joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7bd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.00544cc0
mov eax, dword [0x5ca120]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, dword [esp + 0x48]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [esp + 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x31], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x30], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x32], al
mov byte [esp + 0x33], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x24], edx
mov byte [esp + 0x34], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ebx
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
test ebp, ebp
je 0x4b7da4
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x40]
sub eax, ebp
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
test esi, esi
jne 0x4b7d1d
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004b3fa0
mov ebx, dword [esp + 0x2c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x3d], al
mov eax, dword [esp + 0x30]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x40], al
shr eax, 0x18
shr ecx, 8
shr edx, 0x10
add esp, 0xc
inc dword [esp + 0x1c]
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], bl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], dl
mov cl, byte [esp + esi + 0x30]
xor cl, byte [ebp]
inc esi
mov byte [eax + ebp], cl
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x4b7cb5
cmp dword [esp + 0x1c], 0
je 0x4b7d8b
mov eax, dword [esp + 0x2c]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x24]
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005448c8
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005448c8
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005448c8
add esp, 0x2c
ret
Function at 0x4be220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, edx
test ebp, ebp
je 0x4be277
test esi, esi
je 0x4be277
push edi
mov edi, dword [ecx + 0xc]
cmp esi, edi
jae 0x4be23a
mov edi, esi
xor eax, eax
test edi, edi
je 0x4be24c
mov dl, byte [eax + ebp]
xor byte [ecx + eax + 0x10], dl
inc eax
cmp eax, edi
jb 0x4be240
mov eax, dword [ecx + 0xc]
pop edi
cmp esi, eax
jbe 0x4be277
sub esi, eax
cmp esi, 0x10
jbe 0x4be260
mov esi, 0x10
xor eax, eax
test esi, esi
je 0x4be277
mov edx, dword [ecx + 0xc]
add edx, eax
mov dl, byte [edx + ebp]
xor byte [ecx + eax + 0x30], dl
inc eax
cmp eax, esi
jb 0x4be266
pop esi
pop ebp
ret

Function at 0x4be280
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00544cc0
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, ebp
sub esi, ebp
mov edi, 4
jmp 0x4be2b0
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec edi
jne 0x4be2b0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x10
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push edx
call fcn.0046ffd0
add esp, 0x14
pop edi
pop esi
pop ebp
test eax, eax
je 0x4be300
cmp dword [esp], 0x10
jne 0x4be300
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x4c0ce0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.00544cc0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.00460090
mov ebx, eax
push ebx
push esi
call fcn.004601f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4c0d6c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4c0d46
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4c0d39
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.00460260
push esi
call fcn.0045ff50
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4c0d6c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.00460090
mov ebx, eax
push ebx
push esi
call fcn.004601f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4c0dde
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4c0dc4
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4c0db7
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.00460260
push esi
call fcn.0045ff50
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x4c0d64
push esi
call fcn.0045ff50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4c35e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00544cc0
mov edx, dword [esp + 8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x64]
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
inc edi
test byte [ecx + 0x30], 1
je 0x4c362b
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 8]
lea ebx, [edi + ecx]
cmp ebx, eax
jbe 0x4c361b
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
add dword [esi + 0x14], ecx
add dword [esi + 0x18], ecx
sub eax, ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], eax
jmp 0x4c3636
mov eax, dword [esp + 0x18]
cmp edi, dword [eax + 8]
ja 0x4c3614
mov esi, eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
movzx ebx, byte [ecx + eax - 1]
mov ecx, dword [edx + 0x3cc]
push ecx
call fcn.00449630
push eax
call fcn.004ba2a0
add esp, 8
test eax, 0x200000
je 0x4c366f
or edx, 0xffffffff
sub edx, ebx
add dword [esi + 8], edx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esi + 8]
lea eax, [ebx + edi]
mov esi, ebp
sub esi, eax
xor esi, eax
mov ecx, ebp
xor ecx, eax
or esi, ecx
xor esi, ebp
shr esi, 0x1f
mov eax, pe_nt_image_headers32
dec esi
mov dword [esp + 0x18], eax
cmp ebp, eax
jae 0x4c369b
mov eax, ebp
mov dword [esp + 0x18], ebp
xor edi, edi
test eax, eax
je 0x4c36f7
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x14]
mov ecx, ebx
shr ecx, 0x1f
lea edx, [eax + ebp - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
lea esp, [esp]
mov edx, ebx
sub edx, edi
shr edx, 0x1f
mov eax, edi
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc edi
and esi, eax
cmp edi, dword [esp + 0x18]
jb 0x4c36c0
mov ecx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea eax, [esi - 1]
shr eax, 0x1f
not esi
shr esi, 0x1f
and eax, esi
neg eax
inc ebx
and ebx, eax
sub ebp, ebx
mov dword [ecx + 8], ebp
mov dword [esp + 0x24], eax
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
pop ebp
pop edi
and eax, 1
pop esi
or eax, edx
pop ebx
pop ecx
ret
Function at 0x4c3740
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00544cc0
mov eax, dword [0x5ca120]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 8]
push ebp
mov ebp, dword [esp + 0xb8]
mov dword [esp + 0x14], eax
sub eax, ebp
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
cmp eax, ebp
jb 0x4c3796
cmp ebp, 0x40
jbe 0x4c37af
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.005448c8
add esp, 0xa8
ret
push ebx
lea ebx, [esp + 0x30]
neg ebx
and ebx, 0x3f
lea ecx, [ebp + 0x100]
lea ebx, [esp + ebx + 0x30]
mov dword [esp + 0x24], ebx
cmp eax, ecx
jbe 0x4c37d6
sub eax, ebp
sub eax, 0x100
mov dword [esp + 0xc], eax
push edi
push ebp
push esi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call sub.MSVCR100.dll_memset
mov edi, dword [esp + 0x1c]
mov eax, edi
add esp, 0xc
xor ecx, ecx
cmp eax, dword [esp + 0x14]
jae 0x4c388a
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0xc0]
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x30], eax
jmp 0x4c381a
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov edx, edi
xor edx, dword [esp + 0x24]
xor esi, ebx
lea eax, [edx - 1]
not edx
shr edx, 0x1f
shr eax, 0x1f
and eax, edx
mov edx, edi
xor edx, ebx
mov ebx, dword [esp + 0x28]
or esi, edx
neg eax
xor esi, edi
mov edx, eax
or edx, dword [esp + 0x1c]
shr esi, 0x1f
inc dword [esp + 0x10]
neg esi
and edx, esi
mov esi, dword [esp + 0x18]
and eax, ecx
mov dword [esp + 0x1c], edx
or esi, eax
mov eax, dword [esp + 0x30]
and dl, byte [eax + edi]
inc ecx
or byte [ecx + ebx - 1], dl
mov edx, ecx
sub edx, ebp
xor edx, ebp
mov eax, ecx
xor eax, ebp
or edx, eax
xor edx, ecx
shr edx, 0x1f
neg edx
inc edi
and ecx, edx
mov dword [esp + 0x18], esi
cmp edi, dword [esp + 0x14]
jb 0x4c3816
xor eax, eax
pop edi
test ebp, ebp
je 0x4c38be
mov ecx, esi
xor ecx, 0x20
mov dl, byte [ecx + ebx]
mov cl, byte [esi + ebx]
mov edx, dword [esp + 0x28]
mov byte [edx + eax], cl
inc esi
mov ecx, esi
sub ecx, ebp
xor ecx, ebp
mov edx, esi
xor edx, ebp
or ecx, edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
inc eax
and esi, ecx
cmp eax, ebp
jb 0x4c3891
mov ecx, dword [esp + 0xb0]
pop ebx
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.005448c8
add esp, 0xa8
ret
Function at 0x4cb290
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x134
call fcn.00544cc0
mov eax, dword [0x5ca120]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x148]
push ebx
mov ebx, dword [esp + 0x140]
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x150]
mov dword [esp + 0x14], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x148]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x4cb2f5
cmp esi, dword [edi]
je 0x4cb2f1
cmp ebx, eax
je 0x4cb36e
cmp ebp, eax
jl 0x4cb36e
mov dword [edi], esi
jmp 0x4cb2fb
mov esi, dword [edi]
cmp esi, eax
je 0x4cb36e
push esi
call fcn.0048f970
add esp, 4
test al, 2
jne 0x4cb36e
test ebx, ebx
je 0x4cb468
push esi
mov dword [esp + 0x14], 1
call fcn.004921d0
add esp, 4
cmp eax, 0x90
jg 0x4cb36e
cmp eax, ebp
jge 0x4cb389
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 4]
push ecx
push esi
push edx
call fcn.00472290
add esp, 0xc
test eax, eax
je 0x4cb36e
mov eax, dword [edi + 4]
push ebp
push ebx
push eax
call fcn.00472440
add esp, 0xc
test eax, eax
je 0x4cb36e
mov eax, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call fcn.00472460
add esp, 0xc
test eax, eax
jne 0x4cb3a8
xor eax, eax
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005448c8
add esp, 0x134
ret
cmp ebp, 0x90
ja 0x4cb36e
push ebp
lea ecx, [esp + 0x24]
push ebx
push ecx
call sub.MSVCR100.dll_memcpy
mov eax, ebp
add esp, 0xc
mov dword [esp + 0x1c], eax
jmp 0x4cb3ac
mov eax, dword [esp + 0x1c]
cmp eax, 0x90
je 0x4cb3ca
mov edx, 0x90
sub edx, eax
push edx
lea eax, [esp + eax + 0x24]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x20]
xor cl, 0x36
mov byte [esp + eax + 0xb0], cl
inc eax
cmp eax, 0x90
jl 0x4cb3d0
mov ebx, dword [esp + 0x18]
mov edx, dword [edi + 8]
push ebx
push esi
push edx
call fcn.00472290
add esp, 0xc
test eax, eax
je 0x4cb48b
push esi
call fcn.004921d0
mov ecx, dword [edi + 8]
push eax
lea eax, [esp + 0xb8]
push eax
push ecx
call fcn.00472440
add esp, 0x10
test eax, eax
je 0x4cb48b
xor eax, eax
mov dl, byte [esp + eax + 0x20]
xor dl, 0x5c
mov byte [esp + eax + 0xb0], dl
inc eax
cmp eax, 0x90
jl 0x4cb421
mov eax, dword [edi + 0xc]
push ebx
push esi
push eax
call fcn.00472290
add esp, 0xc
test eax, eax
je 0x4cb48b
push esi
call fcn.004921d0
mov edx, dword [edi + 0xc]
push eax
lea ecx, [esp + 0xb8]
push ecx
push edx
call fcn.00472440
add esp, 0x10
test eax, eax
je 0x4cb48b
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.00472570
add esp, 8
test eax, eax
je 0x4cb484
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], 0
je 0x4cb4af
lea edx, [esp + 0x20]
push 0x90
push edx
call fcn.00484bb0
lea eax, [esp + 0xb8]
push 0x90
push eax
call fcn.00484bb0
add esp, 0x10
mov eax, dword [esp + 0x14]
jmp 0x4cb370
Function at 0x4d3790
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
push esi
test edx, edx
je 0x4d37a7
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x4d37ac
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test ebp, ebp
jle 0x4d3875
push ebx
push edi
mov edi, dword [esp + 0x14]
inc edi
jmp 0x4d37c0
movzx edx, byte [edi - 1]
cmp ebp, 3
jl 0x4d3811
movzx ebx, byte [edi]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + 1]
shl edx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
mov ebx, edx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 2], bl
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [ecx + 3], dl
jmp 0x4d3859
shl edx, 0x10
cmp ebp, 2
jne 0x4d3821
movzx ebx, byte [edi]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
cmp ebp, 1
jne 0x4d3848
lea edx, [ebp + 0x3c]
jmp 0x4d3852
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub ebp, 3
add ecx, 4
add eax, 4
add edi, 3
test ebp, ebp
jg 0x4d37c0
pop edi
pop ebx
pop esi
mov byte [ecx], 0
pop ebp
ret
pop esi
mov byte [ecx], al
pop ebp
ret
Function at 0x4db0c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.00544cc0
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.004a16c0
add esp, 8
test eax, eax
jne 0x4db0fb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x4db15d
xor ebx, ebx
test ebp, ebp
jle 0x4db2c0
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x4db13f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x4db118
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x4db110
jmp 0x4db2c0
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x40], eax
jle 0x4db2c0
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
mov dword [esp + 0x20], esi
cmp edi, esi
jle 0x4db29c
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x4db230
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x40]
jl 0x4db200
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x4ddaa0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x4ddb1f
test eax, eax
je 0x4ddaeb
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00485050
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x4ddaeb
push 0x3b
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.00446d70
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x4ddb1b
cmp edi, 0x40a
je 0x4ddb12
cmp edi, 0x43f
je 0x4ddb12
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ddb17
mov eax, 0x20
cmp esi, eax
je 0x4ddb1f
push 0x41
jmp 0x4ddad0
push ebx
push 0x46
push str.cryptoececx_meth.c
push 0x40
call fcn.0044cc20
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4ddb55
push 0x48
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00446d70
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x4ddb6d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
jmp case.0x4ddc9e.1036
cmp edi, 0x40a
je 0x4ddb8d
cmp edi, 0x43f
je 0x4ddb8d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ddb92
mov eax, 0x20
push 0x50
push str.cryptoececx_meth.c
push eax
call fcn.0045e740
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x4ddbc5
push 0x52
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00446d70
add esp, 0x14
jmp 0x4ddc18
cmp ebp, 2
jne 0x4ddc58
cmp edi, 0x40a
je 0x4ddbee
cmp edi, 0x43f
je 0x4ddbee
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ddbf3
mov eax, 0x20
push eax
push esi
call fcn.00460700
add esp, 8
test eax, eax
jg 0x4ddc2e
push 0x57
push str.cryptoececx_meth.c
push esi
call fcn.0045e760
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.cryptoececx_meth.c
push ebx
call fcn.0044cc90
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x4ddc47
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x4ddc8c
cmp edi, 0x40b
jne 0x4ddc8c
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x4ddc8c
cmp edi, 0x40a
je 0x4ddc78
cmp edi, 0x43f
je 0x4ddc78
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4ddc7d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x4ddc9e.1036
movzx ecx, byte [eax + 0x4ddcf8]
jmp dword [ecx*4 + 0x4ddce4]
push esi
push ebx
call fcn.00531560
jmp 0x4ddcc7
push esi
push ebx
call fcn.00531440
jmp 0x4ddcc7
push esi
push ebx
call fcn.00523ed0
jmp 0x4ddcc7
push esi
push ebx
call fcn.00521f10
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.00449960
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x4e76f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
push ebx
mov esi, ecx
call fcn.00449630
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, 0x72
mov eax, dword [esp + 0x14]
jne 0x4e77e6
push ebp
mov ebx, esi
push edi
shr ebx, 1
and esi, 1
push eax
lea ebp, [esi + ebx]
push ebp
push ecx
call fcn.00450bb0
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push eax
call fcn.004e7480
add esp, 0x14
test eax, eax
je 0x4e776a
push 0x104
push str.cryptokdf_tls1_prf.c
push edi
call fcn.0044cbe0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4e7770
push 0x105
push str.cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.00446d70
add esp, 0x14
pop ebp
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x18]
add ebx, dword [esp + 0x10]
push edi
push edx
push ebp
push ebx
call fcn.00450040
mov ecx, dword [esp + 0x24]
push eax
mov edx, esi
call fcn.004e7480
add esp, 0x14
test eax, eax
jne 0x4e77ae
push 0x10a
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.0044ccb0
add esp, 0x10
pop ebp
pop esi
xor eax, eax
pop ebx
ret
test edi, edi
je 0x4e77c9
mov eax, dword [esp + 0x1c]
mov ecx, esi
sub ecx, eax
mov ebp, edi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x4e77c0
push 0x10f
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.0044ccb0
add esp, 0x10
pop ebp
pop esi
mov eax, 1
pop ebx
ret
mov edx, dword [esp + 0x18]
push edi
push eax
push esi
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.004e7480
add esp, 0x14
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
ret