joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499b30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057aae0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x499bb0
mov cl, byte [edi]
test cl, cl
je 0x499bb0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x499b60
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x499df0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057aae0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x499e73
mov cl, byte [edi]
test cl, cl
je 0x499e73
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x499e20
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x4a19d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0057aae0
mov eax, dword [0x5fbea4]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xd8]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], edi
call fcn.004bcd40
push ebp
push 0
push edi
mov dword [esp + 0x2c], eax
call fcn.004e21c0
add esp, 0x10
test eax, eax
je 0x4a1ba2
mov edi, dword [esp + 0xcc]
inc ebp
test edi, edi
mov edi, dword [esp + 0x10]
je 0x4a1a84
push 0
push esi
push edi
push dword [esp + 0x28]
call fcn.00458a70
add esp, 0x10
test eax, eax
jle 0x4a1ba3
push esi
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
push esi
lea eax, [esp + 0x7c]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x4a1aad
add byte [ebx + eax], 1
jne 0x4a1aad
sub eax, 1
jns 0x4a1aa2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push edi
call fcn.00480610
add esp, 0x18
test eax, eax
je 0x4a1ba3
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push ebx
call fcn.00480610
add esp, 0x18
test eax, eax
je 0x4a1ba3
xor eax, eax
test esi, esi
jle 0x4a1b4e
cmp esi, 0x20
jb 0x4a1b3d
mov ecx, esi
and ecx, 0x8000001f
jns 0x4a1b05
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, esi
sub edx, ecx
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
add eax, 0x20
cmp eax, edx
jl 0x4a1b10
cmp eax, esi
jge 0x4a1b4e
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x4a1b41
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push edi
push esi
push eax
call fcn.0046ee70
add esp, 0xc
test eax, eax
je 0x4a1ba3
push dword [esp + 0x18]
push dword [esp + 0x28]
push edi
call fcn.004e2210
add esp, 0xc
test eax, eax
jg 0x4a1bc4
jne 0x4a1ba3
push ebp
push 0
push dword [esp + 0x20]
mov edi, 1
call fcn.004e21c0
add esp, 0xc
test eax, eax
jne 0x4a1a63
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.0057a738
add esp, 0xa0
ret
mov eax, 1
jmp 0x4a1ba5
Function at 0x4a75c0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
cmp ebp, 2
je 0x4a7697
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4a7649
push edi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.004a63c0
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x4a761e
call fcn.004657e0
push str.ossl_ecx_key_op
push 0xa6
push str.cryptoececx_backend.c
call fcn.00465830
push 0
push 0x66
push 0x10
call fcn.00465860
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
push dword [edi]
mov esi, dword [esp + 0x20]
call fcn.00463610
add esp, 4
test esi, esi
jne 0x4a7634
mov esi, eax
jmp 0x4a764d
cmp esi, eax
je 0x4a764d
call fcn.004657e0
push str.ossl_ecx_key_op
push 0xac
jmp 0x4a7600
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0
je 0x4a7683
test esi, esi
je 0x4a7683
cmp esi, 0x40a
je 0x4a7678
cmp esi, 0x43f
je 0x4a7678
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4a767d
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x4a769b
call fcn.004657e0
push str.ossl_ecx_key_op
push 0xb2
jmp 0x4a7600
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x4a76bf
cmp esi, 0x43f
je 0x4a76bf
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x4a76cf
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.00489470
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4a7719
call fcn.004657e0
push str.ossl_ecx_key_op
push 0xb9
push str.cryptoececx_backend.c
call fcn.00465830
push ebx
push 0x80010
push 0x10
call fcn.00465860
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x4a7739
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
push eax
lea eax, [ebx + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.00489400
mov edi, eax
add esp, 4
test edi, edi
jne 0x4a776c
call fcn.004657e0
push str.ossl_ecx_key_op
push 0xc3
push str.cryptoececx_backend.c
call fcn.00465830
push edi
push 0x80010
jmp 0x4a7843
cmp ebp, 2
jne 0x4a77de
test esi, esi
je 0x4a7812
cmp esi, 0x40a
je 0x4a7799
cmp esi, 0x43f
je 0x4a7799
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4a779e
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.00458e20
add esp, 0x10
test eax, eax
jle 0x4a784d
cmp esi, 0x40a
jne 0x4a77cd
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x4a7812
cmp esi, 0x40b
jne 0x4a7812
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x4a7812
cmp esi, 0x40a
je 0x4a77fe
cmp esi, 0x43f
je 0x4a77fe
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4a7803
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebx
call fcn.004a7860
add esp, 4
test eax, eax
jne 0x4a7732
call fcn.004657e0
push str.ossl_ecx_key_op
push 0xd7
push str.cryptoececx_backend.c
call fcn.00465830
push 0
push 0xa6
push 0x10
call fcn.00465860
add esp, 0x18
push ebx
call fcn.00489420
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4ac130
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.0057aae0
mov eax, dword [0x5fbea4]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.00481130
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4ac1b2
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.00480610
push edi
mov esi, eax
call fcn.00481160
add esp, 0x1c
test esi, esi
jne 0x4ac1cc
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0057a738
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004ab8f0
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004ab870
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057a738
add esp, 0xe4
ret
Function at 0x4b9980
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4b9a49
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4b99a1
cmp al, 0x6b
jne 0x4b9a49
inc ecx
cmp al, 0x6b
jne 0x4b9a02
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4b99c2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4b99c2
cmp dl, 0xbb
jne 0x4b99d6
inc eax
cmp eax, esi
jl 0x4b99b0
sub esi, eax
test eax, eax
jne 0x4b9a05
call fcn.004657e0
push str.RSA_padding_check_X931
push 0x56
jmp 0x4b99e2
call fcn.004657e0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.00465830
push 0
push 0x8a
push 4
call fcn.00465860
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4b9a37
call fcn.004657e0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.00465830
push 0
push 0x8b
push 4
call fcn.00465860
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.004657e0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.00465830
push 0
push 0x89
push 4
call fcn.00465860
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x4bd740
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.00457780
add esp, 8
test esi, esi
jg 0x4bd797
je 0x4bd779
cmp esi, 0xffffffff
jne 0x4bd797
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004bdad0
add esp, 4
test eax, eax
je 0x4bd797
push 0xa
push edi
call fcn.00458600
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x4bdbd0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.0057aae0
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x4bdc18
call fcn.004657e0
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.00465830
push 0
push 0x87
push 0x20
call fcn.00465860
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.004769f0
add esp, 8
test eax, eax
jne 0x4bdc37
pop ebx
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4bdcb2
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x4bdcb2
call fcn.004657e0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.00465830
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00465860
call fcn.004657e0
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.00465830
push 0
push 0x89
push 0x20
call fcn.00465860
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
test bl, 0x10
je 0x4bdd23
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x4bdd23
call fcn.004657e0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.00465830
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00465860
call fcn.004657e0
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.00465830
push 0
push 0x8a
push 0x20
call fcn.00465860
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.00477bc0
add esp, 4
push eax
push esi
call fcn.00569910
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4bddb1
push eax
call fcn.004bdb90
add esp, 4
test eax, eax
jne 0x4bddaa
call fcn.004657e0
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.00465830
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00465860
call fcn.004657e0
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.00465830
push 0
push 0x67
push 0x20
call fcn.00465860
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x4da8b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x4da8f2
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
add edi, esi
add ebx, esi
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x4da8d1
pop edi
pop ebx
pop esi
ret

Function at 0x4e9fb0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x4ed150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0057aae0
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x4ed198
call fcn.004657e0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00465830
push 0
push 0x78
push 4
call fcn.00465860
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.004ecea0
add esp, 4
test eax, eax
jne 0x4ed1d4
call fcn.004657e0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00465830
push 0
push 0xb2
push 4
call fcn.00465860
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004bcad0
push esi
call fcn.004bc9b0
push esi
mov dword [esp + 0x2c], eax
call fcn.004bc9b0
push esi
mov ebp, eax
call fcn.004bc9b0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x4ed304
test ebp, ebp
je 0x4ed311
test ebx, ebx
je 0x4ed304
push 4
push ebp
call fcn.0046f740
push 4
push ebx
call fcn.0046f740
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x4ed23e
call fcn.0046f610
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x4ed24c
call fcn.0046f610
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4ed300
cmp dword [esi + 0x24], 0
je 0x4ed300
push 4
push eax
call fcn.0046f740
push 4
push dword [esi + 0x24]
call fcn.0046f740
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00539aa0
add esp, 0x3c
test eax, eax
je 0x4ed300
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00539aa0
add esp, 0x2c
test eax, eax
je 0x4ed300
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.004ece30
add esp, 0x10
test eax, eax
js 0x4ed300
je 0x4ed2a0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.004ece30
add esp, 0x10
test eax, eax
js 0x4ed300
je 0x4ed2a0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
test ebp, ebp
je 0x4ed311
push ebp
call fcn.0046ef10
add esp, 4
test ebx, ebx
je 0x4ed31e
push ebx
call fcn.0046ef10
add esp, 4
push dword [esp + 0x20]
call fcn.0046ef10
push esi
call fcn.004bc920
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x4f55f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0057aae0
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax + 0x64]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [ecx + 0x70]
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x4f5656
test edi, edi
je 0x4f5636
nop
cmp edx, 0x40
jae 0x4f5636
mov al, byte [edx + ecx + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
sub edi, 1
jne 0x4f5620
mov dword [ecx + 0x70], edx
test edi, edi
je 0x4f570c
cmp edx, 0x40
jne 0x4f5656
mov dword [ecx + 0x70], 0
add dword [ecx + 0x20], 1
jne 0x4f5656
inc dword [ecx + 0x24]
mov eax, edi
lea edx, [ecx + 0x20]
and eax, 0x3f
mov dword [esp + 0x14], edx
sub edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push esi
cmp edi, 0x40
jb 0x4f56b9
mov esi, edi
shr esi, 6
add eax, esi
mov dword [esp + 0x14], eax
cmp eax, esi
jae 0x4f5689
sub esi, eax
mov dword [esp + 0x14], 0
push edx
push ecx
shl esi, 6
push esi
push ebx
push ebp
call fcn.00444c00
mov edx, dword [esp + 0x2c]
add esp, 0x14
mov eax, dword [esp + 0x14]
sub edi, esi
mov ecx, dword [esp + 0x20]
add ebx, esi
add ebp, esi
mov dword [edx], eax
test eax, eax
jne 0x4f56b4
inc dword [ecx + 0x24]
cmp edi, 0x40
jae 0x4f5670
cmp dword [esp + 0x10], 0
je 0x4f570b
push 0x40
lea edi, [ecx + 0x30]
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x24]
mov esi, dword [esp + 0x30]
push esi
push 0x40
push edi
push edi
call fcn.00444c00
mov eax, dword [esp + 0x30]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x4f5708
sub ebx, ebp
mov esi, eax
lea ecx, [edx + ebp]
mov al, byte [ebx + ecx]
xor al, byte [edi + edx]
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x4f56f0
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], eax
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4f9250
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.004606e0
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4f9294
push 0
push 0
push edi
push 0x4f92b0
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4f9294
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.00460510
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x50e0b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057aae0
cmp dword [esp + 0xc], 0
je 0x50e1ed
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
inc eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x30]
push edi
push esi
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push ebp
push dword [esp + 0x2c]
call fcn.0050dee0
add esp, 0x1c
test eax, eax
jne 0x50e100
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push 0x1b8
push str.providersimplementationskdfs_tls1_prf.c
push edi
call fcn.00460490
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x50e154
mov eax, dword [esp + 0x10]
sub ebp, eax
add ebp, dword [esp + 0x24]
push edi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push ebp
push dword [esp + 0x34]
call fcn.0050dee0
add esp, 0x1c
test eax, eax
jne 0x50e15c
push 0x1bd
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.004605a0
add esp, 0x10
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
xor edx, edx
test edi, edi
je 0x50e1ce
cmp edi, 0x20
jb 0x50e1af
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x50e179
cmp ecx, ebx
jae 0x50e1af
mov ecx, edi
mov ebp, ebx
and ecx, 0xffffffe0
mov eax, esi
sub ebp, esi
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x50e184
cmp edx, edi
jae 0x50e1ce
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
mov esi, edi
sub esi, edx
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x50e1c0
push 0x1c2
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.004605a0
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x20]
call fcn.0050dee0
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop ecx
ret
Function at 0x5160e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
xor esi, esi
lea ecx, [edx + 0x3f8]
push edi
lea edi, [eax + 0x3f8]
cmp eax, ecx
ja 0x51611f
cmp edi, edx
jb 0x51611f
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x516107
pop edi
pop esi
ret
mov edi, edx
lea ecx, [eax + 0x10]
sub edi, eax
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [edx + esi*8]
add esi, 4
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [edi + ecx - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp esi, 0x80
jl 0x516130
pop edi
pop esi
ret

Function at 0x5182b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x518313
mov edx, dword [esp + 0x10]
test edx, edx
je 0x518313
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi + 0x14]
cmp edx, ebx
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x5182e1
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x1c], al
inc ecx
cmp ecx, ebx
jb 0x5182d5
mov eax, dword [edi + 0x14]
cmp edx, eax
jbe 0x518311
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor eax, eax
test edx, edx
je 0x518311
nop word [eax + eax]
mov ecx, dword [edi + 0x14]
add ecx, eax
mov cl, byte [ecx + esi]
xor byte [edi + eax + 0x3c], cl
inc eax
cmp eax, edx
jb 0x518300
pop edi
pop ebx
pop esi
ret