joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47cce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x47cd15
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x47cd1d
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x47ce13
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x16c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x47cd83
test edi, edi
jne 0x47cd44
jmp 0x47cd5e
test edi, edi
je 0x47cd5a
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x47cd40
test edx, edx
je 0x47cd71
mov dword [esi + 0x16c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x60]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.0047c110
cmp edi, 0xf
jbe 0x47cde6
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x60]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x47cda6
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.0047c110
cmp ebx, 0xf
ja 0x47cda4
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x47ce00
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x47cdf0
mov dword [esi + 0x16c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x47cd23
xor eax, eax
jmp 0x47cd15
Function at 0x47db70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x40]
mov ebx, dword [eax]
test ebx, ebx
je 0x47dbba
test edx, edx
je 0x47dbba
mov edi, dword [esp + 0x30]
jmp 0x47db9b
test edx, edx
je 0x47dbb6
movzx eax, byte [esi + ebx]
add edi, 1
add ebx, 1
xor al, byte [edi - 1]
add ecx, 1
sub edx, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x47db97
mov dword [esp + 0x30], edi
cmp edx, 0xf
jbe 0x47dca2
mov edi, dword [esp + 0x30]
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x38], edx
mov edx, esi
mov dword [esp + 0x34], ecx
mov esi, edi
mov edi, eax
lea esi, [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [esp + 0x48]
cmp ebx, 0xf
mov edx, dword [esp + 0xc]
ja 0x47dc12
mov eax, dword [edx + ebx]
xor eax, dword [esi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x47dc00
sub edi, 0x10
add ebp, 0x10
add esi, 0x10
cmp edi, 0xf
jbe 0x47dc24
xor ebx, ebx
jmp 0x47dbe0
mov esi, edx
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov ecx, dword [esp + 0x34]
mov edi, edx
sub edx, 0x10
and edx, 0xfffffff0
and edi, 0xf
lea eax, [edx + 0x10]
add dword [esp + 0x30], eax
add ecx, eax
test edi, edi
jne 0x47dc56
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp], esi
add esi, ebx
mov dword [esp + 8], eax
call dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edx, dword [esp + 0x30]
add ecx, ebx
lea ebp, [edx + ebx]
nop
movzx edx, byte [esi + eax]
xor dl, byte [ebp + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, edi
jne 0x47dc80
add ebx, eax
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, edx
jmp 0x47dc44
Function at 0x481960
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x60
test dl, 1
mov edi, edx
jne 0x4819c3
test edi, 2
jne 0x4819d3
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x481991
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x481999
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
mov byte [edx], 0
je 0x48197a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x48197a

Function at 0x481b80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00480400

Function at 0x481d70
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov eax, 0x56f6d0
push esi
mov ecx, 0x18
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x10]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 4], eax
call sym.adb.exe_SHA1_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA1_Final
mov dword [esp], esi
mov dword [esp + 4], 0x60
call sym.adb.exe_OPENSSL_cleanse
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x4830d0
Capabilities:
Hash data using sha224

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x483150
test edi, 2
jne 0x483160
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x483101
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x483109
mov byte [edi], 0
mov dword [edx], 0xc1059ed8
mov eax, 1
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x4830ea
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x4830ea

Function at 0x483180
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x483200
test edi, 2
jne 0x483210
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x4831b1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x4831b9
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x48319a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x48319a

Function at 0x483290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00481e10
Function at 0x484110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00483590

Function at 0x4844a0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov eax, 0x56f780
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xc1059ed8
mov dword [esp + 0x1c], 0xcbbb9d5d
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x367cd507
mov dword [esp + 0x24], 0x629a292a
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x9159015a
mov dword [esp + 0x30], 0xf70e5939
mov dword [esp + 0x34], 0x152fecd8
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xffc00b31
mov dword [esp + 0x3c], 0x67332667
mov dword [esp + 0x40], 0x68581511
mov dword [esp + 0x44], 0x8eb44a87
mov dword [esp + 0x48], 0x64f98fa7
mov dword [esp + 0x4c], 0xdb0c2e0d
mov dword [esp + 0x50], 0xbefa4fa4
mov dword [esp + 0x54], 0x47b5481d
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x30
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x4845c0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov eax, 0x56f740
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xf3bcc908
mov dword [esp + 0x1c], 0x6a09e667
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x84caa73b
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0xfe94f82b
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x3c6ef372
mov dword [esp + 0x30], 0x5f1d36f1
mov dword [esp + 0x34], 0xa54ff53a
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xade682d1
mov dword [esp + 0x3c], 0x510e527f
mov dword [esp + 0x40], 0x2b3e6c1f
mov dword [esp + 0x44], 0x9b05688c
mov dword [esp + 0x48], 0xfb41bd6b
mov dword [esp + 0x4c], 0x1f83d9ab
mov dword [esp + 0x50], 0x137e2179
mov dword [esp + 0x54], 0x5be0cd19
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x40
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x4901a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call sym.adb.exe_AES_set_encrypt_key
test eax, eax
js 0x4903be
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x490239
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x4901f0
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x4903bc
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x5479c0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x5479c0]
mov edx, dword [edx*4 + 0x5461c0]
xor edx, dword [esi*4 + 0x546dc0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x5479c0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x5479c0]
xor edx, dword [esi*4 + 0x5469c0]
xor edx, dword [ebx*4 + 0x5465c0]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x5479c0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x5479c0]
mov edx, dword [edx*4 + 0x5461c0]
xor edx, dword [esi*4 + 0x546dc0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x5479c0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x5479c0]
xor edx, dword [esi*4 + 0x5469c0]
xor edx, dword [ebx*4 + 0x5465c0]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x5479c0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x5479c0]
mov edx, dword [edx*4 + 0x5461c0]
xor edx, dword [esi*4 + 0x546dc0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x5479c0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x5479c0]
xor edx, dword [esi*4 + 0x5469c0]
xor edx, dword [ebx*4 + 0x5465c0]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x5479c0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x5479c0]
mov edx, dword [edx*4 + 0x5461c0]
xor edx, dword [esi*4 + 0x546dc0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x5479c0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x5479c0]
xor edx, dword [esi*4 + 0x5469c0]
xor edx, dword [ebx*4 + 0x5465c0]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x490250
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x490d50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
je 0x490d74
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp sym.adb.exe_AES_decrypt
jmp sym.adb.exe_AES_encrypt

Function at 0x490d80
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jne 0x490dc0
mov dword [esp + 0x20], sym.adb.exe_AES_decrypt
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp fcn.0047bbc0
mov dword [esp + 0x20], sym.adb.exe_AES_encrypt
pop ebx
pop esi
jmp fcn.0047baa0
Function at 0x494ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov esi, dword [esp + 0x104]
mov ebx, dword [esp + 0x10c]
mov dword [esp], esi
call sym.adb.exe_EVP_MD_size
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_init
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 4], eax
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_Init_ex
test eax, eax
je 0x494dd2
mov ecx, dword [esp + 0x108]
test ecx, ecx
je 0x494d95
mov dword [esp + 0x1c], 1
lea esi, [esp + 0x5c]
lea ebp, [esp + 0x90]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x108], eax
cmovbe eax, dword [esp + 0x108]
mov dword [esp], esi
mov byte [esp + 0x27], cl
mov edi, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x26], al
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
call sym.adb.exe_HMAC_CTX_copy
test eax, eax
je 0x494dd2
mov eax, dword [esp + 0xfc]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf8]
mov dword [esp + 4], eax
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x494db1
lea eax, [esp + 0x24]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x494db1
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_HMAC_Final
test eax, eax
je 0x494db1
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
cmp dword [esp + 0x100], 1
mov dword [esp + 0x14], 1
jbe 0x494d81
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_copy
test eax, eax
je 0x494dd2
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.adb.exe_HMAC_Update
test eax, eax
je 0x494db1
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call sym.adb.exe_HMAC_Final
test eax, eax
je 0x494db1
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
test edi, edi
je 0x494d6f
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x494d60
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x100]
jne 0x494d04
add dword [esp + 0x1c], 1
add ebx, edi
sub dword [esp + 0x108], edi
jne 0x494c28
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
mov edx, dword [esp + 0x100]
xor eax, eax
test edx, edx
setne al
jmp 0x494dc7
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
mov dword [esp], esi
call sym.adb.exe_HMAC_CTX_cleanup
xor eax, eax
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x28]
mov dword [esp], eax
call sym.adb.exe_HMAC_CTX_cleanup
add esp, 0xdc
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a0580
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4a05b8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4a05ae
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4a05ba
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4a05a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4a1700
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4a1730
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp fcn.004b2bc0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
pop ebx
pop esi
jmp eax

Function at 0x4a1b70
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4a1ba4
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x56fbf8], eax
call fcn.004b2bc0
test eax, eax
sete al
movzx eax, al
mov dword [0x5192b4], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a1b93

Function at 0x4a1cb0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx]
mov dword [ebp - 0x20], edi
jmp 0x4a1cdc
mov dword [0x56fbfc], ecx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x4a1d98
mov edi, dword [eax + 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
call eax
test eax, eax
jne 0x4a1df0
test edi, edi
je 0x4a1d5b
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call edi
cmp eax, 7
je 0x4a1e00
cmp eax, 8
jne 0x4a1df0
mov eax, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [0x5192b4]
test eax, eax
js 0x4a1dd6
test eax, eax
je 0x4a1cd0
mov eax, dword [0x56fbf8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4a1cd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4a1cd6
mov eax, dword [esi]
mov edi, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
jne 0x4a1df0
lea esp, [ebp - 0xc]
mov al, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x24], ecx
call fcn.004a1bb0
mov eax, dword [0x5192b4]
mov ecx, dword [ebp - 0x24]
jmp 0x4a1d68
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 7
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a2010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x5192b4]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x4a20f2
test eax, eax
mov edi, dword [0x56fbfc]
jne 0x4a2090
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x4a2083
mov eax, edi
lea esi, [ebp - 0x1c]
nop
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4a2077
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call ecx
cmp eax, 6
je 0x4a20c0
cmp eax, 8
jne 0x4a20e5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x4a2040
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x56fbf8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x4a2033
mov eax, dword [ebp - 0x1c]
mov edx, esi
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x1c], edi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.004a1ac0
cmp eax, 7
jne 0x4a2088
mov eax, esi
call fcn.004a1c40
lea esp, [ebp - 0xc]
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004a1bb0
mov eax, dword [0x5192b4]
jmp 0x4a2029

Function at 0x4a21a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x5192b4]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x4a2216
test edx, edx
mov eax, dword [0x56fbfc]
jne 0x4a21ee
mov ecx, dword [ebx + 0xc]
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, esi
mov eax, ebx
test ecx, ecx
jne 0x4a21df
call fcn.004a1ac0
cmp eax, 7
je 0x4a21e7
call sub.msvcrt.dll_abort
nop
call fcn.004a1cb0
jmp 0x4a21d5
mov eax, esi
call fcn.004a1c40
mov esi, dword [0x56fbf8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x4a21bf
call fcn.004a1bb0
mov edx, dword [0x5192b4]
jmp 0x4a21b6
Function at 0x4a2230
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4a2270
mov edx, dword [0x5192b4]
test edx, edx
js 0x4a22b4
test edx, edx
mov eax, dword [0x56fbfc]
jne 0x4a2288
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004a1cb0
cmp eax, 7
je 0x4a2280
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.004a2010
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
call fcn.004a1c40
mov esi, dword [0x56fbf8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x4a2256
call fcn.004a1bb0
mov edx, dword [0x5192b4]
jmp 0x4a224d