joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8060
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.0045cf80
mov eax, dword [0x673010]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.004bb660
add esp, 0xc
mov edi, eax
call fcn.004bb5d0
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x4e826e
test esi, esi
je 0x4e826e
push 0
push edi
push esi
call fcn.004bafb0
add esp, 0xc
test eax, eax
je 0x4e826e
push 0x20
push ebx
push esi
call fcn.004baff0
add esp, 0xc
test eax, eax
je 0x4e826e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.004bae80
add esp, 0xc
test eax, eax
je 0x4e826e
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.004bafb0
add esp, 0xc
test eax, eax
je 0x4e826e
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.004baff0
add esp, 0xc
test eax, eax
je 0x4e826e
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.004baff0
add esp, 0xc
test eax, eax
je 0x4e826e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.004bae80
add esp, 0xc
test eax, eax
je 0x4e826e
lea eax, [esp + 0x100]
push eax
call fcn.004eccf0
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004e7790
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.004e7710
push 0
push edi
push esi
call fcn.004bafb0
add esp, 0x20
test eax, eax
je 0x4e826e
push 0x20
push ebp
push esi
call fcn.004baff0
add esp, 0xc
test eax, eax
je 0x4e826e
push 0x20
push dword [esp + 0x20]
push esi
call fcn.004baff0
add esp, 0xc
test eax, eax
je 0x4e826e
push ebx
push dword [esp + 0x14]
push esi
call fcn.004baff0
add esp, 0xc
test eax, eax
je 0x4e826e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.004bae80
add esp, 0xc
test eax, eax
je 0x4e826e
lea eax, [esp + 0x140]
push eax
call fcn.004eccf0
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.004e8790
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00401320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.004bb690
push esi
call fcn.004bb540
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045bfb6
add esp, 0x174
ret
Function at 0x4f6460
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4f6529
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4f6481
cmp al, 0x6b
jne 0x4f6529
inc ecx
cmp al, 0x6b
jne 0x4f64e2
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4f64a2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4f64a2
cmp dl, 0xbb
jne 0x4f64b6
inc eax
cmp eax, esi
jl 0x4f6490
sub esi, eax
test eax, eax
jne 0x4f64e5
call fcn.004ade90
push str.RSA_padding_check_X931
push 0x56
jmp 0x4f64c2
call fcn.004ade90
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.004adf90
push 0
push 0x8a
push 4
call fcn.004ae040
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4f6517
call fcn.004ade90
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.004adf90
push 0
push 0x8b
push 4
call fcn.004ae040
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.005bb9c0
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.004ade90
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.004adf90
push 0
push 0x89
push 4
call fcn.004ae040
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x4fabe0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0045cf80
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4fac60
mov cl, byte [edi]
test cl, cl
je 0x4fac60
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x4fac10
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x4face0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0045cf80
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4fad63
mov cl, byte [edi]
test cl, cl
je 0x4fad63
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x4fad10
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x502000
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.0045cf80
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x502048
call fcn.004ade90
push str.BIO_connect
push 0x54
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
push 0
push 0x87
push 0x20
call fcn.004ae040
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.004b6ae0
add esp, 8
test eax, eax
je 0x5020d7
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x5020de
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x5020de
call fcn.004ade90
push str.BIO_connect
push 0x5e
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.004ae040
call fcn.004ade90
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
push 0
push 0x89
push 0x20
call fcn.004ae040
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x50214f
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x50214f
call fcn.004ade90
push str.BIO_connect
push 0x68
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.004ae040
call fcn.004ade90
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
push 0
push 0x8a
push 0x20
call fcn.004ae040
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.004b6d80
add esp, 4
push eax
push esi
call fcn.004b6d70
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5021db
push eax
call fcn.00501f10
add esp, 4
test eax, eax
jne 0x5020d7
call fcn.004ade90
push str.BIO_connect
push 0x72
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.004ae040
call fcn.004ade90
push str.BIO_connect
push 0x74
push str.crypto_bio_bio_sock2.c
call fcn.004adf90
push 0
push 0x67
push 0x20
call fcn.004ae040
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x515290
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x5152d2
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
add edi, esi
add ebx, esi
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x5152b1
pop edi
pop ebx
pop esi
ret

Function at 0x51dd20
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.0045cf80
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.0051d970
mov ebx, eax
push ebx
push esi
call fcn.0051d880
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x51dd9f
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x51dd83
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0051d910
push esi
call fcn.0051da60
add esp, 0x10
test eax, eax
jne 0x51de19
push 1
push esi
call fcn.0051d970
mov ebx, eax
push ebx
push esi
call fcn.0051d880
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x51de10
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x51ddf4
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0051d910
push esi
call fcn.0051da60
add esp, 0x10
test eax, eax
jne 0x51de19
push esi
call fcn.0051da60
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x525730
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.0045cf80
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [eax + 0x64]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x30]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x525799
test edi, edi
je 0x525779
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x525779
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [ebx], al
inc esi
inc ebx
sub edi, 1
jne 0x525765
mov dword [ebp + 0x70], ecx
test edi, edi
je 0x525854
cmp ecx, 0x40
jne 0x525799
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x525799
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, edi
and eax, 0x3f
sub edi, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp edi, 0x40
jb 0x525807
push dword [esp + 0x24]
mov ecx, edi
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push ebx
mov dword [esp + 0x28], edx
call fcn.00438180
mov eax, dword [esp + 0x28]
add esp, 0x14
sub edi, eax
add esi, eax
add ebx, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x525800
inc dword [ebp + 0x24]
mov edx, eax
cmp edi, 0x40
jae 0x5257b3
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x525854
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.005bbf50
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.00438180
add esp, 0x20
xor edx, edx
test edi, edi
je 0x525851
sub esi, ebx
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + ebx]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, edi
jb 0x525840
mov dword [ebp + 0x70], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x527a10
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x40
call fcn.0045cf80
mov eax, dword [0x673010]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x48], 0x1d
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x58]
je 0x527a4c
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045bfb6
add esp, 0x40
ret
test esi, esi
je 0x527b5b
cmp dword [esp + 0x54], 0x30
jne 0x527b5b
push 0x30
push edi
push esi
call fcn.00527930
add esp, 0xc
test eax, eax
jle 0x527b5b
movaps xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj_]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.00527930
add esp, 0xc
test eax, eax
je 0x527b5b
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00527790
add esp, 8
test eax, eax
je 0x527b5b
push 0x4c
lea eax, [esi + 0x14]
push 0
push eax
call fcn.005bbf50
push 0x30
push edi
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.00527930
add esp, 0x18
test eax, eax
jle 0x527b5b
movaps xmm0, xmmword [str.crypto_rsa_rsa_meth.c]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.00527930
add esp, 0xc
test eax, eax
je 0x527b5b
push 0x14
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00527930
add esp, 0xc
test eax, eax
je 0x527b5b
lea eax, [esp + 0x30]
push 0x14
push eax
call fcn.00401320
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0045bfb6
add esp, 0x40
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0045bfb6
add esp, 0x40
ret
Function at 0x536060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0045cf80
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x5360a8
call fcn.004ade90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004adf90
push 0
push 0x78
push 4
call fcn.004ae040
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.00535db0
add esp, 4
test eax, eax
jne 0x5360e4
call fcn.004ade90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004adf90
push 0
push 0xb2
push 4
call fcn.004ae040
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004ffeb0
push esi
call fcn.004ffc60
push esi
mov dword [esp + 0x2c], eax
call fcn.004ffc60
push esi
mov ebp, eax
call fcn.004ffc60
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x536246
test ebp, ebp
je 0x53621d
test ebx, ebx
je 0x536214
push 4
push ebp
call fcn.004a7e50
push 4
push ebx
call fcn.004a7e50
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x53614e
call fcn.004a7d20
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x53615c
call fcn.004a7d20
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x536210
cmp dword [esi + 0x24], 0
je 0x536210
push 4
push eax
call fcn.004a7e50
push 4
push dword [esi + 0x24]
call fcn.004a7e50
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.0056b890
add esp, 0x3c
test eax, eax
je 0x536210
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.0056b890
add esp, 0x2c
test eax, eax
je 0x536210
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00535d40
add esp, 0x10
test eax, eax
js 0x536210
je 0x5361b0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00535d40
add esp, 0x10
test eax, eax
js 0x536210
je 0x5361b0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.004a7420
add esp, 4
test ebx, ebx
je 0x53622a
push ebx
call fcn.004a7420
add esp, 4
push dword [esp + 0x20]
call fcn.004a7420
push esi
call fcn.004ffb60
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x53621d
jmp 0x536214
Function at 0x549a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.0045cf80
mov eax, dword [0x673010]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
push esi
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
jns 0x549ac1
mov dword [ecx], 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0045bfb6
add esp, 0x28
ret
push ebx
movzx ebx, byte [eax]
push ebp
lea ebp, [eax + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x10], ebx
movzx eax, byte [edx + 6]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x28]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2b], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x549c30
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x549bd8
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.00549060
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x549b73
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x549c30
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 6], dl
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.0045bfb6
add esp, 0x28
ret
Function at 0x54d810
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0045cf80
mov eax, dword [esp + 0x2c]
push esi
mov esi, dword [eax]
test esi, esi
jns 0x54d830
mov dword [eax], 0xffffffff
pop esi
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
test esi, esi
je 0x54d85c
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x54d85c
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x54d847
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x54d8f5
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x54d8a4
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x54d8d7
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x54d8c5
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x54d8a0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x54d927
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push eax
push eax
call edx
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x54d915
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [eax], esi
pop esi
add esp, 0x14
ret
Function at 0x54ddf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0045cf80
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x54de0f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x54dee0
jb 0x54de34
test eax, eax
jne 0x54dee0
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x170]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x54de83
nop
test esi, esi
je 0x54ded2
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x18], ecx
jne 0x54de50
lea eax, [ebp + 0x60]
push eax
mov eax, dword [ebp + 0x168]
lea ebx, [ebp + 0x40]
push ebx
call eax
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x54de86
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x54deab
push eax
mov eax, dword [ebp + 0x164]
push edi
push ecx
push ebx
call eax
add edi, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x54dece
mov ecx, esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x54deb1
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret