joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e69a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov byte [ebp - 5], dl
test eax, eax
je 0x4e6b0f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4e6aac
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.004e63e0
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov dword [ebp - 4], ecx
jmp 0x4e6aaf
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4e6a50
test ecx, ecx
je 0x4e6b03
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e8ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov byte [ebp - 5], dl
test eax, eax
je 0x4e8e0f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4e8dac
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.004e8660
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov dword [ebp - 4], ecx
jmp 0x4e8daf
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4e8d50
test ecx, ecx
je 0x4e8e03
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, ebx
shr eax, 3
mov dword [ebp - 4], eax
push esi
cmp ebx, 0xc8
jae 0x4f23a0
test bl, 7
je 0x4f23ba
push 0x42a
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_sha_keccak1600.c
push str.r____25__sizeof_A_0__0______r___8___0
call fcn.005502fe
mov eax, dword [ebp - 4]
add esp, 0xc
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jb 0x4f259a
push edi
nop word [eax + eax]
mov dword [ebp - 8], 0
test eax, eax
je 0x4f257d
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 7]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 1]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
mov dword [ebp + 0xc], ecx
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
mov eax, edi
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
mov eax, ebx
and ecx, 0xff00ff
and eax, 0x55555555
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
and edi, 0xaaaaaaaa
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
or eax, edi
and ebx, 0xaaaaaaaa
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
lea eax, [ebx + ebx]
or eax, ebx
and ecx, 0xf0f0f0f0
and eax, 0xcccccccc
mov edi, ecx
shl edi, 4
or edi, ecx
and edi, 0xff00ff00
lea ecx, [eax*4]
mov ebx, edi
or ecx, eax
shr ebx, 8
and ecx, 0xf0f0f0f0
and edi, 0xffff00
mov edx, ecx
or ebx, edi
shl edx, 4
or edx, ecx
shr ebx, 8
and edx, 0xff00ff00
mov eax, edx
shl eax, 8
or eax, edx
xor edx, edx
and eax, 0xffff0000
or ebx, eax
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl eax, 8
and ecx, 0xffffff00
or ecx, eax
mov eax, dword [ebp - 0x10]
shr eax, 8
or eax, dword [ebp - 0x10]
shl ecx, 8
movzx eax, ax
or ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
mov ecx, dword [ebp + 8]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x4f23e2
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
jmp 0x4f2580
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f1ad0
mov eax, dword [ebp - 4]
sub esi, ebx
add esp, 4
mov dword [ebp + 0x10], esi
cmp esi, ebx
jae 0x4f23d0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2910
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4f2a8e
mov eax, dword [ebp + 8]
dec edi
push ebx
shr edi, 3
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [eax + 0xc]
lea edx, [eax + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
inc edi
nop
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebx]
and al, 0xdf
mov dword [ebp - 4], ecx
or al, 0x40
mov dword [ebp - 0x10], ecx
mov byte [ebx], al
movzx eax, byte [edx]
and al, 0xbf
mov dword [ebp - 0x18], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.004d8d50
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.004d8b10
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004d5e50
mov ebx, dword [ebp - 8]
push ebx
call fcn.004d8d50
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.004d8b10
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004d5e50
mov ecx, dword [ebp - 4]
add esp, 0x30
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
xor edx, ecx
xor ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor ebx, eax
mov dword [ebp - 4], ecx
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0xc]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub edi, 1
jne 0x4f2940
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4fb360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, 1
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
shl ebx, cl
call fcn.004a19a0
add esp, 8
test eax, eax
jne 0x4fb391
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 3
jg 0x4fb3f5
xor ecx, ecx
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0xc], ecx
jle 0x4fb52f
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x4fb3d6
nop dword [eax]
mov ecx, eax
xor ecx, dword [ebp + 0x14]
lea edx, [ecx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
neg edx
and edx, 1
neg edx
and edx, dword [edi + eax*4]
inc eax
or esi, edx
cmp eax, ebx
jl 0x4fb3b0
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
inc ecx
lea eax, [ebx*4]
mov dword [ebp + 0x18], ecx
add edi, eax
cmp ecx, dword [ebp + 0xc]
jl 0x4fb3a4
jmp 0x4fb52f
mov edx, dword [ebp + 0x14]
lea ecx, [esi - 2]
sar edx, cl
mov esi, 1
shl esi, cl
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], esi
lea eax, [esi - 1]
and ecx, eax
mov eax, edx
mov dword [ebp - 0x10], ecx
not eax
shr eax, 0x1f
lea ecx, [edx - 1]
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 1
and ecx, 1
neg ecx
mov dword [ebp - 0x20], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 2
and ecx, 1
xor edx, 3
neg ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [edx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
neg ecx
and eax, edx
and ecx, 1
neg eax
xor edx, edx
and eax, 1
mov dword [ebp - 0xc], edx
neg ecx
neg eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], edx
jle 0x4fb52f
lea eax, [ebx*4]
mov dword [ebp - 0x28], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0x18], eax
test esi, esi
jle 0x4fb517
lea eax, [esi + esi*2]
lea edx, [edi + esi*4]
lea ecx, [edi + esi*8]
mov dword [ebp - 8], edx
lea eax, [edi + eax*4]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [eax]
mov esi, ebx
mov ecx, dword [ecx]
and ecx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
xor esi, dword [ebp - 0x10]
or ecx, eax
mov edx, dword [edx]
and edx, dword [ebp - 0x1c]
mov eax, dword [edi + ebx*4]
or edx, ecx
and eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
or eax, edx
mov edx, dword [ebp - 8]
and ecx, esi
mov esi, dword [ebp - 0x24]
neg ecx
and ecx, 1
inc ebx
neg ecx
add edx, 4
and ecx, eax
mov dword [ebp - 8], edx
or dword [ebp + 0x18], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add eax, 4
add ecx, 4
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ecx
cmp ebx, esi
jl 0x4fb4b5
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add edi, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0xc], edx
cmp edx, dword [ebp + 0xc]
jl 0x4fb495
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [eax + 4], edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fde30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x4fdeb4
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4fde49
cmp al, 0x6b
jne 0x4fdeb4
inc ecx
cmp al, 0x6b
jne 0x4fde8b
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4fde69
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4fde69
cmp dl, 0xbb
jne 0x4fde7d
inc eax
cmp eax, esi
jl 0x4fde57
sub esi, eax
test eax, eax
jne 0x4fde8e
push 0x50
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x4fdec0
push 0x48
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x4fdec0
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4fdea2
push 0x59
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x4fdec0
push esi
push ecx
push dword [ebp + 8]
call fcn.0053f470
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x3d
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004576a0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x5064e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x506530
cmp edx, esi
jb 0x506530
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x506510
pop edi
pop esi
pop ebx
pop ebp
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
pxor xmm2, xmm3
pand xmm2, xmm4
movaps xmm0, xmm2
pxor xmm2, xmm3
pxor xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x506540
pop esi
pop ebx
pop ebp
ret
Function at 0x507880
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
lea eax, [ebp - 0x40]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.004d4c70
mov al, byte [ebp - 0x21]
and byte [ebp - 0x40], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0050b630
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 8]
call fcn.0050b5c0
lea eax, [ebp - 0x40]
push 0x40
push eax
call fcn.004579a0
add esp, 0x24
mov esp, ebp
pop ebp
ret

Function at 0x5078e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
lea eax, [ebp - 0x158]
push esi
push eax
call fcn.004d55b0
push 0x20
push dword [ebp + 0x18]
lea eax, [ebp - 0x158]
push eax
call fcn.004d5680
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004d4d90
mov al, byte [ebp - 0x21]
and byte [ebp - 0x40], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x158]
push eax
call fcn.004d55b0
push 0x20
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.004d5680
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push dword [ebp + 0xc]
push eax
call fcn.004d5680
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004d4d90
lea eax, [ebp - 0x80]
push eax
call fcn.0050f970
add esp, 0x40
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.0050b630
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.0050b5c0
lea eax, [ebp - 0x158]
push eax
call fcn.004d55b0
push 0x20
lea eax, [ebp - 0x158]
push esi
push eax
call fcn.004d5680
push 0x20
push dword [ebp + 0x14]
lea eax, [ebp - 0x158]
push eax
call fcn.004d5680
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push dword [ebp + 0xc]
push eax
call fcn.004d5680
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004d4d90
add esp, 0x40
lea eax, [ebp - 0x198]
push eax
call fcn.0050f970
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.0050bc90
lea eax, [ebp - 0x158]
push 0xd8
push eax
call fcn.004579a0
lea eax, [ebp - 0x80]
push 0x40
push eax
call fcn.004579a0
lea eax, [ebp - 0x40]
push 0x40
push eax
call fcn.004579a0
add esp, 0x2c
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x507bf0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [ebp - 0x60], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [ebp - 0x70], xmm0
mov byte [ebp - 0x70], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x51], al
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0050b630
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0xc0]
lea eax, [ecx + edx]
sub edx, ecx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0x28], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0x24], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x20], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x1c], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x18], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x14], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xc], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x2c], edx
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.005082d0
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
push eax
call fcn.00508500
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.00509c20
lea eax, [ebp - 0x70]
push 0x20
push eax
call fcn.004579a0
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x530cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [edx + 4]
mov esi, edx
push edi
mov edi, dword [ebp + 0x10]
cmp ecx, dword [edi + 4]
cmovge esi, edi
cmovge edi, edx
mov dword [ebp + 0xc], esi
push dword [edi + 4]
push ebx
call fcn.004a19a0
add esp, 8
test eax, eax
jne 0x530d05
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
cmp dword [esi + 4], eax
jle 0x530d28
nop dword [eax]
mov ecx, dword [esi]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
xor esi, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], esi
inc eax
mov esi, dword [ebp + 0xc]
cmp eax, dword [esi + 4]
jl 0x530d10
mov ecx, dword [edi + 4]
cmp eax, ecx
jge 0x530d42
nop
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x530d30
push ebx
mov dword [ebx + 4], ecx
call fcn.004a1820
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x531c40
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
push esi
xor edi, edi
call fcn.004ca2d0
push esi
call fcn.004ca080
mov esi, eax
add esp, 8
test esi, esi
je 0x531e23
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.004a19a0
add esp, 8
test eax, eax
je 0x531e22
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x531dfe
mov edi, ecx
nop
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x531c90
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.004a1820
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.00530d60
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push dword [ebp + 0x14]
call fcn.004c9f80
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret