joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e490
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xd
nop dword [eax]
push 1
push 0x104
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0xc]
call fcn.0045e8e0
add esp, 0xc
push eax
push 0x104
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call fcn.0045e8e0
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x45e508
call edi
cmp eax, 5
jne 0x45e4ff
push 1
push esi
call ebx
add esi, esi
cmp esi, 0x64
jl 0x45e4b0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ec40
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test esi, esi
je 0x45ec87
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x60840c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 4], eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x45ed40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, ecx
and edx, 1
shl edx, 2
push esi
push 0
mov eax, edx
or eax, 1
and cl, 2
push 0
cmove eax, edx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
test esi, esi
jns 0x45ed9f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x60840c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 4], eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x45edb0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, eax
test edx, edx
je 0x45edf8
mov ecx, dword fs:[0x2c]
cmp edx, 0x2733
mov eax, 0xb
cmove edx, eax
mov eax, dword [0x60840c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 4], edx
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x45ee3f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x60840c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 4], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
inc dword [0x602c9c]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45ee60
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, word [edi]
cmp ecx, 2
setne al
lea eax, [eax*4 + 4]
add eax, edi
push eax
push esi
push ecx
call fcn.00518e70
add esp, 0xc
test eax, eax
jne 0x45ef1b
movzx eax, word [edi]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp + 0xc], 0
push eax
push 0
push esi
movups xmmword [ebp - 0x10], xmm0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x45eef3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x60840c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
pop edi
pop esi
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 4], eax
xor al, al
mov esp, ebp
pop ebp
ret
cmp word [edi], 2
mov ecx, 0x10
mov esi, dword [ebp + 0xc]
mov eax, 0x1c
cmove eax, ecx
push eax
push dword [esi + 0x18]
push edi
call fcn.005849d0
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4659a0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x70
push 0
push esi
call fcn.00584f50
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
pop ebp
ret

Function at 0x465cf0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x70
push 0
push esi
call fcn.00584f50
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
pop ebp
ret
Function at 0x4718e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], 1
push edi
push edi
push str.RANDFILE
mov dword [ebp - 4], str.RANDFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
jne 0x471960
push edi
push edi
push str.HOME
mov dword [ebp - 4], str.HOME
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x471960
push eax
push eax
push str.USERPROFILE
mov dword [ebp - 4], str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x471960
push eax
push eax
push str.SYSTEMROOT
mov dword [ebp - 4], str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x4719d8
lea eax, [esi + esi]
call fcn.0055e4d0
mov eax, esp
push esi
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
jae 0x4719c6
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x4719c6
call fcn.0055e4d0
mov esi, esp
push 0
push 0
push dword [ebp - 4]
push esi
push 0xffffffffffffffff
push dword [ebp - 0xc]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, esi
mov edx, dword [ebp - 8]
test edx, edx
jne 0x4719e1
test edi, edi
jne 0x4719e5
mov edi, 0x59a9b8
jmp 0x4719ea
mov edx, edi
mov edi, 0x59a9b8
jmp 0x4719ea
test edi, edi
je 0x471a5d
cmp byte [edi], 0
je 0x471a5d
mov ecx, edi
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4719f0
sub ecx, esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x471a22
lea eax, [ecx + 1]
cmp eax, esi
jae 0x471a22
push esi
push edi
push ebx
call fcn.004784a0
add esp, 0xc
cmp eax, esi
jb 0x471a60
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 6]
cmp eax, esi
jae 0x471a60
push esi
push edi
push ebx
call fcn.004784a0
push esi
push 0x58cc00
push ebx
call fcn.00478440
push esi
push str..rnd
push ebx
call fcn.00478440
xor eax, eax
add esp, 0x24
cmp byte [ebx], al
cmovne eax, ebx
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebx], 0
xor eax, eax
cmp byte [ebx], al
cmovne eax, ebx
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471a80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
test eax, eax
jne 0x471a9b
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x471aab
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push 0x58b6d4
push eax
call fcn.004a6a40
mov ebx, eax
add esp, 8
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x471baa
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.00584f50
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push ebx
call fcn.0056dbe8
add esp, 4
push eax
call fcn.00566279
add esp, 8
test eax, eax
js 0x471ba1
sub esp, 8
lea eax, [ebp - 0x34]
xorps xmm0, xmm0
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.004716d0
add esp, 0x10
test dword [ebp - 0x2e], 0x2000
je 0x471b30
mov eax, 0x800
cmp esi, 0xffffffff
push 0
push ebx
cmove esi, eax
call fcn.0056dc0e
add esp, 8
nop dword [eax]
mov edi, 0x400
test esi, esi
jle 0x471b3e
cmp esi, edi
cmovl edi, esi
push ebx
push edi
lea eax, [ebp - 0x434]
push 1
push eax
call fcn.00566a01
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x471b87
movd xmm0, ebx
lea eax, [ebp - 0x434]
cvtdq2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push ebx
push eax
call fcn.004716d0
add dword [ebp - 4], ebx
add esp, 0x10
mov ebx, dword [ebp + 8]
test esi, esi
jle 0x471b30
sub esi, edi
test esi, esi
jg 0x471b30
lea eax, [ebp - 0x434]
push 0x400
push eax
call fcn.00401360
mov ebx, dword [ebp + 8]
add esp, 8
mov edi, dword [ebp - 4]
push ebx
call fcn.00564794
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x475c50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call fcn.00584f50
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x4787b0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x478834
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x478834
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0041d430
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.00563fd2
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [ebp - 4]
push 0
push ecx
test eax, eax
mov ecx, 0x200
cmovs eax, ecx
push eax
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x210]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x478840
sub ecx, edx
lea esi, [ecx + 1]
lea eax, [esi + esi]
call fcn.0055e4d0
mov edi, esp
test edi, edi
jne 0x478864
mov edi, str.no_stack_
jmp 0x4788ef
push esi
push edi
push esi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x478890
xor ecx, ecx
test esi, esi
je 0x478890
nop dword [eax]
mov eax, dword [ebp + 8]
movzx eax, byte [ecx + eax]
mov word [edi + ecx*2], ax
inc ecx
cmp ecx, esi
jb 0x478880
xor edx, edx
test esi, esi
je 0x4788ef
lea ebx, [edx + 0x53]
nop dword [eax]
cmp word [edi + edx*2], 0x25
jne case.0x4788c2.43
lea ecx, [edx + 1]
lea ecx, [edi + ecx*2]
nop dword [eax]
movzx eax, word [ecx]
add eax, 0xffffffd6
cmp eax, 0x49
ja case.0x4788c2.43
movzx eax, byte [eax + 0x4789ac]
jmp dword [eax*4 + 0x478994]
inc edx
add ecx, 2
jmp 0x4788b0
mov word [ecx], bx
jmp case.0x4788c2.43
mov eax, 0x73
jmp 0x4788e7
mov eax, 0x43
jmp 0x4788e7
mov eax, 0x63
mov word [ecx], ax
inc edx
cmp edx, esi
jb 0x4788a0
lea eax, [ebp + 0xc]
push eax
push 0
push edi
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0041d430
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0056401a
add esp, 0x1c
xor eax, eax
mov word [ebp - 6], ax
call fcn.004786a0
test eax, eax
jle 0x478970
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x478986
push 0
lea eax, [ebp - 0x204]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x210]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x210]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478ec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call fcn.004a6a40
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.00585160
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x478f79
push 0x4a
push str.........prog3rdPartyLibsopenssl_1.1crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00473d60
push 0x58b430
push esi
push 0x5adf50
push dword [ebp + 8]
push str.fopen_
push 5
call fcn.00473630
add esp, 0x2c
call fcn.00564579
cmp dword [eax], 2
je 0x478f5a
call fcn.00564579
cmp dword [eax], 6
je 0x478f5a
push 0x53
push str.........prog3rdPartyLibsopenssl_1.1crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00473d60
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x51
push str.........prog3rdPartyLibsopenssl_1.1crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00473d60
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x5aded8
call fcn.00460650
mov esi, eax
add esp, 4
test esi, esi
jne 0x478f9c
push edi
call fcn.00564794
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push esi
call fcn.00460250
push edi
push ebx
push 0x6a
push esi
call fcn.00460280
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x488dd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
add ebx, esi
push edi
mov edi, dword [ebp + 8]
movzx eax, cl
add edi, esi
and eax, 1
test esi, esi
je 0x488e0e
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [ebp + 0x14]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x488df0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48ed50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
sub ecx, 4
jb 0x48ed77
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x48ed7e
add edx, 4
add esi, 4
sub ecx, 4
jae 0x48ed66
xor edi, edi
cmp ecx, 0xfffffffc
je 0x48edb9
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x48edb9
cmp ecx, 0xfffffffd
je 0x48edb9
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x48edb9
cmp ecx, 0xfffffffe
je 0x48edb9
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x48edb9
cmp ecx, 0xffffffff
je 0x48edb9
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x48edd4
push 0x159
push str.........prog3rdPartyLibsopenssl_1.1cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.00478670
add esp, 0xc
mov edi, dword [ebp + 0xc]
xor ecx, ecx
test ebx, ebx
jle 0x48edf1
mov esi, dword [ebp + 8]
mov edx, edi
sub esi, edi
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x48edf1
inc ecx
inc edx
cmp ecx, ebx
jl 0x48ede4
lea edx, [ebx - 1]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x48ee13
mov esi, ebx
lea eax, [edx + edi]
sub esi, edi
cmp byte [eax + esi], 0
jne 0x48ee13
cmp byte [eax], 0xff
jne 0x48ee13
dec eax
sub edx, 1
jns 0x48ee02
cmp ecx, edx
jl case.0x48ee3f.2
jle 0x48ee25
pop edi
pop esi
lea eax, [ecx*8]
pop ebx
pop ebp
ret
mov dh, byte [ecx + ebx]
mov bl, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x48ee3f.2
movzx eax, byte [eax + 0x48eeb0]
jmp dword [eax*4 + 0x48ee90]
mov eax, 7
jmp 0x48ee75
mov eax, 6
jmp 0x48ee75
mov eax, 5
jmp 0x48ee75
mov eax, 4
jmp 0x48ee75
mov eax, 3
jmp 0x48ee75
mov eax, 2
jmp 0x48ee75
mov eax, 1
test dl, dh
jne case.0x48ee3f.2
and bl, dl
cmp bl, dl
jne case.0x48ee3f.2
pop edi
pop esi
lea eax, [eax + ecx*8]
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x493f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
test esi, esi
je 0x493f70
mov al, byte [esi]
test al, al
je 0x493f70
push edi
mov edi, 0x100
nop dword [eax]
movzx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x493f40
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4b8a60
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, 2
je 0x4b8aba
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4b8aac
push eax
push 0
lea eax, [ebp + 0x18]
push eax
push 0
call fcn.00489a50
add esp, 0x10
cmp dword [ebp + 0x18], 0xffffffff
je 0x4b8aac
push 0x2f
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.00473d60
add esp, 0x14
xor eax, eax
pop edi
pop ebx
pop ebp
ret
test edi, edi
je 0x4b8ab6
cmp dword [ebp + 0x14], 0x20
je 0x4b8aba
push 0x35
jmp 0x4b8a90
push esi
push 0x3a
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push 0x24
call fcn.00460160
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4b8af1
push 0x3c
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00473d60
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
jne 0x4b8b07
push dword [ebp + 0x14]
push edi
push esi
call fcn.005849d0
add esp, 0xc
jmp 0x4b8bb5
push 0x43
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push 0x20
call fcn.004b00e0
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x4b8b4b
push 0x45
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00473d60
push 0x46
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push esi
call fcn.00460020
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 2
jne 0x4b8b9b
push 0x20
push eax
call fcn.00471700
add esp, 8
test eax, eax
jg 0x4b8b85
push 0x4b
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push dword [esi + 0x20]
call fcn.004b00d0
push 0x4c
push str.........prog3rdPartyLibsopenssl_1.1cryptoececx_meth.c
push esi
call fcn.00460020
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x20]
and byte [eax], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x4b8ba9
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.004e8a80
add esp, 8
push esi
push 0x40a
push dword [ebp + 8]
call fcn.00464800
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4be230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, 1
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
shl ebx, cl
call fcn.0047a0d0
add esp, 8
test eax, eax
jne 0x4be261
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 3
jg 0x4be2c5
xor ecx, ecx
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0xc], ecx
jle 0x4be3fb
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x4be2a6
nop dword [eax]
mov ecx, eax
xor ecx, dword [ebp + 0x14]
lea edx, [ecx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
neg edx
and edx, 1
neg edx
and edx, dword [edi + eax*4]
inc eax
or esi, edx
cmp eax, ebx
jl 0x4be280
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
inc ecx
lea eax, [ebx*4]
mov dword [ebp + 0x18], ecx
add edi, eax
cmp ecx, dword [ebp + 0xc]
jl 0x4be274
jmp 0x4be3fb
mov edx, dword [ebp + 0x14]
lea ecx, [esi - 2]
sar edx, cl
mov esi, 1
shl esi, cl
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], esi
lea eax, [esi - 1]
and ecx, eax
mov eax, edx
mov dword [ebp - 0x10], ecx
not eax
shr eax, 0x1f
lea ecx, [edx - 1]
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 1
and ecx, 1
neg ecx
mov dword [ebp - 0x20], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 2
and ecx, 1
xor edx, 3
neg ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [edx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
neg ecx
and eax, edx
and ecx, 1
neg eax
xor edx, edx
and eax, 1
mov dword [ebp - 0xc], edx
neg ecx
neg eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], edx
jle 0x4be3fb
shl ebx, 2
mov dword [ebp - 0x28], ebx
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0x18], ecx
test esi, esi
jle 0x4be3e3
lea eax, [esi + esi*2]
lea edx, [edi + esi*4]
lea ecx, [edi + esi*8]
mov dword [ebp - 8], edx
lea eax, [edi + eax*4]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [eax]
mov esi, ebx
mov ecx, dword [ecx]
and ecx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
xor esi, dword [ebp - 0x10]
or ecx, eax
mov edx, dword [edx]
and edx, dword [ebp - 0x1c]
mov eax, dword [edi + ebx*4]
or edx, ecx
and eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
or eax, edx
mov edx, dword [ebp - 8]
and ecx, esi
mov esi, dword [ebp - 0x24]
neg ecx
and ecx, 1
inc ebx
neg ecx
add edx, 4
and ecx, eax
mov dword [ebp - 8], edx
or dword [ebp + 0x18], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add eax, 4
add ecx, 4
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ecx
cmp ebx, esi
jl 0x4be381
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add edi, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [eax + edx*4], ecx
inc edx
mov dword [ebp - 0xc], edx
cmp edx, dword [ebp + 0xc]
jl 0x4be361
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
mov dword [eax + 4], edi
call fcn.00479eb0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret