joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a6ac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.0051a456
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.0051a2ee
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x51a705
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_longjmp
mov eax, dword [0x5aa244]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x51a82f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x51a797
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x51a754
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005191a0
mov dword [ebp - 0x10], 0
mov eax, dword [0x5aa244]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x51a82f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x51a7c7
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x51a82f
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.005191a0
mov dword [ebp - 0x10], 0
mov eax, dword [0x5aa244]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthreadex]
call eax
Function at 0x523070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x52321e
cmp byte [ebx], 0
je 0x5231e8
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x523200
test al, 0x10
je 0x5231e8
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x5230d4
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
mov esi, eax
je 0x52320f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x523163
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x523163
cmp al, 0x5c
je 0x523163
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x523165
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x5231e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x5231e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x5231e0
Function at 0x5284e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x28]
movzx ebx, byte [ebp]
test bl, 1
mov dword [esp], ecx
je 0x5284ff
mov ebx, dword [ebp + 4]
mov ebp, dword [ebp + 8]
jmp 0x528502
inc ebp
shr ebx, 1
mov eax, ebx
mov ecx, ebp
mov edx, ebx
cmp ebx, 4
jb 0x528592
lea edx, [ebx - 4]
test dl, 4
jne 0x528541
imul eax, dword [ebp], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul eax, ebx, 0x5bd1e995
xor eax, ecx
lea ecx, [ebp + 4]
mov esi, edx
cmp edx, 4
jae 0x52854c
jmp 0x528592
mov esi, ebx
mov ecx, ebp
mov eax, ebx
cmp edx, 4
jb 0x528592
mov edx, esi
nop
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
imul esi, dword [ecx + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x528550
cmp edx, 1
je 0x5285b8
cmp edx, 2
mov edi, dword [esp]
je 0x5285ad
cmp edx, 3
jne 0x5285c6
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
jmp 0x5285bb
mov edi, dword [esp]
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x528717
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov eax, ecx
shr eax, 1
and eax, 0x55555555
mov edx, ecx
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [esp + 0x10], eax
cmp eax, 1
mov dword [esp + 8], ecx
ja 0x52862d
lea edx, [ecx - 1]
and edx, esi
jmp 0x52863b
mov edx, esi
cmp esi, ecx
jb 0x52863b
mov eax, esi
xor edx, edx
div dword [esp + 8]
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x528717
mov dword [esp], ebx
mov ebx, dword [eax]
test ebx, ebx
mov eax, 0
je 0x528719
mov dword [esp + 4], edx
mov eax, dword [esp + 8]
dec eax
mov dword [esp + 0xc], eax
jmp 0x52868a
and eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
cmp eax, ecx
jne 0x528717
mov ebx, dword [ebx]
test ebx, ebx
je 0x528717
mov eax, dword [ebx + 4]
cmp eax, esi
jne 0x5286e0
movzx ecx, byte [ebx + 8]
mov eax, ecx
shr eax, 1
test cl, 1
mov edi, dword [ebx + 0xc]
mov edx, edi
cmove edx, eax
cmp edx, dword [esp]
jne 0x528680
test cl, 1
jne 0x5286fa
cmp cl, 2
jb 0x528713
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 9]
cmp dl, byte [ebp + ecx]
jne 0x528680
inc ecx
cmp eax, ecx
jne 0x5286c0
jmp 0x528713
cmp dword [esp + 0x10], 1
jbe 0x528670
mov ecx, dword [esp + 8]
cmp eax, ecx
jb 0x528674
xor edx, edx
div ecx
mov eax, edx
jmp 0x528674
test edi, edi
je 0x528713
push edi
push ebp
push dword [ebx + 0x10]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x528680
mov eax, ebx
jmp 0x528719
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x535c20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x535d57
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor esi, esi
mov ebx, 0
cmp eax, 8
jb 0x535d40
xor ebx, ebx
mov esi, 0
cmp eax, 0x20
jb 0x535cd9
mov esi, eax
and esi, 0xffffffe0
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
nop word cs:[eax + eax]
movdqu xmm2, xmmword [edx + edi]
movdqu xmm3, xmmword [edx + edi + 0x10]
movdqu xmm4, xmmword [ecx + edi]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [ecx + edi + 0x10]
pxor xmm2, xmm3
por xmm1, xmm2
add edi, 0x20
cmp esi, edi
jne 0x535c70
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd ebx, xmm1
cmp esi, eax
je 0x535d52
test al, 0x18
je 0x535d40
mov edi, esi
mov esi, eax
and esi, 0xfffffff8
movzx ebx, bl
movd xmm0, ebx
nop word [eax + eax]
movq xmm1, qword [edx + edi]
movq xmm2, qword [ecx + edi]
pxor xmm2, xmm1
por xmm0, xmm2
add edi, 8
cmp esi, edi
jne 0x535cf0
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd ebx, xmm1
cmp esi, eax
je 0x535d52
nop word cs:[eax + eax]
mov edi, eax
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
mov eax, edi
inc esi
cmp edi, esi
jne 0x535d40
movzx eax, bl
jmp 0x535d59
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x535d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x535d82
mov ecx, dword [esp + 0x10]
mov edx, edi
and edx, 3
cmp edi, 4
jae 0x535d89
mov eax, 0x811c9dc5
xor esi, esi
jmp 0x535dda
mov eax, 0x811c9dc5
jmp 0x535e01
and edi, 0xfffffffc
mov eax, 0x811c9dc5
xor esi, esi
nop word cs:[eax + eax]
movzx ebx, byte [ecx + esi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add esi, 4
cmp edi, esi
jne 0x535da0
test edx, edx
je 0x535e01
add ecx, esi
xor esi, esi
nop word cs:[eax + eax]
movzx edi, byte [ecx + esi]
xor edi, eax
imul eax, edi, 0x1000193
inc esi
cmp edx, esi
jne 0x535df0
pop esi
pop edi
pop ebx
ret
Function at 0x535e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
je 0x535e39
mov ecx, eax
mov edx, eax
and edx, 3
cmp eax, 4
jae 0x535e40
mov eax, 0x811c9dc5
xor edi, edi
jmp 0x535e8a
mov eax, 0x811c9dc5
jmp 0x535eb1
and ecx, 0xfffffffc
mov eax, 0x811c9dc5
xor edi, edi
nop word [eax + eax]
movzx ebx, byte [esi + edi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [esi + edi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [esi + edi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [esi + edi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add edi, 4
cmp ecx, edi
jne 0x535e50
test edx, edx
je 0x535eb1
add esi, edi
xor ecx, ecx
nop word cs:[eax + eax]
movzx edi, byte [esi + ecx]
xor edi, eax
imul eax, edi, 0x1000193
inc ecx
cmp edx, ecx
jne 0x535ea0
pop esi
pop edi
pop ebx
ret

Function at 0x53b810
Capabilities:
Initialize winsock library

Disassembly:
mov al, 1
cmp byte [0x5aca28], 0
je 0x53b81c
ret
push esi
sub esp, 0x190
mov esi, esp
push 0x190
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete al
sete byte [0x5aca28]
add esp, 0x190
pop esi
ret

Function at 0x53b970
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa0
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], 0x80
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x53b9e0
movzx eax, word [esp + 0x12]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov esp, ebp
pop ebp
ret
Function at 0x53ba20
Capabilities:
Connect socket
Resolve dns

Disassembly:
push edi
push esi
sub esp, 0x34
mov esi, 0xffffffff
call fcn.0053b810
test al, al
je 0x53baea
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], eax
mov dword [esp], 0
movups xmmword [esp + 4], xmm0
lea edi, [esp + 4]
push ecx
push 0x594033
push 0x10
push edi
call fcn.00427a70
add esp, 0x10
mov eax, esp
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, dword [esp]
test eax, eax
jne 0x53bac0
test ecx, ecx
je 0x53bac0
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov eax, dword [esp]
cmp esi, 0xffffffff
je 0x53bad2
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x53bad5
push dword [esp]
jmp 0x53baca
mov esi, 0xffffffff
test ecx, ecx
je 0x53baea
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x53baea
push eax
jmp 0x53badf
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esp]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, 0xffffffff
mov eax, esi
add esp, 0x34
pop esi
pop edi
ret
Function at 0x54d518
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x5aa280
call fcn.0054d32a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0xbab1f0ed
jne 0x54d544
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
test eax, eax
jg 0x54d586
mov dword [esp], 2
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call eax
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], str._buildbot_src_android_mingw_toolchain_mingw_mingw_w64_v6.x_mingw_w64_libraries_winpthreads_src_rwlock.c
mov dword [esp + 8], str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov dword [esp + 4], str.Assertion_failed:___s___file__s__line__d_n
mov dword [esp], eax
call fcn.0049dd30
mov dword [esp], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [eax + 4]
sub edx, 1
mov dword [eax + 4], edx
mov dword [esp], 0x5aa280
call fcn.0054d388
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x568e10
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x180
mov esi, dword [esp + 0x194]
xorps xmm0, xmm0
movups xmmword [esp + 0x58], xmm0
movups xmmword [esp + 0x48], xmm0
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x28], xmm0
lea ebx, [esp + 0x28]
push ebx
push 0x20
push dword [esp + 0x1a4]
call sym.fastboot.exe_SHA512
add esp, 0xc
and byte [esp + 0x28], 0xf8
movzx eax, byte [esp + 0x47]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x47], al
xorps xmm0, xmm0
movups xmmword [esp + 0x170], xmm0
movups xmmword [esp + 0x160], xmm0
movups xmmword [esp + 0x150], xmm0
movups xmmword [esp + 0x140], xmm0
movups xmmword [esp + 0x130], xmm0
movups xmmword [esp + 0x120], xmm0
movups xmmword [esp + 0x110], xmm0
movups xmmword [esp + 0x100], xmm0
movups xmmword [esp + 0xf0], xmm0
movups xmmword [esp + 0xe0], xmm0
lea edi, [esp + 0xe0]
push 0x59e108
push ebx
push edi
call fcn.00565bc0
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [esp + 0xc8], xmm0
movups xmmword [esp + 0xb8], xmm0
mov dword [esp + 0xdc], 0
mov dword [esp + 0xd8], 0
movups xmmword [esp + 0xa0], xmm0
movups xmmword [esp + 0x90], xmm0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb0], 0
movups xmmword [esp + 0x78], xmm0
movups xmmword [esp + 0x68], xmm0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
movsd xmm0, qword [esp + 0x150]
movsd qword [esp + 0x20], xmm0
movups xmm0, xmmword [esp + 0x130]
movups xmm1, xmmword [esp + 0x140]
movups xmmword [esp + 0x10], xmm1
movups xmmword [esp], xmm0
lea ebp, [esp + 0xb8]
mov edx, esp
mov ecx, ebp
call fcn.0056f450
lea ebx, [esp + 0x90]
mov ecx, ebx
mov edx, edi
push ebp
call fcn.0056f7e0
add esp, 4
lea edx, [esp + 0x108]
lea edi, [esp + 0x68]
mov ecx, edi
push ebp
call fcn.0056f7e0
add esp, 4
mov ecx, esi
mov edx, edi
call fcn.00564100
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
mov ecx, esp
mov edx, ebx
call fcn.00564100
movzx eax, byte [esp]
shl al, 7
xor byte [esi + 0x1f], al
mov eax, dword [esp + 0x19c]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov eax, dword [esp + 0x198]
movups xmmword [eax + 0x10], xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x30], xmm1
add esp, 0x180
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56e300
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x138
mov esi, dword [esp + 0x14c]
mov eax, dword [esp + 0x150]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp], xmm0
and byte [esp], 0xf8
movups xmmword [esp + 0x10], xmm1
movzx eax, byte [esp + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x1f], al
xorps xmm0, xmm0
movups xmmword [esp + 0x128], xmm0
movups xmmword [esp + 0x118], xmm0
movups xmmword [esp + 0x108], xmm0
movups xmmword [esp + 0xf8], xmm0
movups xmmword [esp + 0xe8], xmm0
movups xmmword [esp + 0xd8], xmm0
movups xmmword [esp + 0xc8], xmm0
movups xmmword [esp + 0xb8], xmm0
movups xmmword [esp + 0xa8], xmm0
movups xmmword [esp + 0x98], xmm0
mov eax, esp
lea ecx, [esp + 0x98]
push 0x59e108
push eax
push ecx
call fcn.00565bc0
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [esp + 0x30], xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x108]
mov edx, dword [esp + 0xe0]
lea edi, [edx + eax]
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esp + 0xe4]
lea ebp, [ebx + ecx]
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], ebp
sub eax, edx
add eax, 0x7fffffe
sub ecx, ebx
add ecx, 0x3fffffe
movdqu xmm0, xmmword [esp + 0xe8]
movdqu xmm1, xmmword [esp + 0xc0]
movdqu xmm2, xmmword [esp + 0xd0]
movdqa xmm3, xmm1
paddd xmm3, xmm0
psubd xmm0, xmm1
paddd xmm0, xmmword [0x59e050]
movdqu xmmword [esp + 0x70], xmm3
movdqu xmmword [esp + 0x48], xmm0
movdqu xmm0, xmmword [esp + 0xf8]
movdqa xmm1, xmm2
paddd xmm1, xmm0
psubd xmm0, xmm2
paddd xmm0, xmmword [0x59e060]
movdqu xmmword [esp + 0x80], xmm1
movdqu xmmword [esp + 0x58], xmm0
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
lea edi, [esp + 0x20]
lea edx, [esp + 0x48]
mov ecx, edi
call fcn.0056f450
lea edx, [esp + 0x70]
mov ecx, edi
push edi
call fcn.0056f7e0
add esp, 4
mov ecx, esi
mov edx, edi
call fcn.00564100
add esp, 0x138
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call sym.icucnv69.dll_u_strFromUTF32WithSub_69
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icucnv69.dll_u_strFromUTF32WithSub_69
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call sym.icucnv69.dll_u_strFromUTF32WithSub_69
pop ecx
jmp 0x10018771
push esi
call sym.icucnv69.dll_u_strFromUTF32WithSub_69
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret