea ebp, [edx + ebx]
nop
movzx edx, byte [esi + eax]
xor dl, byte [ebp + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, edi
jne 0x483ac0
add ebx, eax
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, edx
jmp 0x483a84

Function at 0x486680
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x18]
mov ebx, dword [eax]
lea esi, [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4866df
xor eax, eax
lea esi, [esi]
add ebx, 1
movzx ebx, bl
lea edi, [esi + ebx*4]
mov edx, dword [edi]
add ecx, edx
movzx ecx, cl
lea ebp, [esi + ecx*4]
mov dword [esp], ebp
mov ebp, dword [ebp]
mov dword [edi], ebp
mov edi, dword [esp]
mov dword [edi], edx
mov edi, dword [esp + 0x20]
add edx, ebp
movzx edx, dl
mov edx, dword [esi + edx*4]
xor dl, byte [edi + eax]
mov edi, dword [esp + 0x24]
mov byte [edi + eax], dl
add eax, 1
cmp eax, dword [esp + 0x1c]
jne 0x4866a0
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov dword [eax + 4], ecx
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x488010
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x60
test dl, 1
mov edi, edx
jne 0x488073
test edi, 2
jne 0x488083
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x488041
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x488049
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
mov byte [edx], 0
je 0x48802a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x48802a

Function at 0x488200
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00486ab0

Function at 0x488420
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov eax, 0x57b5a0
push esi
mov ecx, 0x18
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x10]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 4], eax
call sym.adb.exe_SHA1_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA1_Final
mov dword [esp], esi
mov dword [esp + 4], 0x60
call sym.adb.exe_OPENSSL_cleanse
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x494eb0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call sym.adb.exe_AES_set_encrypt_key
test eax, eax
js 0x4950ce
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x494f49
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x494f00
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x4950cc
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x553440]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553440]
mov edx, dword [edx*4 + 0x551c40]
xor edx, dword [esi*4 + 0x552840]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553440]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553440]
xor edx, dword [esi*4 + 0x552440]
xor edx, dword [ebx*4 + 0x552040]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x553440]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553440]
mov edx, dword [edx*4 + 0x551c40]
xor edx, dword [esi*4 + 0x552840]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553440]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553440]
xor edx, dword [esi*4 + 0x552440]
xor edx, dword [ebx*4 + 0x552040]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x553440]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553440]
mov edx, dword [edx*4 + 0x551c40]
xor edx, dword [esi*4 + 0x552840]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553440]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553440]
xor edx, dword [esi*4 + 0x552440]
xor edx, dword [ebx*4 + 0x552040]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x553440]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x553440]
mov edx, dword [edx*4 + 0x551c40]
xor edx, dword [esi*4 + 0x552840]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x553440]
movzx esi, cl
movzx esi, byte [esi*4 + 0x553440]
xor edx, dword [esi*4 + 0x552440]
xor edx, dword [ebx*4 + 0x552040]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x494f60
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x495a60
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
je 0x495a84
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp sym.adb.exe_AES_decrypt
jmp sym.adb.exe_AES_encrypt

Function at 0x495a90
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jne 0x495ad0
mov dword [esp + 0x20], sym.adb.exe_AES_decrypt
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp fcn.00481e20
mov dword [esp + 0x20], sym.adb.exe_AES_encrypt
pop ebx
pop esi
jmp fcn.00481d00
Function at 0x499050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov esi, dword [esp + 0x104]
mov ebx, dword [esp + 0x10c]
mov dword [esp], esi
call sym.adb.exe_EVP_MD_size
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_init
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_Init_ex
test eax, eax
je 0x499278
mov ecx, dword [esp + 0x108]
test ecx, ecx
je 0x49923b
mov dword [esp + 0x1c], 1
lea esi, [esp + 0x5c]
lea ebp, [esp + 0x90]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x108], eax
cmovbe eax, dword [esp + 0x108]
mov dword [esp], esi
mov byte [esp + 0x27], cl
mov edi, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x26], al
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
call sym.adb.exe_HMAC_CTX_copy
test eax, eax
je 0x499278
mov eax, dword [esp + 0xfc]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf8]
mov dword [esp + 4], eax
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x499257
lea eax, [esp + 0x24]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x499257
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_HMAC_Final
test eax, eax
je 0x499257
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
test edi, edi
jne 0x499291
cmp dword [esp + 0x100], 1
mov dword [esp + 0x14], 1
jbe 0x499227
lea esi, [esi]
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_copy
test eax, eax
je 0x499278
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x499257
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_HMAC_Final
test eax, eax
je 0x499257
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
test edi, edi
je 0x499215
xor eax, eax
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x499206
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x100]
jne 0x4991b0
add dword [esp + 0x1c], 1
add ebx, edi
sub dword [esp + 0x108], edi
jne 0x4990d8
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
mov edx, dword [esp + 0x100]
xor eax, eax
test edx, edx
setne al
jmp 0x49926d
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
xor eax, eax
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
add esp, 0xdc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
jmp 0x49919a
Function at 0x4a072c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [esp + 4], 0x4a05a1
mov dword [esp], 0x57b5d4
call fcn.0049fd07
mov eax, dword [0x5262e8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4a0773
mov eax, dword [ebp - 0x20]
jmp 0x4a08b2
call fcn.0049f752
mov dword [ebp - 0x20], eax
mov eax, dword [entry3]
test eax, eax
je 0x4a078a
cmp dword [ebp - 0x20], 0
jne 0x4a0794
mov eax, 0
jmp 0x4a08b2
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x24], 1
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call eax
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x38], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x1c], 0xffffffff
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x60], 0
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x14]
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call eax
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
test eax, eax
jne 0x4a085a
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x68], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + 0x20]
and edx, 0xffffffcf
or edx, 0x10
mov byte [eax + 0x20], dl
mov eax, dword [0x5262e8]
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
test eax, eax
jne 0x4a08af
call sub.msvcrt.dll_abort
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a0976
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004a072c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb0]
mov dword [esp], eax
call fcn.004a05c4
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x4a09cf
mov eax, dword [ebp - 0x14]
add eax, 0x6c
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_longjmp
mov eax, dword [0x5262e8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a0af9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x4a0a61
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4a0a1e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049f686
mov dword [ebp - 0x10], 0
mov eax, dword [0x5262e8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x4a0af9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x64], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4a0a91
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x4a0af9
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049f686
mov dword [ebp - 0x10], 0
mov eax, dword [0x5262e8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax