joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f370
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00581890
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x49f3f0
mov cl, byte [edi]
test cl, cl
je 0x49f3f0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x49f3a0
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x49f630
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00581890
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x49f6b3
mov cl, byte [edi]
test cl, cl
je 0x49f6b3
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x49f660
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x4a7220
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00581890
mov eax, dword [0x634f14]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xd8]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], edi
call fcn.004c26b0
push ebp
push 0
push edi
mov dword [esp + 0x2c], eax
call fcn.004e7a60
add esp, 0x10
test eax, eax
je 0x4a73f2
mov edi, dword [esp + 0xcc]
inc ebp
test edi, edi
mov edi, dword [esp + 0x10]
je 0x4a72d4
push 0
push esi
push edi
push dword [esp + 0x28]
call fcn.0045e210
add esp, 0x10
test eax, eax
jle 0x4a73f3
push esi
push edi
push ebx
call fcn.00583b70
push esi
lea eax, [esp + 0x7c]
push edi
push eax
call fcn.00583b70
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x4a72fd
add byte [ebx + eax], 1
jne 0x4a72fd
sub eax, 1
jns 0x4a72f2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push edi
call fcn.00485e20
add esp, 0x18
test eax, eax
je 0x4a73f3
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push ebx
call fcn.00485e20
add esp, 0x18
test eax, eax
je 0x4a73f3
xor eax, eax
test esi, esi
jle 0x4a739e
cmp esi, 0x20
jb 0x4a738d
mov ecx, esi
and ecx, 0x8000001f
jns 0x4a7355
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, esi
sub edx, ecx
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
add eax, 0x20
cmp eax, edx
jl 0x4a7360
cmp eax, esi
jge 0x4a739e
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x4a7391
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push edi
push esi
push eax
call fcn.004745f0
add esp, 0xc
test eax, eax
je 0x4a73f3
push dword [esp + 0x18]
push dword [esp + 0x28]
push edi
call fcn.004e7ab0
add esp, 0xc
test eax, eax
jg 0x4a7414
jne 0x4a73f3
push ebp
push 0
push dword [esp + 0x20]
mov edi, 1
call fcn.004e7a60
add esp, 0xc
test eax, eax
jne 0x4a72b3
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.00581041
add esp, 0xa0
ret
mov eax, 1
jmp 0x4a73f5
Function at 0x4ace30
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
cmp ebp, 2
je 0x4acf07
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4aceb9
push edi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.004abc20
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x4ace8e
call fcn.0046aff0
push str.ossl_ecx_key_op
push 0xa6
push str.cryptoececx_backend.c
call fcn.0046b040
push 0
push 0x66
push 0x10
call fcn.0046b070
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
push dword [edi]
mov esi, dword [esp + 0x20]
call fcn.00468dd0
add esp, 4
test esi, esi
jne 0x4acea4
mov esi, eax
jmp 0x4acebd
cmp esi, eax
je 0x4acebd
call fcn.0046aff0
push str.ossl_ecx_key_op
push 0xac
jmp 0x4ace70
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0
je 0x4acef3
test esi, esi
je 0x4acef3
cmp esi, 0x40a
je 0x4acee8
cmp esi, 0x43f
je 0x4acee8
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4aceed
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x4acf0b
call fcn.0046aff0
push str.ossl_ecx_key_op
push 0xb2
jmp 0x4ace70
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x4acf2f
cmp esi, 0x43f
je 0x4acf2f
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x4acf3f
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.0048ec90
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4acf89
call fcn.0046aff0
push str.ossl_ecx_key_op
push 0xb9
push str.cryptoececx_backend.c
call fcn.0046b040
push ebx
push 0x80010
push 0x10
call fcn.0046b070
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x4acfa9
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
push eax
lea eax, [ebx + 0xc]
push eax
call fcn.00583b70
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.0048ec20
mov edi, eax
add esp, 4
test edi, edi
jne 0x4acfdc
call fcn.0046aff0
push str.ossl_ecx_key_op
push 0xc3
push str.cryptoececx_backend.c
call fcn.0046b040
push edi
push 0x80010
jmp 0x4ad0b3
cmp ebp, 2
jne 0x4ad04e
test esi, esi
je 0x4ad082
cmp esi, 0x40a
je 0x4ad009
cmp esi, 0x43f
je 0x4ad009
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4ad00e
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.0045e5c0
add esp, 0x10
test eax, eax
jle 0x4ad0bd
cmp esi, 0x40a
jne 0x4ad03d
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x4ad082
cmp esi, 0x40b
jne 0x4ad082
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x4ad082
cmp esi, 0x40a
je 0x4ad06e
cmp esi, 0x43f
je 0x4ad06e
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4ad073
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push edi
call fcn.00583b70
add esp, 0xc
push ebx
call fcn.004ad0d0
add esp, 4
test eax, eax
jne 0x4acfa2
call fcn.0046aff0
push str.ossl_ecx_key_op
push 0xd7
push str.cryptoececx_backend.c
call fcn.0046b040
push 0
push 0xa6
push 0x10
call fcn.0046b070
add esp, 0x18
push ebx
call fcn.0048ec40
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4b19a0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.00581890
mov eax, dword [0x634f14]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.00486940
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4b1a22
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.00485e20
push edi
mov esi, eax
call fcn.00486e90
add esp, 0x1c
test esi, esi
jne 0x4b1a3c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.00581041
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004b1160
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004b10e0
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00581041
add esp, 0xe4
ret
Function at 0x4bf2f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4bf3b9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4bf311
cmp al, 0x6b
jne 0x4bf3b9
inc ecx
cmp al, 0x6b
jne 0x4bf372
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4bf332
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4bf332
cmp dl, 0xbb
jne 0x4bf346
inc eax
cmp eax, esi
jl 0x4bf320
sub esi, eax
test eax, eax
jne 0x4bf375
call fcn.0046aff0
push str.RSA_padding_check_X931
push 0x56
jmp 0x4bf352
call fcn.0046aff0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.0046b040
push 0
push 0x8a
push 4
call fcn.0046b070
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4bf3a7
call fcn.0046aff0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.0046b040
push 0
push 0x8b
push 4
call fcn.0046b070
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.00583b70
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.0046aff0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.0046b040
push 0
push 0x89
push 4
call fcn.0046b070
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x4c3090
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.0045cf20
add esp, 8
test esi, esi
jg 0x4c30e7
je 0x4c30c9
cmp esi, 0xffffffff
jne 0x4c30e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004c3420
add esp, 4
test eax, eax
je 0x4c30e7
push 0xa
push edi
call fcn.0045ddb0
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x4c3520
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.00581890
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x4c3568
call fcn.0046aff0
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
push 0
push 0x87
push 0x20
call fcn.0046b070
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.0047c170
add esp, 8
test eax, eax
jne 0x4c3587
pop ebx
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4c3602
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x4c3602
call fcn.0046aff0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0046b070
call fcn.0046aff0
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
push 0
push 0x89
push 0x20
call fcn.0046b070
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
test bl, 0x10
je 0x4c3673
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x4c3673
call fcn.0046aff0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0046b070
call fcn.0046aff0
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
push 0
push 0x8a
push 0x20
call fcn.0046b070
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.0047d3d0
add esp, 4
push eax
push esi
call fcn.0047d3c0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4c3701
push eax
call fcn.004c34e0
add esp, 4
test eax, eax
jne 0x4c36fa
call fcn.0046aff0
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0046b070
call fcn.0046aff0
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.0046b040
push 0
push 0x67
push 0x20
call fcn.0046b070
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x4e0150
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x4e0192
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
add edi, esi
add ebx, esi
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x4e0171
pop edi
pop ebx
pop esi
ret

Function at 0x4ef760
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.005840f0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x4f2920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.00581890
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x4f2968
call fcn.0046aff0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0046b040
push 0
push 0x78
push 4
call fcn.0046b070
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.004f2670
add esp, 4
test eax, eax
jne 0x4f29a4
call fcn.0046aff0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0046b040
push 0
push 0xb2
push 4
call fcn.0046b070
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004c2440
push esi
call fcn.004c2320
push esi
mov dword [esp + 0x2c], eax
call fcn.004c2320
push esi
mov ebp, eax
call fcn.004c2320
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x4f2ad4
test ebp, ebp
je 0x4f2ae1
test ebx, ebx
je 0x4f2ad4
push 4
push ebp
call fcn.00474ec0
push 4
push ebx
call fcn.00474ec0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x4f2a0e
call fcn.00474d90
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x4f2a1c
call fcn.00474d90
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4f2ad0
cmp dword [esi + 0x24], 0
je 0x4f2ad0
push 4
push eax
call fcn.00474ec0
push 4
push dword [esi + 0x24]
call fcn.00474ec0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.0053f160
add esp, 0x3c
test eax, eax
je 0x4f2ad0
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.0053f160
add esp, 0x2c
test eax, eax
je 0x4f2ad0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.004f2600
add esp, 0x10
test eax, eax
js 0x4f2ad0
je 0x4f2a70
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.004f2600
add esp, 0x10
test eax, eax
js 0x4f2ad0
je 0x4f2a70
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
test ebp, ebp
je 0x4f2ae1
push ebp
call fcn.00474690
add esp, 4
test ebx, ebx
je 0x4f2aee
push ebx
call fcn.00474690
add esp, 4
push dword [esp + 0x20]
call fcn.00474690
push esi
call fcn.004c2290
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x4fadc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00581890
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax + 0x64]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [ecx + 0x70]
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x4fae26
test edi, edi
je 0x4fae06
nop
cmp edx, 0x40
jae 0x4fae06
mov al, byte [edx + ecx + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
sub edi, 1
jne 0x4fadf0
mov dword [ecx + 0x70], edx
test edi, edi
je 0x4faedc
cmp edx, 0x40
jne 0x4fae26
mov dword [ecx + 0x70], 0
add dword [ecx + 0x20], 1
jne 0x4fae26
inc dword [ecx + 0x24]
mov eax, edi
lea edx, [ecx + 0x20]
and eax, 0x3f
mov dword [esp + 0x14], edx
sub edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push esi
cmp edi, 0x40
jb 0x4fae89
mov esi, edi
shr esi, 6
add eax, esi
mov dword [esp + 0x14], eax
cmp eax, esi
jae 0x4fae59
sub esi, eax
mov dword [esp + 0x14], 0
push edx
push ecx
shl esi, 6
push esi
push ebx
push ebp
call fcn.00444c00
mov edx, dword [esp + 0x2c]
add esp, 0x14
mov eax, dword [esp + 0x14]
sub edi, esi
mov ecx, dword [esp + 0x20]
add ebx, esi
add ebp, esi
mov dword [edx], eax
test eax, eax
jne 0x4fae84
inc dword [ecx + 0x24]
cmp edi, 0x40
jae 0x4fae40
cmp dword [esp + 0x10], 0
je 0x4faedb
push 0x40
lea edi, [ecx + 0x30]
push 0
push edi
call fcn.005840f0
push dword [esp + 0x24]
mov esi, dword [esp + 0x30]
push esi
push 0x40
push edi
push edi
call fcn.00444c00
mov eax, dword [esp + 0x30]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x4faed8
sub ebx, ebp
mov esi, eax
lea ecx, [edx + ebp]
mov al, byte [ebx + ecx]
xor al, byte [edi + edx]
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x4faec0
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], eax
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4fe9e0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.00465eb0
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4fea24
push 0
push 0
push edi
push 0x4fea40
push 0
push 0
call fcn.0058f05b
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4fea24
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.00465ce0
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x513880
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00581890
cmp dword [esp + 0xc], 0
je 0x5139bd
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
inc eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x30]
push edi
push esi
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push ebp
push dword [esp + 0x2c]
call fcn.005136b0
add esp, 0x1c
test eax, eax
jne 0x5138d0
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push 0x1b8
push str.providersimplementationskdfs_tls1_prf.c
push edi
call fcn.00465c60
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x513924
mov eax, dword [esp + 0x10]
sub ebp, eax
add ebp, dword [esp + 0x24]
push edi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push ebp
push dword [esp + 0x34]
call fcn.005136b0
add esp, 0x1c
test eax, eax
jne 0x51392c
push 0x1bd
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.00465d70
add esp, 0x10
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
xor edx, edx
test edi, edi
je 0x51399e
cmp edi, 0x20
jb 0x51397f
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x513949
cmp ecx, ebx
jae 0x51397f
mov ecx, edi
mov ebp, ebx
and ecx, 0xffffffe0
mov eax, esi
sub ebp, esi
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x513954
cmp edx, edi
jae 0x51399e
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
mov esi, edi
sub esi, edx
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x513990
push 0x1c2
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.00465d70
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x20]
call fcn.005136b0
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop ecx
ret
Function at 0x51b8a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
xor esi, esi
lea ecx, [edx + 0x3f8]
push edi
lea edi, [eax + 0x3f8]
cmp eax, ecx
ja 0x51b8df
cmp edi, edx
jb 0x51b8df
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x51b8c7
pop edi
pop esi
ret
mov edi, edx
lea ecx, [eax + 0x10]
sub edi, eax
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [edx + esi*8]
add esi, 4
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [edi + ecx - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp esi, 0x80
jl 0x51b8f0
pop edi
pop esi
ret

Function at 0x51da70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x51dad3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x51dad3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi + 0x14]
cmp edx, ebx
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x51daa1
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x1c], al
inc ecx
cmp ecx, ebx
jb 0x51da95
mov eax, dword [edi + 0x14]
cmp edx, eax
jbe 0x51dad1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor eax, eax
test edx, edx
je 0x51dad1
nop word [eax + eax]
mov ecx, dword [edi + 0x14]
add ecx, eax
mov cl, byte [ecx + esi]
xor byte [edi + eax + 0x3c], cl
inc eax
cmp eax, edx
jb 0x51dac0
pop edi
pop ebx
pop esi
ret