joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed870
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4ed939
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4ed891
cmp al, 0x6b
jne 0x4ed939
inc ecx
cmp al, 0x6b
jne 0x4ed8f2
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4ed8b2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4ed8b2
cmp dl, 0xbb
jne 0x4ed8c6
inc eax
cmp eax, esi
jl 0x4ed8a0
sub esi, eax
test eax, eax
jne 0x4ed8f5
call fcn.0046b450
push str.RSA_padding_check_X931
push 0x56
jmp 0x4ed8d2
call fcn.0046b450
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.0046b550
push 0
push 0x8a
push 4
call fcn.0046b600
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4ed927
call fcn.0046b450
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.0046b550
push 0
push 0x8b
push 4
call fcn.0046b600
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.005e1090
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.0046b450
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.0046b550
push 0
push 0x89
push 4
call fcn.0046b600
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x510730
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
movzx eax, cl
and eax, 1
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x510772
push ebx
add edi, esi
lea ebx, [edx + esi]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x510752
pop ebx
pop edi
pop esi
ret
Function at 0x51e790
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.005dfc90
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x51e9a8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x51e982
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x51e7d4
mov esi, dword [esp + 0x30]
jmp 0x51e986
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0051ded0
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x51e7c0
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x526530
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x526609
mov esi, dword [esp + 0x10]
test esi, esi
je 0x5265be
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.00504a10
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x526592
call fcn.0046b450
push str.ossl_ecx_key_op
push 0xaa
push str.cryptoececx_backend.c
call fcn.0046b550
push 0
push 0x66
push 0x10
call fcn.0046b600
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.00478330
add esp, 4
test esi, esi
jne 0x5265a9
mov esi, eax
jmp 0x5265c2
cmp esi, eax
je 0x5265c2
call fcn.0046b450
push str.ossl_ecx_key_op
push 0xb0
jmp 0x526574
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x5265f5
test esi, esi
je 0x5265f5
cmp esi, 0x40a
je 0x5265ea
cmp esi, 0x43f
je 0x5265ea
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5265ef
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x52660d
call fcn.0046b450
push str.ossl_ecx_key_op
push 0xb6
jmp 0x526574
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x526631
cmp esi, 0x43f
je 0x526631
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x526641
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.00501bb0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x52668b
call fcn.0046b450
push str.ossl_ecx_key_op
push 0xbd
push str.cryptoececx_backend.c
call fcn.0046b550
push ebx
push 0xc0100
push 0x10
call fcn.0046b600
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x5266a7
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.005e1090
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.00501b30
mov edi, eax
add esp, 4
test edi, edi
jne 0x5266da
call fcn.0046b450
push str.ossl_ecx_key_op
push 0xc7
push str.cryptoececx_backend.c
call fcn.0046b550
push edi
push 0xc0100
jmp 0x5267b0
cmp ebp, 2
jne 0x52674c
test esi, esi
je 0x52677f
cmp esi, 0x40a
je 0x526707
cmp esi, 0x43f
je 0x526707
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x52670c
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.0046ed90
add esp, 0x10
test eax, eax
jle 0x5267ba
cmp esi, 0x40a
jne 0x52673b
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x52677f
cmp esi, 0x40b
jne 0x52677f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x52677f
cmp esi, 0x40a
je 0x52676c
cmp esi, 0x43f
je 0x52676c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x526771
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.005e1090
add esp, 0xc
push ebx
call fcn.005267d0
add esp, 4
test eax, eax
jne 0x5266a0
call fcn.0046b450
push str.ossl_ecx_key_op
push 0xdb
push str.cryptoececx_backend.c
call fcn.0046b550
push 0
push 0xa6
push 0x10
call fcn.0046b600
add esp, 0x18
push ebx
call fcn.00501b50
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x52b190
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.005dfc90
mov eax, dword [0x6a7d40]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.004b0490
mov edi, eax
add esp, 0xc
test edi, edi
je 0x52b212
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.004af720
push edi
mov esi, eax
call fcn.004b04c0
add esp, 0x1c
test esi, esi
jne 0x52b22c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.005df387
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0052a9d0
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0052a950
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005df387
add esp, 0xe4
ret
Function at 0x52b2a0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.005dfc90
mov eax, dword [0x6a7d40]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.004b0490
add esp, 0xc
mov edi, eax
call fcn.004b0400
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x52b4ae
test esi, esi
je 0x52b4ae
push 0
push edi
push esi
call fcn.004afb90
add esp, 0xc
test eax, eax
je 0x52b4ae
push 0x20
push ebx
push esi
call fcn.004afbd0
add esp, 0xc
test eax, eax
je 0x52b4ae
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.004afa60
add esp, 0xc
test eax, eax
je 0x52b4ae
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.004afb90
add esp, 0xc
test eax, eax
je 0x52b4ae
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.004afbd0
add esp, 0xc
test eax, eax
je 0x52b4ae
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.004afbd0
add esp, 0xc
test eax, eax
je 0x52b4ae
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.004afa60
add esp, 0xc
test eax, eax
je 0x52b4ae
lea eax, [esp + 0x100]
push eax
call fcn.0052ff10
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0052a9d0
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.0052a950
push 0
push edi
push esi
call fcn.004afb90
add esp, 0x20
test eax, eax
je 0x52b4ae
push 0x20
push ebp
push esi
call fcn.004afbd0
add esp, 0xc
test eax, eax
je 0x52b4ae
push 0x20
push dword [esp + 0x20]
push esi
call fcn.004afbd0
add esp, 0xc
test eax, eax
je 0x52b4ae
push ebx
push dword [esp + 0x14]
push esi
call fcn.004afbd0
add esp, 0xc
test eax, eax
je 0x52b4ae
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.004afa60
add esp, 0xc
test eax, eax
je 0x52b4ae
lea eax, [esp + 0x140]
push eax
call fcn.0052ff10
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0052b9d0
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00401320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.004b04c0
push esi
call fcn.004b0370
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005df387
add esp, 0x174
ret
Function at 0x533320
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x53336f
cmp edx, esi
jb 0x53336f
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x533350
pop edi
pop esi
pop ebx
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
xorps xmm2, xmm3
andps xmm2, xmm4
movaps xmm0, xmm2
xorps xmm2, xmm3
xorps xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x533380
pop esi
pop ebx
ret
Function at 0x53c1e0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x53c1f8
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x53c1fd
mov ebx, 0x660de0
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x53c2d5
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
cmp esi, 3
jb 0x53c269
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x53c2b5
shl eax, 0x10
cmp esi, 2
jne 0x53c279
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x53c29c
mov al, 0x3d
jmp 0x53c2a5
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 2], al
mov cl, 0x3d
mov eax, dword [esp + 0x14]
add eax, 3
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x53c213
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x55dcf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005dfc90
push ebx
mov ebx, dword [esp + 0x10]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push edi
mov edi, dword [esp + 0x1c]
test esi, esi
jle 0x55ddee
cmp esi, 8
jb 0x55ddd4
lea eax, [esi - 1]
lea edx, [esi - 1]
add eax, edi
add edx, ebx
cmp ebx, eax
ja 0x55dd3a
cmp edx, edi
jae 0x55ddd4
mov edx, edi
push ebp
cmp esi, 0x40
jb 0x55dda9
mov eax, esi
lea ebp, [edi + 0x30]
and eax, 0xffffffc0
sub edx, ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea ebp, [ebp + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebp - 0x70]
xorps xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [edx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebp - 0x50]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
movups xmm0, xmmword [ebp - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [esp + 0x10]
jl 0x55dd53
mov eax, esi
and al, 0x3f
cmp al, 8
jb 0x55ddcf
jmp 0x55ddab
sub edx, ebx
mov ebp, esi
lea eax, [ecx + ebx]
and ebp, 0xfffffff8
movq xmm1, qword [edx + eax]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp ecx, ebp
jl 0x55ddb3
pop ebp
cmp ecx, esi
jge 0x55ddee
mov edx, esi
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
nop dword [eax]
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x55dde0
push esi
push ebx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x20]
push ebx
push dword [eax + 8]
call fcn.004b6190
add esp, 0x14
test eax, eax
je 0x55de17
xor eax, eax
cmp dword [esp + 0x20], esi
pop edi
pop esi
sete al
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x55dfb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x55e023
mov edx, dword [esp + 0x10]
test edx, edx
je 0x55e023
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [ebx + 0x14]
cmp edx, edi
cmovb edi, edx
test edi, edi
je 0x55dff0
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x55dfe0
pop esi
mov eax, dword [ebx + 0x14]
cmp edx, eax
jbe 0x55e021
sub edx, eax
cmp edx, 0x10
jbe 0x55e005
mov edx, 0x10
jmp 0x55e009
test edx, edx
je 0x55e021
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x55e010
pop edi
pop ebx
pop ebp
ret
Function at 0x55e2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.005dfc90
mov eax, dword [0x6a7d40]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x55e300
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x55e327
lea edi, [edx + 0x20]
jmp 0x55e352
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x55e331
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.004b6190
add esp, 0x14
test eax, eax
je 0x55e469
cmp dword [esp + 0x14], edi
jne 0x55e469
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.005e1090
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x55e3ff
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x55e3bf
test ecx, ecx
jne 0x55e3bf
test eax, eax
je 0x55e3e2
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.0055e030
add esp, 0x1c
test eax, eax
je 0x55e469
test edi, edi
je 0x55e422
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.0055dfb0
add esp, 0xc
jmp 0x55e422
push dword [esp + 0x90]
push ebp
push esi
call fcn.0055dfb0
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0055dfb0
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.004b6160
add esp, 0x18
test eax, eax
je 0x55e469
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.004b6160
add esp, 0x18
test eax, eax
je 0x55e469
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.005df387
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005df387
add esp, 0x74
ret
Function at 0x5619f5
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x56193d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.00501bb0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x561984
call fcn.0046b450
push str.ecx_gen
push 0x249
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.0046b550
push edi
push 0xc0100
push 0x39
call fcn.0046b600
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x5619cf
push esi
push edi
call fcn.00501b30
mov esi, eax
add esp, 4
test esi, esi
jne 0x5619d2
call fcn.0046b450
push str.ecx_gen
push 0x252
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.0046b550
push esi
push 0xc0100
push 0x39
call fcn.0046b600
add esp, 0x18
push edi
call fcn.00501b50
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.0046ed90
add esp, 0x10
test eax, eax
jle 0x5619c3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x5619ee
jmp dword [eax*4 + 0x561a6c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.0052b7d0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.00534a50
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.0052b190
jmp 0x561a57
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.00532e40
add esp, 0x10
test eax, eax
je 0x5619c3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x581090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.005dfc90
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x5810d8
call fcn.0046b450
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0046b550
push 0
push 0x78
push 4
call fcn.0046b600
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.00580de0
add esp, 4
test eax, eax
jne 0x581114
call fcn.0046b450
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0046b550
push 0
push 0xb2
push 4
call fcn.0046b600
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004e8f30
push esi
call fcn.004e8ce0
push esi
mov dword [esp + 0x2c], eax
call fcn.004e8ce0
push esi
mov ebp, eax
call fcn.004e8ce0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x581276
test ebp, ebp
je 0x58124d
test ebx, ebx
je 0x581244
push 4
push ebp
call fcn.0049ab30
push 4
push ebx
call fcn.0049ab30
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x58117e
call fcn.0049aa00
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x58118d
call fcn.0049aa00
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x581240
test eax, eax
je 0x581240
push 4
push ecx
call fcn.0049ab30
push 4
push dword [esi + 0x24]
call fcn.0049ab30
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00599d50
add esp, 0x3c
test eax, eax
je 0x581240
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00599d50
add esp, 0x2c
test eax, eax
je 0x581240
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00580d70
add esp, 0x10
test eax, eax
js 0x581240
je 0x5811e0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00580d70
add esp, 0x10
test eax, eax
js 0x581240
je 0x5811e0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.0049a110
add esp, 4
test ebx, ebx
je 0x58125a
push ebx
call fcn.0049a110
add esp, 4
push dword [esp + 0x20]
call fcn.0049a110
push esi
call fcn.004e8be0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x58124d
jmp 0x581244