joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb130
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
mov ebx, dword [ecx + 4]
mov dword [eax], ebx
test edi, edi
je 0x5bb165
mov eax, dword [esi + 0xb4]
cmp eax, ebx
jne 0x5bb172
lea eax, [esi + 0x84]
test ebx, ebx
jne 0x5bb1aa
jmp 0x5bb345
mov eax, 1
add esp, 4
jmp 0x5bb351
mov byte [esi + eax + 0xa4], 0x80
mov ecx, dword [esi + 0xb4]
mov eax, ecx
not eax
add eax, ebx
je 0x5bb19c
add ecx, esi
add ecx, 0xa5
push eax
push 0
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [esi + 0x94]
test ebx, ebx
je 0x5bb345
xor ecx, ecx
cmp ebx, 8
jb 0x5bb2d0
mov edx, edi
sub edx, eax
cmp edx, 0x20
jb 0x5bb2d0
mov edx, edi
sub edx, esi
add edx, 0xffffff5c
cmp edx, 0x20
jb 0x5bb2d0
xor ecx, ecx
cmp ebx, 0x20
jb 0x5bb29e
lea ecx, [ebx - 0x20]
mov edx, ecx
shr edx, 5
inc edx
mov dword [esp], edx
xor edx, edx
cmp ecx, 0x20
jb 0x5bb25a
mov ecx, dword [esp]
and ecx, 0xfffffffe
xor edx, edx
nop dword [eax + eax]
movups xmm0, xmmword [esi + edx + 0xa4]
movups xmm1, xmmword [esi + edx + 0xb4]
movups xmm2, xmmword [eax + edx]
xorps xmm2, xmm0
movups xmm0, xmmword [eax + edx + 0x10]
xorps xmm0, xmm1
movups xmmword [edi + edx], xmm2
movups xmmword [edi + edx + 0x10], xmm0
movups xmm0, xmmword [esi + edx + 0xc4]
movups xmm1, xmmword [esi + edx + 0xd4]
movups xmm2, xmmword [eax + edx + 0x20]
xorps xmm2, xmm0
movups xmm0, xmmword [eax + edx + 0x30]
xorps xmm0, xmm1
movups xmmword [edi + edx + 0x20], xmm2
movups xmmword [edi + edx + 0x30], xmm0
add edx, 0x40
add ecx, 0xfffffffe
jne 0x5bb200
mov ecx, ebx
and ecx, 0xffffffe0
mov ebp, ebx
test byte [esp], 1
je 0x5bb28f
movups xmm0, xmmword [esi + edx + 0xa4]
movups xmm1, xmmword [esi + edx + 0xb4]
movups xmm2, xmmword [eax + edx]
xorps xmm2, xmm0
movups xmm0, xmmword [eax + edx + 0x10]
xorps xmm0, xmm1
movups xmmword [edi + edx], xmm2
movups xmmword [edi + edx + 0x10], xmm0
cmp ebp, ecx
mov ebx, ebp
je 0x5bb345
test bl, 0x18
je 0x5bb2d0
mov edx, ecx
mov ecx, ebx
and ecx, 0xfffffff8
nop word cs:[eax + eax]
movsd xmm0, qword [esi + edx + 0xa4]
movsd xmm1, qword [eax + edx]
xorps xmm1, xmm0
movlps qword [edi + edx], xmm1
add edx, 8
cmp ecx, edx
jne 0x5bb2b0
cmp ebx, ecx
je 0x5bb345
mov edx, ecx
not edx
add edx, ebx
mov dword [esp], edx
mov ebp, ebx
and ebp, 3
je 0x5bb2f2
movzx edx, byte [eax + ecx]
xor dl, byte [esi + ecx + 0xa4]
mov byte [edi + ecx], dl
inc ecx
dec ebp
jne 0x5bb2e0
cmp dword [esp], 3
jb 0x5bb345
nop dword [eax + eax]
movzx edx, byte [eax + ecx]
xor dl, byte [esi + ecx + 0xa4]
mov byte [edi + ecx], dl
movzx edx, byte [eax + ecx + 1]
xor dl, byte [esi + ecx + 0xa5]
mov byte [edi + ecx + 1], dl
movzx edx, byte [eax + ecx + 2]
xor dl, byte [esi + ecx + 0xa6]
mov byte [edi + ecx + 2], dl
movzx edx, byte [eax + ecx + 3]
xor dl, byte [esi + ecx + 0xa7]
mov byte [edi + ecx + 3], dl
add ecx, 4
cmp ebx, ecx
jne 0x5bb300
mov eax, dword [esi]
push ebx
push edi
push edi
push esi
call dword [eax + 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d5e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
test ecx, ecx
je 0x5d5f5c
xor eax, eax
cmp ecx, 0x30
ja 0x5d5f8c
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [edx + 0x20]
movaps xmmword [esp + 0x20], xmm0
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
movaps xmmword [esp + 0x10], xmm1
movaps xmmword [esp], xmm0
xor esi, esi
cmp ecx, 8
jb 0x5d5f40
xor esi, esi
cmp ecx, 0x10
jb 0x5d5f0e
mov esi, ecx
and esi, 0xfffffff0
movups xmm0, xmmword [eax]
xorps xmm0, xmmword [esp]
movaps xmmword [esp], xmm0
cmp esi, 0x10
je 0x5d5f05
movups xmm0, xmmword [eax + 0x10]
xorps xmm0, xmmword [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
cmp esi, 0x20
je 0x5d5f05
movups xmm0, xmmword [eax + 0x20]
xorps xmm0, xmmword [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
cmp esi, ecx
je 0x5d5f3c
test cl, 8
je 0x5d5f40
mov edx, esi
mov esi, ecx
and esi, 0xfffffff8
nop word cs:[eax + eax]
movsd xmm0, qword [eax + edx]
movsd xmm1, qword [esp + edx]
xorps xmm1, xmm0
movlps qword [esp + edx], xmm1
add edx, 8
cmp esi, edx
jne 0x5d5f20
cmp esi, ecx
jne 0x5d5f40
mov edx, esp
jmp 0x5d5f5c
mov edx, esp
nop word cs:[eax + eax]
movzx ebx, byte [eax + esi]
xor byte [esp + esi], bl
inc esi
cmp ecx, esi
jne 0x5d5f50
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x30
call fcn.005d5fa0
add esp, 4
test eax, eax
je 0x5d5f8a
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
mov eax, 1
jmp 0x5d5f8c
xor eax, eax
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret
Function at 0x5d6960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x5d6985
cmp ecx, 0xa
ja 0x5d6996
push 0xc6
push str.external_boringssl_src_crypto_fipsmodule_rsa_padding.c
push 0x7e
jmp 0x5d6a72
push 0xbd
push str.external_boringssl_src_crypto_fipsmodule_rsa_padding.c
push pe_nt_image_headers32
jmp 0x5d6a72
mov edx, dword [esp + 0x2c]
movzx eax, byte [edx]
dec eax
mov dword [esp + 4], eax
movzx eax, byte [edx + 1]
xor eax, 2
dec eax
mov dword [esp], eax
and ecx, 0xfffffffe
add ecx, 0xfffffffc
mov dword [esp + 8], ecx
mov esi, 0xffffffff
mov edx, 2
xor ebp, ebp
mov ecx, 0
nop dword [eax + eax]
mov ebx, edx
mov eax, edx
xor eax, ebp
mov edi, dword [esp + 0x2c]
cmp byte [edi + edx], 0
mov edx, 0
cmove edx, esi
cmove esi, ecx
and edx, eax
xor edx, ebp
lea eax, [ebx + 1]
xor eax, edx
cmp byte [edi + ebx + 1], 0
mov ebp, 0
cmove ebp, esi
cmove esi, ecx
and ebp, eax
xor ebp, edx
lea edx, [ebx + 2]
add ebx, 0xfffffffe
cmp ebx, dword [esp + 8]
jne 0x5d69d0
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
test bl, 1
je 0x5d6a38
mov ecx, edx
xor ecx, ebp
xor edi, edi
cmp byte [eax + edx], 0
mov edx, 0
cmove edx, esi
cmove esi, edi
and edx, ecx
xor ebp, edx
lea ecx, [ebp - 0xa]
mov edx, ebp
not edx
test ecx, edx
js 0x5d6a63
mov ecx, dword [esp]
and ecx, dword [esp + 4]
jns 0x5d6a63
cmp esi, 0xffffffff
je 0x5d6a63
inc ebp
mov ecx, ebx
sub ebx, ebp
cmp ebx, dword [esp + 0x28]
jbe 0x5d6a88
push 0xf3
jmp 0x5d6a68
push 0xeb
push str.external_boringssl_src_crypto_fipsmodule_rsa_padding.c
push 0x89
push 0
push 4
call sym.adb.exe_ERR_put_error
add esp, 0x14
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebp, ecx
je 0x5d6a9c
add eax, ebp
push ebx
push eax
push dword [esp + 0x28]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x24]
mov dword [eax], ebx
mov eax, 1
jmp 0x5d6a80
Function at 0x5de6a0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ebx, 1
test eax, eax
je 0x5de793
mov esi, edx
mov edi, ecx
push eax
push ecx
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
je 0x5de793
mov ebx, dword [esp + 0x18]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebx
push str._s_failed._nExpected:
push eax
call fcn.005f56e0
add esp, 0xc
xor ebp, ebp
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word cs:[eax + eax]
push 2
call ebx
add esp, 4
movzx ecx, byte [edi + ebp]
push ecx
push str._02x
push eax
call fcn.005f56e0
add esp, 0xc
inc ebp
cmp dword [esp + 0x14], ebp
jne 0x5de700
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0xd
push str._nCalculated:
call fcn.005fe788
add esp, 0x10
xor edi, edi
mov ebp, dword [esp + 0x14]
nop word cs:[eax + eax]
push 2
call ebx
add esp, 4
movzx ecx, byte [esi + edi]
push ecx
push str._02x
push eax
call fcn.005f56e0
add esp, 0xc
inc edi
cmp ebp, edi
jne 0x5de750
push 2
call ebx
add esp, 4
push eax
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
push 2
call ebx
add esp, 4
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5e9780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 8], esi
jne 0x5e9903
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov dword [esp + 0xc], ecx
mov eax, dword [ecx]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
cmp ebx, 0x10
mov dword [esp + 4], edx
mov dword [esp], eax
jb 0x5e97ea
lea esi, [edx + 0x10]
nop dword [eax]
movups xmm0, xmmword [edi]
movaps xmmword [esp + 0x10], xmm0
movups xmm0, xmmword [esi]
xorps xmm0, xmmword [esp + 0x10]
movups xmmword [esi], xmm0
push dword [ebp + 8]
push esi
push esi
call dword [esp + 0xc]
add esp, 0xc
add edi, 0x10
add ebx, 0xfffffff0
cmp ebx, 0xf
ja 0x5e97c0
test ebx, ebx
mov esi, dword [esp + 4]
je 0x5e98a6
lea eax, [esi + 0x10]
xor ecx, ecx
cmp ebx, 8
jb 0x5e983c
lea edx, [edi + ebx]
cmp eax, edx
jae 0x5e9812
mov edx, ebx
or edx, 0x10
add edx, esi
cmp edi, edx
jb 0x5e983c
mov ecx, ebx
and ecx, 8
xor edx, edx
nop dword [eax]
movsd xmm0, qword [edi + edx]
movsd xmm1, qword [eax + edx]
xorps xmm1, xmm0
movlps qword [eax + edx], xmm1
add edx, 8
cmp ecx, edx
jne 0x5e9820
cmp ebx, ecx
je 0x5e989a
mov edx, ecx
not edx
add edx, ebx
mov dword [esp + 8], edx
mov esi, ebx
and esi, 3
je 0x5e985b
nop dword [eax]
movzx edx, byte [edi + ecx]
xor byte [eax + ecx], dl
inc ecx
dec esi
jne 0x5e9850
cmp dword [esp + 8], 3
mov esi, dword [esp + 4]
jb 0x5e989a
nop word cs:[eax + eax]
movzx edx, byte [edi + ecx]
xor byte [esi + ecx + 0x10], dl
movzx edx, byte [edi + ecx + 1]
xor byte [esi + ecx + 0x11], dl
movzx edx, byte [edi + ecx + 2]
xor byte [esi + ecx + 0x12], dl
movzx edx, byte [edi + ecx + 3]
xor byte [esi + ecx + 0x13], dl
add ecx, 4
cmp ebx, ecx
jne 0x5e9870
push dword [ebp + 8]
push eax
push eax
call dword [esp + 0xc]
add esp, 0xc
mov edx, dword [esp + 0xc]
cmp dword [edx + 0xc], 0
je 0x5e98ca
lea eax, [esi + 0xf]
xor ecx, ecx
nop word cs:[eax + eax]
mov byte [eax], 0
inc ecx
dec eax
cmp ecx, dword [edx + 0xc]
jb 0x5e98c0
lea eax, [esp + 0x10]
push dword [ebp + 8]
push eax
push esi
call dword [esp + 0xc]
add esp, 0xc
movups xmm0, xmmword [esi + 0x10]
xorps xmm0, xmmword [esp + 0x10]
movups xmmword [esi + 0x10], xmm0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x5e98fe
add esi, 0x10
push eax
push esi
push dword [ebp + 0xc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5fc500
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5fc54d
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor esi, esi
mov ebx, 0
cmp eax, 8
jb 0x5fc690
xor ebx, ebx
mov esi, 0
cmp eax, 0x20
jb 0x5fc632
lea esi, [eax - 0x20]
mov ebx, esi
shr ebx, 5
inc ebx
cmp esi, 0x20
jae 0x5fc554
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
jmp 0x5fc5c6
xor eax, eax
jmp 0x5fc6a5
mov esi, ebx
and esi, 0xfffffffe
pxor xmm0, xmm0
xor edi, edi
pxor xmm1, xmm1
nop word cs:[eax + eax]
movdqu xmm2, xmmword [edx + edi]
movdqu xmm3, xmmword [edx + edi + 0x10]
movdqu xmm4, xmmword [ecx + edi]
pxor xmm4, xmm2
por xmm4, xmm0
movdqu xmm2, xmmword [ecx + edi + 0x10]
pxor xmm2, xmm3
por xmm2, xmm1
movdqu xmm1, xmmword [edx + edi + 0x20]
movdqu xmm3, xmmword [edx + edi + 0x30]
movdqu xmm0, xmmword [ecx + edi + 0x20]
pxor xmm0, xmm1
por xmm0, xmm4
movdqu xmm1, xmmword [ecx + edi + 0x30]
pxor xmm1, xmm3
por xmm1, xmm2
add edi, 0x40
add esi, 0xfffffffe
jne 0x5fc570
mov esi, eax
and esi, 0xffffffe0
test bl, 1
je 0x5fc5f6
movdqu xmm2, xmmword [edx + edi]
movdqu xmm3, xmmword [edx + edi + 0x10]
movdqu xmm4, xmmword [ecx + edi]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [ecx + edi + 0x10]
pxor xmm2, xmm3
por xmm1, xmm2
por xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd ebx, xmm0
cmp esi, eax
je 0x5fc6a2
test al, 0x18
je 0x5fc690
mov edi, esi
mov esi, eax
and esi, 0xfffffff8
movzx ebx, bl
movd xmm0, ebx
movq xmm1, qword [edx + edi]
movq xmm2, qword [ecx + edi]
pxor xmm2, xmm1
por xmm0, xmm2
add edi, 8
cmp esi, edi
jne 0x5fc640
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd ebx, xmm1
cmp esi, eax
je 0x5fc6a2
nop word cs:[eax + eax]
mov edi, eax
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
mov eax, edi
inc esi
cmp edi, esi
jne 0x5fc690
movzx eax, bl
pop esi
pop edi
pop ebx
ret

Function at 0x5fc6b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x5fc6d2
mov ecx, dword [esp + 0x10]
mov edx, edi
and edx, 3
cmp edi, 4
jae 0x5fc6d9
mov eax, 0x811c9dc5
xor esi, esi
jmp 0x5fc72a
mov eax, 0x811c9dc5
jmp 0x5fc751
and edi, 0xfffffffc
mov eax, 0x811c9dc5
xor esi, esi
nop word cs:[eax + eax]
movzx ebx, byte [ecx + esi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add esi, 4
cmp edi, esi
jne 0x5fc6f0
test edx, edx
je 0x5fc751
add ecx, esi
xor esi, esi
nop word cs:[eax + eax]
movzx edi, byte [ecx + esi]
xor edi, eax
imul eax, edi, 0x1000193
inc esi
cmp edx, esi
jne 0x5fc740
pop esi
pop edi
pop ebx
ret
Function at 0x5fc760
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
je 0x5fc789
mov ecx, eax
mov edx, eax
and edx, 3
cmp eax, 4
jae 0x5fc790
mov eax, 0x811c9dc5
xor edi, edi
jmp 0x5fc7da
mov eax, 0x811c9dc5
jmp 0x5fc801
and ecx, 0xfffffffc
mov eax, 0x811c9dc5
xor edi, edi
nop word [eax + eax]
movzx ebx, byte [esi + edi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [esi + edi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [esi + edi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [esi + edi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add edi, 4
cmp ecx, edi
jne 0x5fc7a0
test edx, edx
je 0x5fc801
add esi, edi
xor ecx, ecx
nop word cs:[eax + eax]
movzx edi, byte [esi + ecx]
xor edi, eax
imul eax, edi, 0x1000193
inc ecx
cmp edx, ecx
jne 0x5fc7f0
pop esi
pop edi
pop ebx
ret
Function at 0x5ff730
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x5ff7db
mov eax, dword [edi + 0x24]
mov esi, dword [eax + 4]
push 0x8c36e9
push str.libusb_close
push 4
push esi
call fcn.005fe840
add esp, 0x10
push dword [esi + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5ff775
mov ecx, esi
mov edx, edi
call fcn.005ff820
jmp 0x5ff7db
lea ebx, [esi + 0xd8]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xf0]
mov ecx, dword [esi + 0xf4]
lea edx, [ecx + 1]
mov dword [esi + 0xf4], edx
test ecx, ecx
je 0x5ff7e1
test eax, eax
je 0x5ff7f0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call fcn.00603560
mov ecx, esi
mov edx, edi
call fcn.005ff820
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [esi + 0xf4]
mov eax, dword [esi + 0xf0]
je 0x5ff7fe
test eax, eax
je 0x5ff80b
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call fcn.006035c0
pop esi
pop edi
pop ebx
ret 4
mov ecx, eax
or ecx, 0x20
mov dword [esi + 0xf0], ecx
test eax, eax
jne 0x5ff79f
lea eax, [esi + 0xc]
push eax
call fcn.007595f0
add esp, 4
jmp 0x5ff79f
and eax, 0xffffffdf
mov dword [esi + 0xf0], eax
test eax, eax
jne 0x5ff7ce
lea eax, [esi + 0xc]
push eax
call fcn.00759630
add esp, 4
jmp 0x5ff7ce
Function at 0x602990
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 0x84]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0xc], eax
push eax
call esi
lea eax, [ebx + 0x9c]
mov dword [esp + 8], eax
push eax
call esi
lea eax, [ebx + 0xbc]
mov dword [esp + 4], eax
push eax
call esi
lea eax, [ebx + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea edi, [ebx + 0xd8]
push edi
call esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx + 0xb8], eax
lea eax, [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x7c], eax
lea eax, [ebx + 0xf8]
lea ecx, [ebx + 0x100]
movd xmm0, ecx
movd xmm1, eax
punpckldq xmm1, xmm0
pshufd xmm0, xmm1, 0x50
movdqu xmmword [ebx + 0xf8], xmm0
lea eax, [ebx + 0x110]
lea ecx, [ebx + 0x118]
movd xmm0, ecx
movd xmm1, eax
punpckldq xmm1, xmm0
pshufd xmm0, xmm1, 0x50
movdqu xmmword [ebx + 0x110], xmm0
lea ebp, [ebx + 0xc]
push ebp
call fcn.00759560
add esp, 4
test eax, eax
js 0x602a8b
push 0
push dword [ebx + 0xc]
push ebx
call fcn.00602b20
add esp, 0xc
test eax, eax
js 0x602a8f
lea esi, [ebx + 0x10]
push esi
call fcn.00759670
add esp, 4
test eax, eax
je 0x602a93
push str.timer_not_available_for_timeouts
push str.usbi_io_init
push 4
push ebx
call fcn.005fe840
add esp, 0x10
xor esi, esi
jmp 0x602b08
mov esi, eax
jmp 0x602ae1
mov esi, eax
jmp 0x602ad8
mov dword [esp], esi
push str.using_timer_for_timeouts
push str.usbi_io_init
push 4
push ebx
call fcn.005fe840
add esp, 0x10
push 0
push dword [ebx + 0x10]
push ebx
call fcn.00602b20
add esp, 0xc
xor esi, esi
test eax, eax
jns 0x602b08
push dword [esp]
mov esi, eax
call fcn.007596c0
add esp, 4
push dword [ebx + 0xc]
push ebx
call fcn.00602bd0
add esp, 8
push ebp
call fcn.007595b0
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [esp + 0xc]
call ebp
push dword [esp + 8]
call ebp
push dword [esp + 4]
call ebp
push edi
call ebp
push dword [ebx + 0xb8]
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x611020
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x24]
movzx ebx, byte [eax]
test bl, 1
je 0x611047
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ebx, 4
jae 0x61104f
mov ecx, ebx
mov edx, ebx
jmp 0x6110d2
inc eax
shr ebx, 1
cmp ebx, 4
jb 0x61103e
lea edx, [ebx - 4]
test dl, 4
jne 0x61107e
imul ecx, dword [eax], 0x5bd1e995
mov esi, ecx
shr esi, 0x18
xor esi, ecx
imul esi, esi, 0x5bd1e995
imul ecx, ebx, 0x5bd1e995
xor ecx, esi
add eax, 4
mov ebx, edx
cmp edx, 4
jae 0x611085
jmp 0x6110d2
mov ecx, ebx
cmp edx, 4
jb 0x6110d2
mov edx, ebx
nop word [eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
imul esi, dword [eax + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x611090
mov esi, dword [esp + 0x28]
cmp edx, 1
je 0x6110f7
cmp edx, 2
je 0x6110ee
cmp edx, 3
jne 0x611102
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
imul eax, dword [esi], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0xde8f4ca8
imul ecx, dword [esi + 4], 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul ecx, edx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ebp, eax
shr ebp, 0xf
xor ebp, eax
push 0x10
call fcn.0051c3d0
add esp, 4
mov dword [esp], eax
mov dword [eax], edi
mov ebx, dword [esp + 0x1c]
xor edi, ebx
mov ecx, 0xeb382d69
mov eax, edi
mul ecx
imul ecx, edi, 0x9ddfea08
add ecx, edx
mov esi, dword [esp + 0x20]
imul edi, esi, 0xeb382d69
add edi, ecx
xor esi, edi
shr edi, 0xf
xor edi, ebx
xor edi, eax
mov eax, edi
mov ecx, 0xeb382d69
mul ecx
mov ecx, dword [esp]
mov dword [ecx + 4], 0
mov dword [ecx + 8], ebp
imul ecx, edi, 0x9ddfea08
add ecx, edx
imul ebx, esi, 0xeb382d69
add ebx, ecx
imul ecx, ebx, 0xeb382d69
mov dword [esp + 4], ecx
shr ebx, 0xf
xor ebx, eax
mov eax, ebx
mov esi, 0xeb382d69
mul esi
mov edi, eax
imul ecx, ebx, 0x9ddfea08
add ecx, edx
xor ebp, eax
mov eax, ebp
mul esi
mov ebx, eax
add ecx, dword [esp + 4]
imul eax, ebp, 0x9ddfea08
add eax, edx
imul edx, ecx, 0xeb382d69
add edx, eax
xor ecx, edx
shr edx, 0xf
xor ebx, edi
xor ebx, edx
mov eax, ebx
mov ebp, 0xeb382d69
mul ebp
imul edi, ebx, 0x9ddfea08
add edi, edx
imul esi, ecx, 0xeb382d69
add esi, edi
imul ecx, esi, 0xeb382d69
shr esi, 0xf
xor esi, eax
mov eax, esi
mul ebp
mov edi, eax
mov ebx, edx
imul eax, esi, 0x9ddfea08
add ebx, eax
add ebx, ecx
mov eax, dword [esp]
mov dword [eax + 0xc], 0
push eax
call fcn.0051c570
add esp, 4
mov eax, edi
mov edx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6119a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x22c
mov ebx, dword [ebp + 8]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x611b33
cmp word [ebx], 0
je 0x611b00
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x611b15
test al, 0x10
je 0x611b00
lea esi, [ebp - 0x220]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov dword [esp], 0x8c9000
mov edi, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov dword [esp], 0x8c9004
mov ebx, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea edx, [edi + ebx + 0x21d]
add eax, edx
add eax, eax
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test eax, eax
mov ebx, eax
je 0x611b24
lea edi, [eax + 0x434]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscpy
cmp word [ebx + 0x434], 0
jne 0x611ac0
mov dword [esp], edi
mov dword [esp + 4], 0x8c9004
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscat
xor edx, edx
xor eax, eax
mov word [ebx + 0x222], dx
lea edx, [ebx + 0x224]
mov ecx, 0x82
mov word [ebx + 0x220], ax
mov edi, edx
xor eax, eax
mov dword [ebx + 0x42c], 0xffffffff
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x21c], 0
rep stosd dword es:[edi], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x2f
je 0x611a60
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x5c
je 0x611a60
mov dword [esp + 4], 0x8c9000
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscat
jmp 0x611a60
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x611ab3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x611ab3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x611ab3