joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e8ce5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0xa8], eax
xor esi, esi
mov eax, dword [edx + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x8c], eax
sub eax, edi
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x88], esi
cmp dword [edx + 0xc], edi
jb 0x5e8e8f
cmp edi, 0x40
ja 0x5e8e8f
lea eax, [ebp - 0x84]
neg eax
lea ecx, [ebp - 0x84]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [ebp - 0x9c], ecx
cmp dword [edx + 0xc], eax
jbe 0x5e8d68
mov eax, dword [edx + 0xc]
sub eax, edi
sub eax, 0x100
mov dword [ebp - 0x88], eax
push ebx
push edi
push esi
push ecx
mov dword [ebp - 0x98], esi
mov ebx, esi
call fcn.00739c90
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x90], esi
cmp ecx, dword [eax + 0xc]
jae 0x5e8e50
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xa4], eax
mov eax, ecx
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov eax, ecx
xor eax, dword [ebp - 0xa0]
xor edx, dword [ebp - 0x8c]
lea esi, [eax - 1]
not eax
shr eax, 0x1f
shr esi, 0x1f
and esi, eax
mov eax, ecx
xor eax, dword [ebp - 0x8c]
neg esi
or edx, eax
mov eax, dword [ebp - 0xa4]
xor edx, ecx
shr edx, 0x1f
neg edx
mov cl, byte [eax + ecx]
mov eax, esi
or eax, dword [ebp - 0x98]
and esi, dword [ebp - 0x90]
and eax, edx
mov edx, dword [ebp - 0x9c]
or ebx, esi
mov esi, dword [ebp - 0x90]
mov dword [ebp - 0x98], eax
and al, cl
or byte [esi + edx], al
inc esi
mov ecx, esi
mov eax, esi
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [ebp + 0xc]
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
mov ecx, dword [ebp - 0x88]
inc ecx
mov dword [ebp - 0x90], esi
inc dword [ebp - 0x94]
mov dword [ebp - 0x88], ecx
cmp ecx, dword [eax + 0xc]
jb 0x5e8dab
xor esi, esi
jmp 0x5e8e56
mov edx, dword [ebp - 0x9c]
test edi, edi
je 0x5e8e89
mov ecx, dword [ebp - 0xa8]
mov eax, ebx
xor eax, 0x20
mov al, byte [eax + edx]
mov al, byte [ebx + edx]
inc ebx
mov byte [ecx + esi], al
mov ecx, ebx
sub ecx, edi
mov eax, ebx
xor ecx, edi
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
inc esi
cmp esi, edi
jb 0x5e8e5a
xor eax, eax
inc eax
pop ebx
jmp 0x5e8e91
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.007207bc
leave
ret
Function at 0x5e9e75
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
inc ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov ecx, dword [esi + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x5e9ef0
mov edx, dword [ebp + 0x10]
lea eax, [ebx + edx]
cmp eax, ecx
ja 0x5e9ef4
add dword [esi + 0x14], edx
sub ecx, edx
add dword [esi + 0x18], edx
sub dword [esi + 0xc], edx
mov dword [esi + 8], ecx
mov eax, dword [esi + 0x14]
push dword [edi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [ebp + 0x17], al
mov dword [ebp - 4], ebx
call fcn.00545956
push eax
call fcn.00544c9d
mov edi, dword [esi + 8]
mov dword [ebp - 0x10], edi
pop ecx
pop ecx
and eax, 0x200000
je 0x5e9efb
sub edi, ebx
xor eax, eax
dec edi
inc eax
mov dword [esi + 8], edi
jmp 0x5e9f9e
cmp ebx, ecx
jbe 0x5e9eb2
xor eax, eax
jmp 0x5e9f9e
mov ecx, dword [ebp - 8]
mov eax, edi
add ecx, ebx
mov ebx, edi
sub ebx, ecx
xor eax, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edi
shr ebx, 0x1f
dec ebx
cmp edi, eax
cmovb eax, edi
mov dword [ebp - 8], eax
test eax, eax
je 0x5e9f75
mov eax, dword [esi + 0x14]
dec edi
mov edx, dword [ebp - 4]
add eax, edi
mov esi, dword [ebp - 4]
shr edx, 0x1f
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp + 8], eax
mov ecx, esi
mov eax, edi
sub ecx, edi
shr eax, 0x1f
shr ecx, 0x1f
xor cl, al
xor al, dl
or cl, al
mov eax, dword [ebp + 8]
dec cl
movzx edx, cl
movzx ecx, byte [eax]
movzx eax, byte [ebp + 0x17]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [ebp - 0xc]
inc edi
dec dword [ebp + 8]
cmp edi, dword [ebp - 8]
jb 0x5e9f3a
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
not ebx
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
inc eax
and eax, ecx
sub edi, eax
mov dword [esi + 8], edi
mov dword [ebp + 0x14], ecx
not ecx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
and ecx, 1
or eax, ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5eee80
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
push esi
mov esi, dword [ebp + 8]
push ecx
push 0x20
push eax
call fcn.0056c6fe
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.005f1b08
lea eax, [ebp - 0xe4]
push eax
push esi
call fcn.005f1ab0
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00562841
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop esi
call fcn.007207bc
leave
ret

Function at 0x5eeeec
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x19c]
push edi
mov edi, dword [ebp + 0x14]
push eax
call fcn.0056ca32
push 0x20
lea eax, [ebp - 0x19c]
push esi
push eax
call fcn.0056cadf
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0056c770
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x19c]
push eax
call fcn.0056ca32
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.0056cadf
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.0056cadf
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0056c770
lea eax, [ebp - 0x84]
push eax
call fcn.005f4d02
add esp, 0x40
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.005f1b08
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push esi
call fcn.005f1ab0
lea eax, [ebp - 0x19c]
push eax
call fcn.0056ca32
push 0x20
lea eax, [ebp - 0x19c]
push esi
push eax
call fcn.0056cadf
push 0x20
lea eax, [ebp - 0x19c]
push edi
push eax
call fcn.0056cadf
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.0056cadf
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0056c770
add esp, 0x40
lea eax, [ebp - 0xc4]
push eax
call fcn.005f4d02
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.005f1e15
lea eax, [ebp - 0x19c]
push 0xd8
push eax
call fcn.00562841
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.00562841
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00562841
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor eax, eax
xor ecx, ebp
inc eax
pop edi
pop esi
pop ebx
call fcn.007207bc
leave
ret
Function at 0x5ef219
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
and byte [ebp - 0x24], 0xf8
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.005f1b08
pop ecx
pop ecx
xor esi, esi
mov edx, dword [ebp + esi - 0xc4]
mov ecx, dword [ebp + esi - 0xec]
lea eax, [edx + ecx]
sub edx, ecx
mov dword [ebp + esi - 0x4c], eax
mov dword [ebp + esi - 0x74], edx
add esi, 4
cmp esi, 0x28
jb 0x5ef262
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.005ef618
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x4c]
push eax
push eax
call fcn.005ef881
lea eax, [ebp - 0x4c]
push eax
push ebx
call fcn.005f0f05
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00562841
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.007207bc
leave
ret

Function at 0x5ef332
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
neg edx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0xa
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x5ef347
pop edi
pop esi
pop ebp
ret

Function at 0x5ef35c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0xa
neg edi
sub esi, edx
pop ebx
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, edi
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x5ef372
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5f737d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10
sub esi, edx
pop edi
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, dword [ebp + 0x10]
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub edi, 1
jne 0x5f738d
pop edi
pop esi
pop ebp
ret
Function at 0x5f882d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x134], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], ecx
test edi, edi
je 0x5f8881
cmp edi, dword [ebx]
je 0x5f887d
test eax, eax
je 0x5f8a67
test esi, esi
js 0x5f8a67
mov dword [ebx], edi
jmp 0x5f888c
cmp dword [ebx], 0
je 0x5f8a67
mov edi, dword [ebx]
push edi
call fcn.00546fff
pop ecx
test al, 2
jne 0x5f8a67
xor eax, eax
inc eax
cmp dword [ebp - 0x128], 0
je 0x5f8a21
push edi
mov dword [ebp - 0x134], eax
call fcn.00544c92
pop ecx
mov ecx, 0x90
cmp eax, ecx
jg 0x5f8a67
cmp eax, esi
jge 0x5f8926
push dword [ebp - 0x12c]
push edi
push dword [ebx + 4]
call fcn.0056ffbe
add esp, 0xc
test eax, eax
je 0x5f8a67
push esi
push dword [ebp - 0x128]
push dword [ebx + 4]
call fcn.0057013f
add esp, 0xc
test eax, eax
je 0x5f8a67
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x94]
push eax
push dword [ebx + 4]
call fcn.0056ff33
add esp, 0xc
test eax, eax
je 0x5f8a67
mov esi, dword [ebp - 0x130]
jmp 0x5f894a
cmp esi, ecx
ja 0x5f8a67
push esi
push dword [ebp - 0x128]
lea eax, [ebp - 0x94]
push eax
call fcn.007390e0
add esp, 0xc
mov dword [ebp - 0x130], esi
mov ecx, 0x90
cmp esi, ecx
je 0x5f896e
sub ecx, esi
lea eax, [ebp - 0x94]
push ecx
add eax, esi
push 0
push eax
call fcn.00739c90
add esp, 0xc
mov ecx, 0x90
xor esi, esi
mov eax, esi
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmmword [str.6666666666666666d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_sign.c]
movups xmmword [ebp + eax - 0x124], xmm0
add eax, 0x10
cmp eax, ecx
jl 0x5f8972
push dword [ebp - 0x12c]
push edi
push dword [ebx + 8]
call fcn.0056ffbe
add esp, 0xc
test eax, eax
je 0x5f8a41
push edi
call fcn.00544c92
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 8]
call fcn.0057013f
add esp, 0x10
test eax, eax
je 0x5f8a41
mov eax, esi
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmmword [0x853950]
movups xmmword [ebp + eax - 0x124], xmm0
add eax, 0x10
cmp eax, 0x90
jl 0x5f89ca
push dword [ebp - 0x12c]
push edi
push dword [ebx + 0xc]
call fcn.0056ffbe
add esp, 0xc
test eax, eax
je 0x5f8a41
push edi
call fcn.00544c92
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0xc]
call fcn.0057013f
add esp, 0x10
test eax, eax
je 0x5f8a41
jmp 0x5f8a23
xor esi, esi
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00570171
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
cmp dword [ebp - 0x134], 0
je 0x5f8a63
mov ebx, 0x90
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.00562841
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.00562841
add esp, 0x10
mov eax, esi
jmp 0x5f8a69
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
Function at 0x60e25e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, dword [edi + 4]
cmovge edx, edi
cmovge edi, ecx
mov dword [ebp + 0xc], edx
push dword [edi + 4]
push ebx
call fcn.0054db71
pop ecx
pop ecx
test eax, eax
je 0x60e2d1
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [eax + 4], esi
jle 0x60e2bc
mov eax, dword [eax]
mov ecx, dword [edi]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax + 4]
jl 0x60e297
jmp 0x60e2bc
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [edi + 4]
cmp esi, eax
jl 0x60e2b1
push ebx
mov dword [ebx + 4], eax
call fcn.0054d955
pop ecx
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x60efeb
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0x14]
xor edi, edi
call fcn.00564f0f
push dword [ebp + 0x14]
call fcn.00564e52
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x60f1ca
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.0054db71
pop ecx
pop ecx
test eax, eax
je 0x60f1c9
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x60f1a7
mov edi, ecx
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x60f039
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.0054d955
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.0060e343
add esp, 0x10
test eax, eax
push 1
pop eax
cmovne edi, eax
pop ebx
push dword [ebp + 0x14]
call fcn.00564db2
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x61f77b
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
shr eax, 0x10
xor eax, dword [ebp + 8]
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop ebp
ret

Function at 0x62bd17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], 1
push esi
mov esi, ebx
jb 0x62bd51
push edi
mov edi, ebx
xor edx, edx
lea edi, [edi + 8]
lea eax, [ebx + edi]
xor ecx, ecx
bts edx, eax
inc esi
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
cmp ebx, ecx
ja 0x62bd29
jb 0x62bd50
cmp dword [ebp + 8], edx
jae 0x62bd29
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x63ae18
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x100
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
jne 0x63ae8e
mov edx, dword [ebp + 8]
movaps xmm0, xmmword [str.expand_32_byte_kexpand_16_byte_k]
movups xmmword [esi], xmm0
movd xmm0, dword [eax]
movd xmm3, dword [edx + 0x10]
movd xmm1, dword [edx]
movd xmm2, dword [edx + 0x14]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x10], xmm2
movd xmm3, dword [eax + 4]
movd xmm0, dword [edx + 4]
movd xmm1, dword [edx + 0x18]
movd xmm2, dword [ebp + 0x14]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x20], xmm2
movd xmm3, dword [edx + 8]
movd xmm0, dword [edx + 0x1c]
movd xmm2, dword [edx + 0xc]
jmp 0x63aeef
mov ecx, dword [ebp + 8]
movaps xmm0, xmmword [0x865ae0]
movups xmmword [esi], xmm0
movd xmm0, dword [eax]
movd xmm3, dword [ecx]
movd xmm1, dword [ecx]
movd xmm2, dword [ecx + 4]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x10], xmm2
movd xmm3, dword [eax + 4]
movd xmm0, dword [ecx + 4]
movd xmm1, dword [ecx + 8]
movd xmm2, dword [ebp + 0x14]
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [esi + 0x20], xmm2
movd xmm3, dword [ecx + 8]
movd xmm0, dword [ecx + 0xc]
movd xmm2, dword [ecx + 0xc]
movd xmm1, dword [ebp + 0x18]
mov eax, esi
punpckldq xmm1, xmm3
punpckldq xmm2, xmm0
punpckldq xmm2, xmm1
movups xmmword [esi + 0x30], xmm2
pop esi
pop ebp
ret 0x14
Function at 0x63bca4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x63bdbf
lea eax, [ebp - 0x42c]
push eax
push 0
push 0
push 0x89a050
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x63bd2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x430], esi
push eax
call fcn.0061b638
lea eax, [ebp - 0x11c]
push eax
push esi
push str.Failed_to_read___AppData___path._Error___u_:__s
push 0x29
push str.d:package_cache_tact3.9.2_src_armadillo_armadillo.windows.cpp
push 4
push str.tact
call fcn.007a784a
add esp, 0x24
mov al, 1
jmp 0x63bdc1
xor ecx, ecx
lea eax, [ebp - 0x428]
push ecx
push ecx
push 0x30c
push eax
push 0xffffffffffffffff
push dword [ebp - 0x42c]
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x42c]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
je 0x63bd25
mov eax, 0x30c
cmp edi, eax
jl 0x63bd89
push eax
push str.Path_to___AppData___is_too_long._It_exceeds__d_characters.
push 0x3a
push str.d:package_cache_tact3.9.2_src_armadillo_armadillo.windows.cpp
push 4
push str.tact
call fcn.007a784a
add esp, 0x18
jmp 0x63bd25
movaps xmm0, xmmword [str.Battle.net_Armad.index]
lea eax, [edi + 0x16]
mov dword [ebp - 0xc], 0x6f6c6c69
mov byte [ebp - 8], 0
movups xmmword [ebp - 0x1c], xmm0
cmp eax, esi
ja 0x63bdbf
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push ebx
call fcn.006b3be5
add esp, 0x10
xor al, al
jmp 0x63bdc1
mov al, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret
Function at 0x650e56
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x6c], eax
call fcn.006aec4f
push edx
push eax
call fcn.006aebc9
mov edi, eax
mov eax, edx
add edi, 0x9502f900
mov dword [ebp - 0x68], edi
adc eax, 0
xor bl, bl
mov dword [ebp - 0x64], eax
call fcn.006aec4f
push edx
push eax
call fcn.006aebc9
push dword [ebp - 0x64]
push edi
push edx
push eax
call fcn.0061b5ec
add esp, 0x20
test al, al
je 0x650ee0
lea edi, [esi + 0xc]
push edi
call fcn.006ace26
mov bl, al
pop ecx
test bl, bl
jne 0x650efe
call fcn.006aec4f
push edx
push eax
call fcn.006aebc9
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push edx
push eax
call fcn.0061b5ec
add esp, 0x18
test al, al
jne 0x650eb3
push str.Failed_to_aquire_downloader_lock_while_dumping_state.
push 0x2eb
push str.d:package_cache_tact3.9.2_srcdownloaddownload_curl.cpp
push 4
push str.tact
call fcn.007a784a
add esp, 0x14
movaps xmm0, xmmword [0x869610]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x10], 0x6e776f44
movaps xmm0, xmmword [0x869600]
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0xc], 0x6325203a
movaps xmm0, xmmword [0x8695f0]
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 8], 0xa
movaps xmm0, xmmword [0x869620]
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmmword [0x8695e0]
movups xmmword [ebp - 0x20], xmm0
mov al, byte [esi + 0x354]
push 0x46
pop ecx
push 0x54
pop edx
test al, al
lea eax, [ebp - 0x60]
cmovne ecx, edx
push ecx
push dword [esi + 0x190]
push dword [esi + 0x14c]
push dword [esi + 0x10c]
push eax
push dword [ebp - 0x6c]
call fcn.0061b77b
add esp, 0x18
test bl, bl
je 0x650f8a
lea eax, [esi + 0xc]
push eax
call fcn.006ace18
pop ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret 4