joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5143a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
test ebp, ebp
je 0x514429
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x10]
mov ecx, esi
call dbg.do_twofish_decrypt
xor eax, eax
mov edx, dword [ebx + eax]
xor edx, dword [esp + eax + 0x10]
mov ecx, dword [esi + eax]
mov dword [edi + eax], edx
mov dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x5143d1
add esi, 0x10
add edi, 0x10
sub ebp, 1
jne 0x5143c0
mov eax, 0x24
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x5143f9

Function at 0x514430
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
test ebp, ebp
je 0x5144d6
mov eax, dword [esp + 0x54]
add eax, 0xf
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
lea edi, [eax - 1]
lea esi, [esi]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x20]
call dbg.do_twofish_encrypt
xor eax, eax
mov edx, dword [esp + eax + 0x20]
xor edx, dword [esi + eax]
mov dword [ebx + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x514473
mov edx, dword [esp + 0x1c]
add ebx, 0x10
add esi, 0x10
nop
add byte [edx], 1
jne 0x51449c
sub edx, 1
cmp edx, edi
jne 0x514490
sub ebp, 1
jne 0x514460
mov eax, 0x24
mov dword [esp], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dbg.__gcry_burn_stack
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x5144a6

Function at 0x5144e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
test ebp, ebp
je 0x514546
nop
lea esi, [esi]
mov eax, dword [esp + 0x30]
mov ecx, ebx
mov edx, ebx
call dbg.do_twofish_encrypt
xor eax, eax
nop
mov edx, dword [esi + eax]
mov ecx, dword [ebx + eax]
xor ecx, edx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x514510
add edi, 0x10
add esi, 0x10
sub ebp, 1
jne 0x514500
mov eax, 0x24
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x519bfa
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x54
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0x67452301
mov dword [ebp - 0x20], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x28], 0x10325476
mov dword [ebp - 0x14], 0
jmp 0x519cd7
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
shrd eax, edx, cl
shr edx, cl
test cl, 0x20
je 0x519c4b
mov eax, edx
xor edx, edx
mov ebx, eax
and ebx, 1
mov dword [ebp - 0x38], ebx
mov eax, edx
and eax, 0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
or eax, dword [ebp - 0x38]
test eax, eax
je 0x519c8d
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov edi, ecx
xor edi, eax
mov dword [ebp - 0x40], edi
mov edi, ebx
xor edi, edx
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
jmp 0x519cb3
mov ecx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov esi, ecx
xor esi, eax
mov dword [ebp - 0x48], esi
mov edi, ebx
xor edi, edx
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [esp + 8], 1
mov dword [esp], eax
mov dword [esp + 4], edx
call dbg.rol64
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0x3f
jbe 0x519c32
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, ecx
xor esi, eax
mov dword [ebp - 0x50], esi
xor ebx, edx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ebx
mov dword [eax + 4], esi
nop
add esp, 0x54
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x51a5e0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov esi, eax
sub esp, 0x3c
mov dword [esp], str.GCRYPT_RNDW32_NOPERF
call sym._getenv
test eax, eax
je 0x51a640
mov edx, dword [0x74351c]
test edx, edx
je 0x51a620
mov dword [esp], 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.note:_get_performance_data_has_been_disabled_n
mov dword [0x74351c], 1
call dbg._gcry_log_info
jmp 0x51a605
mov eax, dword [0x5bf1e0]
mov ebx, 0xa
mov dword [esp], eax
call dbg._gcry_xmalloc
mov ebp, eax
jmp 0x51a6c1
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Global
mov dword [esp + 0x14], eax
mov dword [esp], 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
je 0x51a710
cmp eax, 0xea
jne 0x51a6e4
mov eax, dword [0x5bf1e0]
mov dword [esp], ebp
add eax, 0x4000
mov dword [esp + 4], eax
mov dword [0x5bf1e0], eax
call dbg._gcry_xrealloc
sub ebx, 1
mov ebp, eax
je 0x51a701
mov eax, dword [0x5bf1e0]
mov dword [esp + 0x2c], eax
mov eax, dword [0x74352c]
test eax, eax
je 0x51a660
mov dword [esp], str.rndw32slow_gatherer_nt:_get_perf_data_n
call dbg._gcry_log_debug
jmp 0x51a660
cmp eax, dword [0x743518]
je 0x51a701
mov dword [esp + 4], eax
mov dword [esp], str.rndw32:_get_performance_data_problem:_ec_ld_n
mov dword [0x743518], eax
call dbg._gcry_log_debug
mov dword [esp], ebp
call dbg._gcry_free
jmp 0x51a605
mov dword [esp + 8], 8
mov dword [esp + 4], str.PERF
mov dword [esp], ebp
call sym._memcmp
test eax, eax
jne 0x51a73f
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], edi
mov dword [esp], ebp
mov dword [esp + 4], eax
call esi
jmp 0x51a701
mov dword [esp], str.rndw32:_no_PERF_signature_n
call dbg._gcry_log_debug
jmp 0x51a701
Function at 0x51b600
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x40
mov eax, dword [0x74356c]
mov edi, dword [esp + 0x54]
test eax, eax
je 0x51b6c0
mov eax, dword [esp + 0x50]
cmp ecx, 1
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
je 0x51b6b1
mov dword [esp], edi
call dbg._gcry_mpi_get_nbits
mov dword [esi + 0xc], eax
mov dword [esp], edi
call dbg._gcry_mpi_copy
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call dbg._gcry_mpi_copy
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call dbg._gcry_mpi_copy
mov edx, dword [0x74356c]
mov dword [esi + 0x18], eax
xor eax, eax
test edx, edx
jle 0x51b683
mov eax, dword [esi + 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg._gcry_mpi_barrett_init
and byte [esi + 0x30], 0xfc
cmp ebx, 1
mov dword [esi + 0x3c], eax
je 0x51b6f0
lea ebx, [esi + 0x40]
lea edi, [esi + 0x6c]
mov eax, dword [esi + 0x10]
add ebx, 4
mov dword [esp], eax
call dbg._gcry_mpi_alloc_like
mov dword [ebx - 4], eax
cmp edi, ebx
jne 0x51b695
add esp, 0x40
pop ebx
pop esi
pop edi
ret
mov dword [esi + 0xc], 0x100
jmp 0x51b63b
mov dword [esp], str.GCRYPT_BARRETT
mov dword [esp + 0x2c], ecx
call sym._getenv
cmp eax, 1
mov ecx, dword [esp + 0x2c]
sbb eax, eax
or eax, 1
mov dword [0x74356c], eax
jmp 0x51b61b
lea edi, [esp + 0x3c]
xor ebx, ebx
mov eax, str.0x0000000000000000000000000000000000000000000000000000000000000000
nop
lea esi, [esi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 4
mov dword [esp], edi
call dbg._gcry_mpi_scan
test eax, eax
jne 0x51b742
mov eax, dword [esp + 0x3c]
mov dword [esi + ebx + 0x40], eax
add ebx, 4
mov eax, dword [ebx + 0x648700]
test eax, eax
jne 0x51b700
jmp 0x51b6aa
mov dword [esp], eax
call dbg.gpg_strerror
mov dword [esp], str.scanning_ECC_parameter_failed:__s_n
mov dword [esp + 4], eax
call dbg._gcry_log_fatal
lea esi, [esi]

Function at 0x525840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edx, dword [edi]
mov edi, dword [esp + 0x38]
neg edi
cmp edx, dword [eax]
jne 0x5258b1
test edx, edx
jle 0x525887
mov esi, dword [esp + 0x34]
mov ebx, dword [eax + 0x10]
mov esi, dword [esi + 0x10]
lea ebp, [ebx + edx*4]
lea esi, [esi]
mov edx, dword [ebx]
mov ecx, dword [esi]
add ebx, 4
add esi, 4
xor ecx, edx
and ecx, edi
xor edx, ecx
mov dword [ebx - 4], edx
cmp ebp, ebx
jne 0x525870
mov esi, dword [esp + 0x34]
mov edx, dword [eax + 4]
mov ecx, dword [esi + 4]
xor ecx, edx
and ecx, edi
xor edx, ecx
mov ecx, dword [esi + 8]
mov dword [eax + 4], edx
mov edx, dword [eax + 8]
xor ecx, edx
and edi, ecx
xor edx, edi
mov dword [eax + 8], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.mpi_set_cond:_different_sizes_n
call dbg._gcry_log_bug
lea esi, [esi]
Function at 0x525a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov ecx, dword [eax]
mov eax, dword [ebp]
neg esi
cmp ecx, eax
cmovg ecx, eax
mov eax, dword [esp + 0x30]
mov edx, dword [eax + 4]
cmp ecx, edx
jl 0x525a9f
mov eax, dword [ebp + 4]
cmp ecx, eax
jl 0x525a9f
test ecx, ecx
jle 0x525a75
mov eax, dword [esp + 0x30]
mov edx, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
lea edi, [eax + ecx*4]
mov ebx, dword [eax]
mov ecx, dword [edx]
add eax, 4
xor ecx, ebx
and ecx, esi
xor ebx, ecx
mov dword [eax - 4], ebx
xor dword [edx], ecx
add edx, 4
cmp edi, eax
jne 0x525a52
mov eax, dword [esp + 0x30]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 4]
mov edi, dword [esp + 0x30]
xor eax, edx
and eax, esi
xor edx, eax
mov dword [edi + 4], edx
mov edx, dword [ebp + 8]
xor dword [ebp + 4], eax
mov eax, dword [edi + 8]
xor edx, eax
and esi, edx
xor eax, esi
mov dword [edi + 8], eax
xor dword [ebp + 8], esi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.mpi_swap_cond:_different_sizes_n
call dbg._gcry_log_bug
nop
lea esi, [esi]
Function at 0x526420
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [esp], 0xac
call sym.__gcry_malloc
test eax, eax
je 0x526637
and byte [eax + 0x28], 0xfc
mov esi, eax
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov edx, eax
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov eax, dword [esp + 0x80]
test eax, eax
je 0x5265e0
lea ebx, [esp + 0x20]
xor eax, eax
mov ecx, 0x10
lea ebp, [esi + 0x69]
mov edi, ebx
rep stosd dword es:[edi], eax
lea edi, [esi + 0x6d]
mov ecx, ebp
mov dword [esi + 0x69], 0
mov dword [ebp + 0x3c], 0
and edi, 0xfffffffc
sub ecx, edi
add ecx, 0x40
shr ecx, 2
rep stosd dword es:[edi], eax
cmp dword [esp + 0x84], 0x40
jbe 0x5265ea
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x1c], esi
call dbg._gcry_hmac256_new
test eax, eax
mov edi, eax
mov edx, dword [esp + 0x1c]
je 0x52663b
mov eax, dword [esp + 0x84]
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
call sym.__gcry_hmac256_update
test byte [edi + 0x28], 1
je 0x52662b
mov edx, dword [edi + 0x29]
mov dword [esp + 0x20], edx
mov edx, dword [edi + 0x2d]
mov dword [esp + 0x24], edx
mov edx, dword [edi + 0x31]
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0x35]
mov dword [esp + 0x2c], edx
mov edx, dword [edi + 0x39]
mov dword [esp + 0x30], edx
mov edx, dword [edi + 0x3d]
mov dword [esp + 0x34], edx
mov edx, dword [edi + 0x41]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x45]
mov dword [esp + 0x3c], edx
mov edx, dword [edi + 0x29]
mov dword [esi + 0x69], edx
mov edx, dword [edi + 0x2d]
mov dword [ebp + 4], edx
mov edx, dword [edi + 0x31]
mov dword [ebp + 8], edx
mov edx, dword [edi + 0x35]
mov dword [ebp + 0xc], edx
mov edx, dword [edi + 0x39]
mov dword [ebp + 0x10], edx
mov edx, dword [edi + 0x3d]
mov dword [ebp + 0x14], edx
mov edx, dword [edi + 0x41]
mov dword [ebp + 0x18], edx
mov eax, dword [edi + 0x45]
mov dword [ebp + 0x1c], eax
mov dword [esp], edi
call dbg._gcry_hmac256_release
xor eax, eax
mov esi, esi
lea edi, [edi]
xor byte [ebx + eax], 0x36
xor byte [esi + eax + 0x69], 0x5c
add eax, 1
cmp eax, 0x40
jne 0x5265a0
or byte [esi + 0x28], 2
mov dword [esp + 8], 0x40
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.__gcry_hmac256_update
lea esi, [esi]
lea eax, [esp + 0x60]
mov byte [ebx], 0
add ebx, 1
cmp ebx, eax
jne 0x5265d0
mov edx, esi
add esp, 0x6c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x84]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
call sym._memcpy
mov eax, dword [esp + 0x84]
mov dword [esp], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
call sym._memcpy
jmp 0x526595
mov eax, edi
call sym._finalize.part.1
jmp 0x526525
xor edx, edx
jmp 0x5265e0
mov dword [esp], edx
call sym._free
xor edx, edx
jmp 0x5265e0
Function at 0x534310
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
test ebp, ebp
je 0x534368
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x18]
mov ecx, ebx
add esi, 8
add ebx, 8
call sym._do_decrypt_block
mov eax, dword [edi]
xor eax, dword [esp + 0x18]
mov edx, dword [ebx - 8]
mov dword [esi - 8], eax
mov eax, dword [edi + 4]
xor eax, dword [esp + 0x1c]
mov dword [edi], edx
mov edx, dword [ebx - 4]
mov dword [esi - 4], eax
sub ebp, 1
mov dword [edi + 4], edx
jne 0x534330
mov dword [esp], 0x50
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x534420
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
test ebp, ebp
je 0x534472
nop
lea esi, [esi]
mov eax, dword [esp + 0x30]
mov edx, ebx
mov ecx, ebx
add edi, 8
add esi, 8
call sym._do_encrypt_block
mov eax, dword [esi - 8]
mov edx, dword [ebx]
xor edx, eax
mov dword [edi - 8], edx
mov dword [ebx], eax
mov edx, dword [ebx + 4]
mov eax, dword [esi - 4]
xor edx, eax
mov dword [edi - 4], edx
sub ebp, 1
mov dword [ebx + 4], eax
jne 0x534440
mov dword [esp], 0x50
call dbg.__gcry_burn_stack
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x535330
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x44]
lea ebp, [esp + 0x10]
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
test eax, eax
je 0x535395
nop
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [eax + 0x110]
mov dword [esp], eax
call dbg._gcry_Camellia_DecryptBlock
xor eax, eax
mov edx, dword [ebx + eax]
xor edx, dword [ebp + eax]
mov ecx, dword [esi + eax]
mov dword [edi + eax], edx
mov dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x535370
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x50], 1
jne 0x535350
mov dword [esp], 0x58
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5353d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x60]
lea edi, [esp + 0x20]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
add eax, 0xf
test ecx, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
lea ebp, [eax - 1]
je 0x535463
mov eax, dword [esp + 0x54]
mov dword [esp + 8], edx
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
mov eax, dword [edx + 0x110]
mov dword [esp], eax
call dbg._gcry_Camellia_EncryptBlock
mov edx, dword [esp + 0x18]
xor eax, eax
lea esi, [esi]
mov ecx, dword [edi + eax]
xor ecx, dword [ebx + eax]
mov dword [esi + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x535430
mov ecx, dword [esp + 0x1c]
add esi, 0x10
add ebx, 0x10
nop
lea esi, [esi]
add byte [ecx], 1
jne 0x53545c
sub ecx, 1
cmp ebp, ecx
jne 0x535450
sub dword [esp + 0x60], 1
jne 0x535401
mov dword [esp], 0x58
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dbg.__gcry_burn_stack
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5354a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
test eax, eax
je 0x535503
nop
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov eax, dword [ebp + 0x110]
mov dword [esp], eax
call dbg._gcry_Camellia_EncryptBlock
xor eax, eax
lea esi, [esi]
mov edx, dword [esi + eax]
mov ecx, dword [ebx + eax]
xor ecx, edx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x5354e0
add edi, 0x10
add esi, 0x10
sub dword [esp + 0x40], 1
jne 0x5354c0
mov dword [esp], 0x58
call dbg.__gcry_burn_stack
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x53b440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
test ebp, ebp
je 0x53b498
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x18]
mov ecx, ebx
add esi, 8
add ebx, 8
call dbg.do_decrypt_block
mov eax, dword [edi]
xor eax, dword [esp + 0x18]
mov edx, dword [ebx - 8]
mov dword [esi - 8], eax
mov eax, dword [edi + 4]
xor eax, dword [esp + 0x1c]
mov dword [edi], edx
mov edx, dword [ebx - 4]
mov dword [esi - 4], eax
sub ebp, 1
mov dword [edi + 4], edx
jne 0x53b460
mov dword [esp], 0x34
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x53b550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
test ebp, ebp
je 0x53b5a2
nop
lea esi, [esi]
mov eax, dword [esp + 0x30]
mov edx, ebx
mov ecx, ebx
add edi, 8
add esi, 8
call dbg.do_encrypt_block
mov eax, dword [esi - 8]
mov edx, dword [ebx]
xor edx, eax
mov dword [edi - 8], edx
mov dword [ebx], eax
mov edx, dword [ebx + 4]
mov eax, dword [esi - 4]
xor edx, eax
mov dword [edi - 4], edx
sub ebp, 1
mov dword [ebx + 4], eax
jne 0x53b570
mov dword [esp], 0x34
call dbg.__gcry_burn_stack
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x53d530
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov esi, ecx
sub esp, 0x5c
test ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [eax + 0xa4]
jne 0x53d55d
test eax, eax
je 0x53d699
mov ebx, dword [esp + 0x70]
test ebx, ebx
je 0x53d699
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x34], 0
mov edx, dword [ecx + 0xc]
mov ebx, dword [edx + 0x24]
mov dword [esp + 0x2c], ebx
lea ebx, [ecx + 0x40]
add ecx, 0x200
mov dword [esp + 0x28], ecx
lea edx, [esi + eax]
cmp edx, 0xf
jbe 0x53d6a3
test eax, eax
jne 0x53d6a3
test esi, esi
jne 0x53d610
mov edx, dword [esp + 0x70]
xor eax, eax
test edx, edx
je 0x53d67c
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax + 0x94]
lea edx, [ecx + 0xa4]
mov esi, esi
lea edi, [edi]
mov byte [eax], 0
add eax, 1
cmp eax, edx
jne 0x53d5c0
xor esi, esi
mov eax, dword [esp + 0x30]
lea edx, [eax + 0x94]
xor eax, eax
nop
lea esi, [esi]
mov ecx, dword [edx + eax]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x53d5e0
mov eax, dword [esp + 0x28]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
call eax
mov ecx, dword [esp + 0x34]
cmp ecx, eax
cmovae eax, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x53d700
mov eax, dword [esp + 0x28]
mov ebp, esi
lea edx, [esp + 0x40]
shr ebp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebp
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call ecx
mov eax, ebp
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
shl eax, 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
add edi, eax
sub esi, eax
xor eax, eax
test esi, esi
jne 0x53d580
mov ecx, dword [esp + 0x30]
mov dword [ecx + 0xa4], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x53d699
add esp, 0x5c
add eax, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x5c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xf
ja 0x53d774
test esi, esi
je 0x53d774
mov ecx, dword [esp + 0x30]
jmp 0x53d6c5
cmp eax, 0xf
ja 0x53d6db
add edi, 1
movzx edx, byte [edi - 1]
add eax, 1
sub esi, 1
mov byte [ecx + eax + 0x93], dl
jne 0x53d6c0
test esi, esi
jne 0x53d5cc
mov ecx, dword [esp + 0x70]
test ecx, ecx
je 0x53d67c
cmp eax, 0xf
jbe 0x53d5a6
jmp 0x53d5ca
cmp esi, 0xf
mov ebp, edi
jbe 0x53d672
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], esi
mov edi, esi
mov esi, dword [esp + 0x34]
lea esi, [esi]
xor eax, eax
mov edx, dword [ebp + eax]
xor dword [ebx + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x53d722
mov eax, dword [esp + 0x28]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
call eax
cmp esi, eax
cmovb esi, eax
sub edi, 0x10
add ebp, 0x10
cmp edi, 0xf
ja 0x53d720
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
lea eax, [esi - 0x10]
and esi, 0xf
and eax, 0xfffffff0
lea edi, [edi + eax + 0x10]
jmp 0x53d672
test esi, esi
je 0x53d6e3
test eax, eax
je 0x53d610
jmp 0x53d5cc
Function at 0x53de80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x4c]
cmp esi, ebx
mov dword [esp + 0x14], eax
mov eax, 0xc8
jae 0x53deb0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [edi + 0xb8]
mov eax, 0x9c
test dl, 1
je 0x53dea8
test byte [edi + 0x3c], 4
jne 0x53dea8
and edx, 2
je 0x53dea8
mov edx, dword [edi + 0x8c]
or edx, dword [edi + 0x88]
jne 0x53dea8
mov dword [esp + 0x1c], 0
mov edx, dword [edi + 0x84]
cmp dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 0x80]
ja 0x53df4c
jae 0x53df48
sub eax, dword [esp + 0x18]
mov ecx, ebx
sbb edx, dword [esp + 0x1c]
mov dword [edi + 0x80], eax
mov eax, edi
mov dword [edi + 0x84], edx
mov dword [esp], 0
mov edx, ebp
call dbg.do_cbc_mac
test eax, eax
jne 0x53df56
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg._gcry_cipher_ctr_encrypt
cmp ebx, eax
jbe 0x53defa
mov eax, 0x8b
jmp 0x53dea8
add eax, 0x14
mov dword [esp], eax
call dbg.__gcry_burn_stack
jmp 0x53df24