joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b0430
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.0075cd80
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x5b0478
call fcn.0055b2b0
push str.BIO_connect
push 0x5f
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
push 0
push 0x87
push 0x20
call fcn.0055b460
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.0055cbd0
add esp, 8
test eax, eax
je 0x5b0507
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x5b050e
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x5b050e
call fcn.0055b2b0
push str.BIO_connect
push 0x69
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0055b460
call fcn.0055b2b0
push str.BIO_connect
push 0x6b
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
push 0
push 0x89
push 0x20
call fcn.0055b460
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x5b057f
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x5b057f
call fcn.0055b2b0
push str.BIO_connect
push 0x73
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0055b460
call fcn.0055b2b0
push str.BIO_connect
push 0x75
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
push 0
push 0x8a
push 0x20
call fcn.0055b460
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.0055cd50
add esp, 4
push eax
push esi
call fcn.0055cd40
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5b060b
push eax
call fcn.005b0340
add esp, 4
test eax, eax
jne 0x5b0507
call fcn.0055b2b0
push str.BIO_connect
push 0x7d
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0055b460
call fcn.0055b2b0
push str.BIO_connect
push 0x7f
push str.crypto_bio_bio_sock2.c
call fcn.0055b3b0
push 0
push 0x67
push 0x20
call fcn.0055b460
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x5cb050
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x5cb119
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x5cb071
cmp al, 0x6b
jne 0x5cb119
inc ecx
cmp al, 0x6b
jne 0x5cb0d2
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x5cb092
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x5cb092
cmp dl, 0xbb
jne 0x5cb0a6
inc eax
cmp eax, esi
jl 0x5cb080
sub esi, eax
test eax, eax
jne 0x5cb0d5
call fcn.0055b2b0
push str.RSA_padding_check_X931
push 0x56
jmp 0x5cb0b2
call fcn.0055b2b0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.0055b3b0
push 0
push 0x8a
push 4
call fcn.0055b460
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x5cb107
call fcn.0055b2b0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.0055b3b0
push 0
push 0x8b
push 4
call fcn.0055b460
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.00774520
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.0055b2b0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.0055b3b0
push 0
push 0x89
push 4
call fcn.0055b460
add esp, 0x18
or eax, 0xffffffff
pop esi
ret

Function at 0x5d8780
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x5d87a7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x5d8796
pop edi
movzx eax, dl
pop esi
ret
Function at 0x5e2970
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0075cd80
mov eax, dword [0x8a0204]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xc0]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebx
call fcn.005853f0
push ebp
push 0
push ebx
mov dword [esp + 0x2c], eax
call fcn.005fcff0
add esp, 0x10
test eax, eax
je 0x5e2b61
mov ebx, dword [esp + 0xcc]
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x5e2a24
push 0
push esi
push ebx
push dword [esp + 0x28]
call fcn.005528f0
add esp, 0x10
test eax, eax
jle 0x5e2b62
push esi
push ebx
push edi
call fcn.00774520
push esi
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.00774520
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x5e2a4d
add byte [edi + eax], 1
jne 0x5e2a4d
sub eax, 1
jns 0x5e2a42
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push ebx
call fcn.00543520
add esp, 0x18
test eax, eax
je 0x5e2b62
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push edi
call fcn.00543520
add esp, 0x18
test eax, eax
je 0x5e2b62
xor eax, eax
test esi, esi
jle 0x5e2b0d
cmp esi, 0x40
jb 0x5e2b00
mov ecx, esi
and ecx, 0xffffffc0
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
movups xmm0, xmmword [esp + eax + 0x4c]
movups xmm1, xmmword [esp + eax + 0x8c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x4c], xmm1
movups xmm0, xmmword [esp + eax + 0x5c]
movups xmm1, xmmword [esp + eax + 0x9c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x5c], xmm1
add eax, 0x40
cmp eax, ecx
jl 0x5e2aa0
cmp eax, esi
jge 0x5e2b0d
nop dword [eax]
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x5e2b00
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push ebx
push esi
push eax
call fcn.0053f790
add esp, 0xc
test eax, eax
je 0x5e2b62
push dword [esp + 0x18]
push dword [esp + 0x28]
push ebx
call fcn.005fd040
add esp, 0xc
test eax, eax
jg 0x5e2b83
jne 0x5e2b62
push ebp
push 0
push dword [esp + 0x20]
mov ebx, 1
call fcn.005fcff0
add esp, 0xc
test eax, eax
jne 0x5e2a03
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.0075c173
add esp, 0xa0
ret
mov eax, 1
jmp 0x5e2b64
Function at 0x5e4f00
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x5e4fd9
mov esi, dword [esp + 0x10]
test esi, esi
je 0x5e4f8e
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.00592750
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x5e4f62
call fcn.0055b2b0
push str.ossl_ecx_key_op
push 0x9f
push str.cryptoececx_backend.c
call fcn.0055b3b0
push 0
push 0x66
push 0x10
call fcn.0055b460
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.005608d0
add esp, 4
test esi, esi
jne 0x5e4f79
mov esi, eax
jmp 0x5e4f92
cmp esi, eax
je 0x5e4f92
call fcn.0055b2b0
push str.ossl_ecx_key_op
push 0xa5
jmp 0x5e4f44
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x5e4fc5
test esi, esi
je 0x5e4fc5
cmp esi, 0x40a
je 0x5e4fba
cmp esi, 0x43f
je 0x5e4fba
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5e4fbf
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x5e4fdd
call fcn.0055b2b0
push str.ossl_ecx_key_op
push 0xab
jmp 0x5e4f44
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x5e5001
cmp esi, 0x43f
je 0x5e5001
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x5e5011
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.0057bc30
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x5e505b
call fcn.0055b2b0
push str.ossl_ecx_key_op
push 0xb2
push str.cryptoececx_backend.c
call fcn.0055b3b0
push ebx
push 0xc0100
push 0x10
call fcn.0055b460
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x5e5077
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.00774520
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.0057bbb0
mov edi, eax
add esp, 4
test edi, edi
jne 0x5e50aa
call fcn.0055b2b0
push str.ossl_ecx_key_op
push 0xbc
push str.cryptoececx_backend.c
call fcn.0055b3b0
push edi
push 0xc0100
jmp 0x5e5180
cmp ebp, 2
jne 0x5e511c
test esi, esi
je 0x5e514f
cmp esi, 0x40a
je 0x5e50d7
cmp esi, 0x43f
je 0x5e50d7
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5e50dc
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.00552ed0
add esp, 0x10
test eax, eax
jle 0x5e518a
cmp esi, 0x40a
jne 0x5e510b
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x5e514f
cmp esi, 0x40b
jne 0x5e514f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x5e514f
cmp esi, 0x40a
je 0x5e513c
cmp esi, 0x43f
je 0x5e513c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5e5141
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.00774520
add esp, 0xc
push ebx
call fcn.005e51a0
add esp, 4
test eax, eax
jne 0x5e5070
call fcn.0055b2b0
push str.ossl_ecx_key_op
push 0xd0
push str.cryptoececx_backend.c
call fcn.0055b3b0
push 0
push 0xa6
push 0x10
call fcn.0055b460
add esp, 0x18
push ebx
call fcn.0057bbd0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x5e9b90
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.0075cd80
mov eax, dword [0x8a0204]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.005441c0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5e9c12
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.00543520
push edi
mov esi, eax
call fcn.005441f0
add esp, 0x1c
test esi, esi
jne 0x5e9c2c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.0055bf70
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0075c173
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.005e93d0
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.005e9350
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.0055bf70
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0075c173
add esp, 0xe4
ret
Function at 0x5e9ca0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.0075cd80
mov eax, dword [0x8a0204]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.005441c0
add esp, 0xc
mov edi, eax
call fcn.00544020
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x5e9eae
test esi, esi
je 0x5e9eae
push 0
push edi
push esi
call fcn.00543980
add esp, 0xc
test eax, eax
je 0x5e9eae
push 0x20
push ebx
push esi
call fcn.005439c0
add esp, 0xc
test eax, eax
je 0x5e9eae
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.00543850
add esp, 0xc
test eax, eax
je 0x5e9eae
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.00543980
add esp, 0xc
test eax, eax
je 0x5e9eae
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.005439c0
add esp, 0xc
test eax, eax
je 0x5e9eae
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.005439c0
add esp, 0xc
test eax, eax
je 0x5e9eae
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.00543850
add esp, 0xc
test eax, eax
je 0x5e9eae
lea eax, [esp + 0x100]
push eax
call fcn.005ee930
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005e93d0
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.005e9350
push 0
push edi
push esi
call fcn.00543980
add esp, 0x20
test eax, eax
je 0x5e9eae
push 0x20
push ebp
push esi
call fcn.005439c0
add esp, 0xc
test eax, eax
je 0x5e9eae
push 0x20
push dword [esp + 0x20]
push esi
call fcn.005439c0
add esp, 0xc
test eax, eax
je 0x5e9eae
push ebx
push dword [esp + 0x14]
push esi
call fcn.005439c0
add esp, 0xc
test eax, eax
je 0x5e9eae
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.00543850
add esp, 0xc
test eax, eax
je 0x5e9eae
lea eax, [esp + 0x140]
push eax
call fcn.005ee930
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.005ea3d0
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.0055bf70
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.0055bf70
push edi
call fcn.005441f0
push esi
call fcn.00543f90
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0075c173
add esp, 0x174
ret
Function at 0x60d910
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0075cd80
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x60d958
call fcn.0055b2b0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0055b3b0
push 0
push 0x78
push 4
call fcn.0055b460
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.0060d660
add esp, 4
test eax, eax
jne 0x60d994
call fcn.0055b2b0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0055b3b0
push 0
push 0xb2
push 4
call fcn.0055b460
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.005852f0
push esi
call fcn.005850a0
push esi
mov dword [esp + 0x2c], eax
call fcn.005850a0
push esi
mov ebp, eax
call fcn.005850a0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x60daf6
test ebp, ebp
je 0x60dacd
test ebx, ebx
je 0x60dac4
push 4
push ebp
call fcn.00540380
push 4
push ebx
call fcn.00540380
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x60d9fe
call fcn.00540250
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x60da0c
call fcn.00540250
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x60dac0
cmp dword [esi + 0x24], 0
je 0x60dac0
push 4
push eax
call fcn.00540380
push 4
push dword [esi + 0x24]
call fcn.00540380
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00666f60
add esp, 0x3c
test eax, eax
je 0x60dac0
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00666f60
add esp, 0x2c
test eax, eax
je 0x60dac0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.0060d5f0
add esp, 0x10
test eax, eax
js 0x60dac0
je 0x60da60
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.0060d5f0
add esp, 0x10
test eax, eax
js 0x60dac0
je 0x60da60
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.0053f950
add esp, 4
test ebx, ebx
je 0x60dada
push ebx
call fcn.0053f950
add esp, 4
push dword [esp + 0x20]
call fcn.0053f950
push esi
call fcn.00584fa0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x60dacd
jmp 0x60dac4
Function at 0x61ad80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0075cd80
cmp dword [esp + 0xc], 0
push ebp
push esi
push edi
je 0x61af34
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
inc eax
push esi
push ebp
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push edi
push dword [esp + 0x2c]
call fcn.0061abb0
add esp, 0x1c
test eax, eax
je 0x61af5c
push ebx
push 0x184
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.0053bb20
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x61ae1a
call fcn.0055b2b0
push str.tls1_prf_alg
push 0x185
push str.providersimplementationskdfs_tls1_prf.c
call fcn.0055b3b0
push ebx
push 0xc0100
push 0x39
call fcn.0055b460
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x10]
sub edi, eax
add edi, dword [esp + 0x24]
push esi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call fcn.0061abb0
add esp, 0x1c
test eax, eax
jne 0x61ae5c
push 0x18b
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.0053bc00
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
xor edi, edi
test esi, esi
je 0x61af15
cmp esi, 0x40
jb 0x61aefa
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, esi
cmp ebp, eax
ja 0x61ae81
cmp ecx, ebx
jae 0x61aefa
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, ebx
lea ecx, [ebx + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, edx
jb 0x61aea0
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x1c], edi
cmp edi, esi
jae 0x61af15
lea ecx, [edi + ebp]
mov edx, esi
mov ebp, ebx
sub ebp, dword [esp + 0x30]
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x61af07
push 0x190
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.0053bc00
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x2c]
call fcn.0061abb0
add esp, 0x1c
test eax, eax
jne 0x61af63
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x621800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x621873
mov edx, dword [esp + 0x10]
test edx, edx
je 0x621873
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0x14]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x621843
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x621830
mov eax, dword [ebx + 0x14]
pop esi
cmp edx, eax
jbe 0x621871
sub edx, eax
cmp edx, 0x10
jbe 0x621855
mov edx, 0x10
jmp 0x621859
test edx, edx
je 0x621871
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x621860
pop edi
pop ebx
pop ebp
ret
Function at 0x621af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0075cd80
mov eax, dword [0x8a0204]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x621b50
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x621b77
lea edi, [edx + 0x20]
jmp 0x621ba2
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x621b81
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.005a8a10
add esp, 0x14
test eax, eax
je 0x621cb9
cmp dword [esp + 0x14], edi
jne 0x621cb9
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.00774520
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x621c4f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x621c0f
test ecx, ecx
jne 0x621c0f
test eax, eax
je 0x621c32
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.00621880
add esp, 0x1c
test eax, eax
je 0x621cb9
test edi, edi
je 0x621c72
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.00621800
add esp, 0xc
jmp 0x621c72
push dword [esp + 0x90]
push ebp
push esi
call fcn.00621800
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00621800
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.005a89e0
add esp, 0x18
test eax, eax
je 0x621cb9
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.005a89e0
add esp, 0x18
test eax, eax
je 0x621cb9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0075c173
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0075c173
add esp, 0x74
ret