joyce8/EMBER2024-capa huggingface dataset:
Function at 0x544750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x54481e
movq xmm4, qword [0x7891d0]
movdqa xmm5, xmmword [0x7891e0]
nop word cs:[eax + eax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x5447a0
movq xmm4, qword [0x7891f0]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
pmovzxdq xmm3, qword [0x789230]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x5448a3
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x54487c
pmovzxdq xmm1, qword [0x789230]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x789200], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x789210], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x789220], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x54ca60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x81527c]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x54cab0
mov esi, dword [0x815278]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x81527c
call fcn.005c8bdd
add esp, 4
cmp dword [0x81527c], 0xffffffff
jne 0x54ca93
lea edi, [ebp - 0x128]
xor esi, esi
push 0x118
push esi
push edi
call fcn.005cced0
add esp, 0xc
mov dword [edi - 4], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ebx, [ebp - 0x130]
mov dword [ebx], esi
push ebx
push esi
push esi
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x58
call fcn.005c8b59
add esp, 4
mov esi, eax
mov ebx, dword [ebx]
mov eax, dword [0x8152ac]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x54cb59
mov ecx, esi
push ebx
push 0x815288
push edi
call fcn.004a5630
mov dword [0x815278], esi
push 0x81527c
call fcn.005c8c57
add esp, 4
jmp 0x54ca93
push 0x8152ac
call fcn.005c8bdd
add esp, 4
cmp dword [0x8152ac], 0xffffffff
jne 0x54cb33
xorps xmm0, xmm0
movups xmmword [0x815298], xmm0
movups xmmword [0x815288], xmm0
mov dword [0x8152a8], 0
push 0x815288
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x8152ac
call fcn.005c8c57
add esp, 4
jmp 0x54cb33
Function at 0x54df90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x54e00e
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x54dff7
lea eax, [edi + 1]
cmp eax, 2
jb 0x54dfdb
mov dword [esi], edi
call fcn.005613d0
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x54e012
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.005613d0
push dword [esi]
call fcn.0054cbb0
add esp, 4
mov dword [esi], 0
jmp 0x54dfcc
mov byte [esi + 4], 0
int3

Function at 0x551410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ebx, [esp + 0x10]
push 0x5f
push str....._base_files_file_win.cc
push str.ReadAtCurrentPos
push ebx
call fcn.005613a0
add esp, 0x10
mov ecx, edi
push 0
push ebx
mov ebx, dword [ebp + 0xc]
call fcn.005546a0
test ebx, ebx
js 0x5514d1
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.00571f20
test al, al
jne 0x5514ed
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push 0
push eax
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5514db
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x5514d6
lea ecx, [esp + 0x10]
call fcn.00571fb0
lea ecx, [esp + 0x20]
call fcn.00554710
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.005c9f16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
xor ebx, ebx
dec ebx
jmp 0x5514b1
int3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x5514a8
lea ecx, [esp + 0x10]
push 0
push ebx
push esi
push str.File::ReadAtCurrentPos
call fcn.006b8950
jmp 0x551485
Function at 0x551510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
lea ebx, [esp + 0x10]
push 0x7f
push str....._base_files_file_win.cc
push str.Write
push ebx
call fcn.005613a0
add esp, 0x10
lea ecx, [esp + 0x30]
push 0
push ebx
call fcn.005546a0
mov edi, 0xffffffff
cmp dword [ebp + 0xc], 0
js 0x5515e0
mov esi, dword [ebp + 0x14]
test esi, esi
js 0x5515e0
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.00571f20
test al, al
jne 0x551607
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 0xffffffff
lea eax, [esp + 0xc]
push ebx
push eax
push esi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x551600
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x28]
call fcn.00571fb0
lea ecx, [esp + 0x30]
call fcn.00554710
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.005c9f16
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov edi, 0xffffffff
jmp 0x5515d7
lea ecx, [esp + 0x28]
push 0
push esi
push dword [esp + 0x10]
push str.File::Write
call fcn.006b8950
jmp 0x551594
Function at 0x5613e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c8a0

Function at 0x5613f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
js 0x5613ff
pop ebp
jmp fcn.0057c7c0
call fcn.00649760
xor eax, eax
pop ebp
ret

Function at 0x564080
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00551320
mov dword [esi], 0
test eax, eax
je 0x5640c7
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x5640f6
lea eax, [ebx + 1]
cmp eax, 2
jb 0x5640bd
mov dword [esi], ebx
call fcn.005613d0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.005616a0
lea ecx, [esi + 0x10]
call fcn.00571f50
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005613d0
push dword [esi]
call fcn.0054cbb0
add esp, 4
mov dword [esi], 0
jmp 0x5640ae

Function at 0x566060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x566096
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
nop word [eax + eax]
movzx eax, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x566080
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x566091
Function at 0x567750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x11c]
test eax, eax
jle 0x567917
mov edx, dword [edx + 0x118]
mov esi, eax
cmp dword [edx + esi*4 - 4], 0
je 0x5678d9
lea edi, [esi - 1]
shl edi, 5
mov esi, dword [edx + esi*4 - 4]
xor edx, edx
test esi, esi
setne dl
mov dword [ebp - 0x18], edx
mov edx, esi
shr edx, 0x10
cmp esi, 0x10000
cmovb edx, esi
mov ebx, 0
setae bl
shl ebx, 4
mov dword [ebp - 0x14], ebx
mov esi, edx
shr esi, 8
xor ebx, ebx
cmp edx, 0x100
cmovb esi, edx
setae bl
mov dword [ebp - 0x10], ebx
mov edx, esi
shr edx, 4
xor ebx, ebx
cmp esi, 0x10
cmovb edx, esi
setae bl
mov dword [ebp - 0x1c], ebx
mov esi, edx
shr esi, 2
xor ebx, ebx
cmp edx, 4
cmovb esi, edx
setae bl
mov edx, dword [ebp - 0x18]
or edx, edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
lea edx, [edx + edi*8]
mov edi, dword [ebp - 0x1c]
lea edx, [edx + edi*4]
lea edx, [edx + ebx*2]
cmp esi, 2
sbb edx, 0xffffffff
add edx, 7
shr edx, 3
cmp edx, ecx
jne 0x5678ee
lea edx, [eax*4]
cmp edx, ecx
jb 0x567912
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
cmp ecx, 4
jb 0x567842
mov esi, dword [edi + ecx - 4]
add ecx, 0xfffffffc
bswap esi
mov dword [edx], esi
add edx, 4
dec eax
cmp ecx, 3
ja 0x56782e
test ecx, ecx
je 0x567863
xor esi, esi
xor edi, edi
mov ebx, edi
shl ebx, 8
mov edi, dword [ebp + 0x10]
movzx edi, byte [edi + esi]
or edi, ebx
inc esi
cmp ecx, esi
jne 0x56784a
mov dword [edx], edi
add edx, 4
dec eax
shl eax, 2
test eax, eax
jne 0x567926
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x11c]
mov dword [ebp - 0x10], 0x14b
test ecx, ecx
je 0x5678f5
mov eax, dword [eax + 0x118]
mov dword [ebp - 0x14], eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + ebx*4]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + ebx*4]
mov ecx, esi
xor ecx, edi
mov eax, esi
sub eax, edi
lea edi, [ecx - 1]
xor eax, esi
or eax, ecx
not ecx
and edi, ecx
mov ecx, dword [ebp - 0x18]
xor eax, esi
sar edi, 0x1f
sar eax, 0x1f
or eax, 1
xor edx, eax
and edx, edi
xor edx, eax
inc ebx
cmp ecx, ebx
jne 0x567892
test edx, edx
jns 0x5678f5
xor eax, eax
inc eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esi - 1]
cmp esi, 1
mov esi, edi
jg 0x567775
xor edx, edx
jmp 0x56780c
mov dword [ebp - 0x10], 0x144
push dword [ebp - 0x10]
push str....._third_party_boringssl_srccrypto_fipsmoduleec_simple.c
push 0x80
push 0
push 0xf
call fcn.006be890
add esp, 0x14
xor eax, eax
jmp 0x5678d1
call fcn.005de1d9
je 0x5678e7
mov edx, dword [edx + 0x118]
mov esi, eax
jmp 0x567780
push eax
push 0
push edx
call fcn.005cced0
add esp, 0xc
jmp 0x56786e
Function at 0x56a6d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x56a6e8
cmp dword [ebp + 0x10], 0
jne 0x56a6e4
call fcn.00582150
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0056a190
Function at 0x56bc80
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 0xc]
movsx edx, byte [esi + 0xb]
mov eax, esi
test edx, edx
jns 0x56bc9b
mov edx, dword [esi + 4]
mov eax, dword [esi]
test edx, edx
js 0x56c00f
sete bl
test eax, eax
setne bh
or bh, bl
je 0x56c00f
mov ebx, edx
cmp edx, 4
jb switch.0x0056bce0
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
xor ebx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja case.default.0x56bce0
jmp dword [edx*4 + 0x796a18]
movzx edx, byte [eax + 1]
shl edx, 8
xor ebx, edx
movzx eax, byte [eax]
xor eax, ebx
imul ebx, eax, 0x5bd1e995
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ebx, edx
jmp case.0x56bce0.2
Function at 0x5791a0
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005796a0
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.0057a640
test eax, eax
je 0x5791cd
mov ecx, eax
call fcn.0057a650
mov ebx, dword [0x82082c]
cmp ebx, 1
jbe 0x57938c
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x57930e
mov edi, dword [0x820834]
xor esi, esi
test edi, edi
je 0x5792df
mov eax, dword [0x82082c]
cmp eax, 1
mov dword [ebp - 0x10], ebx
jbe 0x57934f
mov esi, dword [edi + 4]
test esi, esi
je 0x579307
imul eax, dword [ebp - 0x18], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0xde8f4ca8
imul ecx, dword [ebp - 0x14], 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul ecx, edx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul ebx, edx, 0x1010101
shr ebx, 0x18
cmp ebx, 1
jbe 0x57931a
mov edx, ecx
cmp ecx, esi
jb 0x5792ab
mov eax, ecx
xor edx, edx
div esi
mov eax, dword [edi]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x579307
mov edi, dword [eax]
test edi, edi
je 0x579307
cmp ebx, 2
mov dword [ebp - 0x1c], edx
jb 0x579332
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x5792f0
mov eax, dword [edi + 8]
xor eax, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
xor edx, dword [ebp - 0x14]
or edx, eax
jne 0x5792ff
mov esi, dword [edi + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, esi
jb 0x5792fa
xor edx, edx
div esi
mov eax, edx
cmp eax, dword [ebp - 0x1c]
jne 0x57930a
mov edi, dword [edi]
test edi, edi
jne 0x5792c5
jmp 0x57930a
mov ebx, dword [ebp - 0x10]
xor esi, esi
jmp 0x5792df
mov ecx, ebx
call fcn.0054e320
jmp 0x5791eb
lea edx, [esi - 1]
and edx, ecx
jmp 0x5792ab
and eax, esi
cmp eax, edx
jne 0x57930a
mov edi, dword [edi]
test edi, edi
mov edx, dword [ebp - 0x1c]
jne 0x579336
jmp 0x57930a
dec esi
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp ecx, eax
jne 0x579321
mov eax, dword [edi + 8]
xor eax, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
xor edx, dword [ebp - 0x14]
or edx, eax
je 0x5792dc
jmp 0x579327
push 0x82082c
call fcn.004d6450
add esp, 4
test al, al
je 0x5793d9
xor esi, esi
mov dword [0x820830], esi
mov ebx, 0x82082c
mov ecx, 0x820830
call fcn.0054e310
push ebx
push esi
push 0x820830
push ebx
call fcn.004d6520
add esp, 0x10
jmp 0x57920c
push 0x82082c
call fcn.004d6450
add esp, 4
test al, al
je 0x5793ce
xor esi, esi
mov dword [0x820830], esi
mov edi, 0x82082c
mov ebx, 0x820830
mov ecx, 0x820830
call fcn.0054e310
push edi
push esi
push 0x820830
push edi
call fcn.004d6520
add esp, 0x10
jmp 0x5791dc
mov ebx, dword [0x82082c]
jmp 0x5791dc
mov eax, dword [0x82082c]
jmp 0x57920c
Function at 0x581be0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x4ef300
lea eax, [ebp - 0x14]
push 0
push eax
push 0x4ef150
push 0x822300
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x581c5a
xor esi, esi
cmp dword [0x822304], 0
jne 0x581c46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x822308]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x581c46
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.005de1d9
int3
Function at 0x582540
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + 0xb]
mov eax, ecx
test edx, edx
jns 0x58255d
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
test edx, edx
js 0x582849
sete cl
test eax, eax
setne ch
or ch, cl
je 0x582849
mov ecx, edx
cmp edx, 4
jb switch.0x005825a2
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja case.default.0x5825a2
jmp dword [edx*4 + 0x79f00c]
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
jmp case.0x5825a2.2
Function at 0x583950
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, esi
mov dword [ebp - 0x18], ecx
mov edx, esi
mov dword [ebp - 0x14], esi
cmp esi, 4
jb switch.0x005839a0
mov eax, dword [ebp - 0x14]
mov edx, eax
mov ecx, dword [ebp - 0x18]
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x58397a
jmp dword [edx*4 + 0x79f108]
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov edi, dword [ebx + 4]
xor ecx, ecx
test edi, edi
je 0x583abc
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov esi, eax
shr esi, 0xf
xor esi, eax
mov edx, edi
shr edx, 1
and edx, 0x55555555
mov eax, edi
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp eax, 1
jbe 0x583ad0
mov edx, esi
cmp esi, edi
jb 0x583a2a
mov eax, esi
xor edx, edx
div edi
mov eax, dword [ebx]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x583abc
mov ebx, dword [eax]
test ebx, ebx
je 0x583abc
mov dword [ebp - 0x10], edx
lea eax, [edi - 1]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
cmp eax, esi
jne 0x583a68
movsx ecx, byte [ebx + 0x13]
test ecx, ecx
js 0x583a8c
lea eax, [ebx + 8]
jmp 0x583a92
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
jmp case.0x5839a0.2
cmp dword [ebp - 0x20], 1
mov ecx, dword [ebp - 0x10]
jbe 0x583acb
cmp eax, edi
jb 0x583a7b
xor edx, edx
div edi
mov eax, edx
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
jne 0x583a88
mov ebx, dword [ebx]
test ebx, ebx
jne 0x583a46
xor ecx, ecx
jmp 0x583abc
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
test ecx, ecx
js 0x583ada
sete dl
test eax, eax
setne dh
or dh, dl
je 0x583ada
mov edx, dword [ebp - 0x14]
cmp edx, ecx
jne 0x583a82
push edx
push eax
push dword [ebp - 0x18]
call fcn.005cb2cd
add esp, 0xc
test eax, eax
jne 0x583a82
mov ecx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
and eax, dword [ebp - 0x1c]
jmp 0x583a7e
lea edx, [edi - 1]
and edx, esi
jmp 0x583a2a
ud2
Function at 0x5887b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x200c
call fcn.005ca340
mov eax, dword [0x80e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x8130c4]
cmp eax, 0xffffffff
jne 0x5887fb
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c9f16
add esp, 0x200c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
push dword [ebp - 0x2018]
call fcn.00516c20
add esp, 8
jmp 0x5887d4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x5887d4
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.005cc950
add esp, 0xc
mov ecx, dword [0x8130c4]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.00516c20
add esp, 8
test ebx, ebx
je 0x58884a
push ebx
call fcn.005c8bcc
add esp, 4
mov esi, 0x101
lea edi, [ebp - 0x2010]
mov eax, dword [0x824da8]
mov ecx, dword [0x813560]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5889a1
mov ebx, dword [0x824da4]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x588a03
push 0x1000
push 0x823da0
lea eax, [ebp - 0x1810]
push eax
call fcn.005cc950
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push edi
call fcn.005cced0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
nop word cs:[eax + eax]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x5888d0
mov ecx, edi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.00588a40
add esp, 8
mov ebx, 4
xor eax, eax
nop word [eax + eax]
movzx edx, word [ebp + ebx - 0x2010]
mov edi, dword [ebp + edx*8 - 0x810]
test edi, edi
jne 0x588948
add ebx, 8
cmp ebx, 0x804
jne 0x588910
dec esi
je 0x5889ec
test al, 1
lea edi, [ebp - 0x2010]
jne 0x588855
jmp 0x5887e9
mov dword [ebp - 0x2014], eax
mov eax, esi
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x5889f6
add ecx, ebp
add ecx, 0xffffe7f0
mov esi, dword [ebp + edx*8 - 0x80c]
cmp esi, dword [ecx + 8]
jne 0x5889f6
mov ecx, dword [ecx + 4]
test ecx, ecx
mov esi, eax
mov eax, dword [ebp - 0x2014]
je 0x588923
mov dword [ebp + edx*8 - 0x810], 0
call dword [0x8072c0]
push edi
call ecx
add esp, 4
mov al, 1
jmp 0x588923
push 0x824da8
call fcn.005c8bdd
add esp, 4
cmp dword [0x824da8], 0xffffffff
jne 0x588876
push 4
call fcn.005c8b59
add esp, 4
mov ebx, eax
mov dword [eax], 0
mov ecx, eax
call fcn.0054e310
mov dword [0x824da4], ebx
push 0x824da8
call fcn.005c8c57
add esp, 4
jmp 0x588876
call fcn.00649760
jmp 0x5887e9
mov esi, eax
mov eax, dword [ebp - 0x2014]
jmp 0x588923
mov ecx, ebx
call fcn.0054e320
jmp 0x58888b