joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5abd1a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push ebx
movzx ebx, byte [ecx]
push esi
lea esi, [ecx + 1]
shl ebx, 0x18
mov edx, esi
mov dword [ebp - 0x28], ecx
push edi
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x14], eax
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x24], esi
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x1c], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x18], edx
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x5abe97
mov ecx, dword [ebp + 8]
sub dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 0x10]
dec eax
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x5abe40
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
call fcn.005ab796
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edx, dword [ebp - 0x18]
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
pop ecx
shr eax, 8
inc dword [ebp - 0x14]
pop ecx
mov ecx, dword [ebp + 8]
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + edi - 0xc]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
mov eax, dword [ebp + 0x10]
inc edi
and edi, 7
mov dword [ebp + 8], ecx
test eax, eax
jne 0x5abde8
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
je 0x5abe97
mov ecx, dword [ebp - 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
mov eax, ebx
shr eax, 8
mov byte [esi + 1], al
mov eax, edx
shr eax, 0x18
mov byte [esi + 2], bl
mov byte [esi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 4], al
mov eax, edx
shr eax, 8
mov byte [esi + 5], al
mov byte [esi + 6], dl
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5ae2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push ebx
movzx ebx, byte [ecx]
push esi
lea esi, [ecx + 1]
shl ebx, 0x18
mov edx, esi
mov dword [ebp - 0x28], ecx
push edi
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x14], eax
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov dword [ebp - 0x24], esi
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x1c], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x18], edx
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
je 0x5ae46d
mov ecx, dword [ebp + 8]
sub dword [ebp - 0x10], ecx
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp - 0x10]
dec eax
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x5ae416
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push eax
call fcn.005adce8
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov edx, dword [ebp - 0x18]
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
pop ecx
shr eax, 8
inc dword [ebp - 0x14]
pop ecx
mov ecx, dword [ebp + 8]
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov al, byte [ebp + edi - 0xc]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
mov eax, dword [ebp + 0x10]
inc edi
and edi, 7
mov dword [ebp + 8], ecx
test eax, eax
jne 0x5ae3be
mov esi, dword [ebp - 0x24]
cmp dword [ebp - 0x14], eax
je 0x5ae46d
mov ecx, dword [ebp - 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
mov eax, ebx
shr eax, 8
mov byte [esi + 1], al
mov eax, edx
shr eax, 0x18
mov byte [esi + 2], bl
mov byte [esi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 4], al
mov eax, edx
shr eax, 8
mov byte [esi + 5], al
mov byte [esi + 6], dl
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5af6ad
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
push 0x2e
push eax
mov dword [ebp - 0x40], eax
xorps xmm0, xmm0
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x32]
push eax
mov dword [ebp - 0x44], 0x1010040
movlpd qword [ebp - 0x3c], xmm0
call fcn.00718210
push 0xa8
lea eax, [ebx + 0x40]
push 0
push eax
call fcn.00718210
add esp, 0x18
mov esi, 0x821440
mov edi, ebx
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x44]
push 8
sub esi, ebx
pop edi
mov ecx, dword [esi + ebx]
mov edx, dword [esi + ebx + 4]
xor dword [ebx], ecx
lea ebx, [ebx + 8]
xor dword [ebx - 4], edx
sub edi, 1
jne 0x5af70e
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5b5bd8
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
lea edi, [ebp - 0x15]
mov word [ebp - 0x18], cx
mov byte [ebp - 0x16], cl
mov dword [ebp - 0x24], 0x1010020
stosd dword es:[edi], eax
push 0x54
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebx + 0x20]
push eax
call fcn.00718210
add esp, 0xc
mov esi, 0x821480
mov edi, ebx
push 8
pop edx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x24]
sub esi, ebx
mov ecx, dword [esi + ebx]
xor dword [ebx], ecx
lea ebx, [ebx + 4]
sub edx, 1
jne 0x5b5c30
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5b884d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, ebx
push edi
mov edi, dword [ebp + 0x10]
shr eax, 3
mov dword [ebp - 8], eax
cmp edi, ebx
jb 0x5b8954
push esi
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
test eax, eax
je 0x5b893c
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 7]
cdq
mov esi, eax
mov ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 6]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 5]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 4]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 3]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 2]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
shld ecx, esi, 8
shl esi, 8
movzx eax, byte [eax + 1]
cdq
or esi, eax
or ecx, edx
mov eax, dword [ebp + 0xc]
add dword [ebp + 0xc], 8
shld ecx, esi, 8
movzx eax, byte [eax]
cdq
or ecx, edx
shl esi, 8
or esi, eax
push ecx
push esi
call fcn.005b7ea8
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor dword [edi + ecx*8], eax
xor dword [edi + ecx*8 + 4], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x5b8880
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
push esi
call fcn.005b7fa2
mov eax, dword [ebp - 8]
sub edi, ebx
mov dword [ebp + 0x10], edi
pop ecx
cmp edi, ebx
jae 0x5b886e
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret
Function at 0x5b8b31
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x5b8cff
dec esi
lea edx, [eax + 0x14]
push ebx
lea ebx, [eax + 0xc]
shr esi, 3
push edi
mov edi, dword [ebp + 0xc]
inc esi
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], edx
movzx eax, byte [edi + 1]
movzx ecx, byte [edi]
lea edi, [edi + 8]
shl eax, 8
or ecx, eax
movzx eax, byte [edi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edi - 3]
shl eax, 8
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa4], ecx
movzx ecx, byte [edi - 4]
or ecx, eax
movzx eax, byte [edi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edi - 1]
shl eax, 0x18
or ecx, eax
mov al, byte [ebx]
and al, 0xdf
mov dword [ebp - 0x8c], ecx
or al, 0x40
mov dword [ebp - 0x98], ecx
mov byte [ebx], al
mov al, byte [edx]
and al, 0xbf
mov dword [ebp - 0xa0], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.00580701
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.005804da
push 1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0057da0f
mov ebx, dword [ebp - 0x90]
push ebx
call fcn.00580701
lea eax, [ebp - 0x84]
push eax
push ebx
call fcn.005804da
push 1
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.0057da0f
mov ecx, dword [ebp - 0x8c]
add esp, 0x30
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x88]
xor edx, ecx
xor ecx, dword [ebp - 0xa0]
mov ebx, dword [ebp - 0x9c]
xor ebx, eax
mov dword [ebp - 0x8c], ecx
xor eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x88], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp - 0x88]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp - 0x88]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0x94]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub esi, 1
jne 0x5b8b6f
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.006fedff
leave
ret
Function at 0x5bd031
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x24]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1c]
push edi
push eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x58], 1
call fcn.0053b734
mov dword [ebp - 0x5c], eax
pop ecx
test eax, eax
js 0x5bd210
call fcn.005e4b50
mov edi, eax
mov dword [ebp - 0x68], edi
test edi, edi
je 0x5bd210
xor ebx, ebx
test esi, esi
jne 0x5bd093
mov esi, 0x7b6c78
mov ecx, ebx
jmp 0x5bd0a9
mov ecx, dword [ebp + 0xc]
cmp ecx, 0xffffffff
jne 0x5bd0a9
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5bd0a0
sub ecx, edx
push ebx
push dword [ebp - 0x54]
push ecx
push esi
push edi
call fcn.005e4c64
add esp, 0x14
test eax, eax
je 0x5bd209
call fcn.005e4b50
mov esi, eax
test esi, esi
je 0x5bd209
mov edx, dword [ebp + 0x20]
jmp 0x5bd1ec
cmp edx, dword [ebp - 0x5c]
mov eax, edx
mov ecx, dword [ebp - 0x58]
cmovg eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4c], eax
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x48], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x47], al
mov eax, ecx
shr eax, 8
push edi
push esi
mov byte [ebp - 0x46], al
mov byte [ebp - 0x45], cl
call fcn.005e4ab2
pop ecx
pop ecx
test eax, eax
je 0x5bd1f7
push dword [ebp + 0x14]
push dword [ebp - 0x60]
push esi
call fcn.005e4eaf
add esp, 0xc
test eax, eax
je 0x5bd1f7
push 4
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.005e4eaf
add esp, 0xc
test eax, eax
je 0x5bd1f7
push ebx
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.005e4bde
add esp, 0xc
test eax, eax
je 0x5bd1f7
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x50]
call fcn.00717660
xor eax, eax
add esp, 0xc
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp + 0x18], eax
jle 0x5bd1db
push edi
push esi
call fcn.005e4ab2
pop ecx
pop ecx
test eax, eax
je 0x5bd1f7
push dword [ebp - 0x5c]
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.005e4eaf
add esp, 0xc
test eax, eax
je 0x5bd1f7
push ebx
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.005e4bde
add esp, 0xc
test eax, eax
je 0x5bd1f7
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jle 0x5bd1cd
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x44]
sub eax, edx
mov edi, ecx
mov dword [ebp - 0x64], eax
mov ecx, eax
mov al, byte [edx + ecx]
xor byte [edx], al
inc edx
sub edi, 1
jne 0x5bd1bc
mov edi, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp eax, dword [ebp + 0x18]
jl 0x5bd173
jmp 0x5bd1de
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp + 0x20]
sub edx, ecx
inc dword [ebp - 0x58]
add dword [ebp - 0x50], ecx
mov dword [ebp + 0x20], edx
test edx, edx
jne 0x5bd0d7
xor ebx, ebx
inc ebx
push esi
call fcn.005e4b11
push edi
call fcn.005e4b11
pop ecx
pop ecx
mov eax, ebx
jmp 0x5bd212
push edi
call fcn.005e4b11
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5d511f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0xa8], eax
xor esi, esi
mov eax, dword [edx + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x8c], eax
sub eax, edi
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x88], esi
cmp dword [edx + 0xc], edi
jb 0x5d52c9
cmp edi, 0x40
ja 0x5d52c9
lea eax, [ebp - 0x84]
neg eax
lea ecx, [ebp - 0x84]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [ebp - 0x9c], ecx
cmp dword [edx + 0xc], eax
jbe 0x5d51a2
mov eax, dword [edx + 0xc]
sub eax, edi
sub eax, 0x100
mov dword [ebp - 0x88], eax
push ebx
push edi
push esi
push ecx
mov dword [ebp - 0x98], esi
mov ebx, esi
call fcn.00718210
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 0x88]
mov dword [ebp - 0x90], esi
cmp ecx, dword [eax + 0xc]
jae 0x5d528a
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xa4], eax
mov eax, ecx
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov eax, ecx
xor eax, dword [ebp - 0xa0]
xor edx, dword [ebp - 0x8c]
lea esi, [eax - 1]
not eax
shr eax, 0x1f
shr esi, 0x1f
and esi, eax
mov eax, ecx
xor eax, dword [ebp - 0x8c]
neg esi
or edx, eax
mov eax, dword [ebp - 0xa4]
xor edx, ecx
shr edx, 0x1f
neg edx
mov cl, byte [eax + ecx]
mov eax, esi
or eax, dword [ebp - 0x98]
and esi, dword [ebp - 0x90]
and eax, edx
mov edx, dword [ebp - 0x9c]
or ebx, esi
mov esi, dword [ebp - 0x90]
mov dword [ebp - 0x98], eax
and al, cl
or byte [esi + edx], al
inc esi
mov ecx, esi
mov eax, esi
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [ebp + 0xc]
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
mov ecx, dword [ebp - 0x88]
inc ecx
mov dword [ebp - 0x90], esi
inc dword [ebp - 0x94]
mov dword [ebp - 0x88], ecx
cmp ecx, dword [eax + 0xc]
jb 0x5d51e5
xor esi, esi
jmp 0x5d5290
mov edx, dword [ebp - 0x9c]
test edi, edi
je 0x5d52c3
mov ecx, dword [ebp - 0xa8]
mov eax, ebx
xor eax, 0x20
mov al, byte [eax + edx]
mov al, byte [ebx + edx]
inc ebx
mov byte [ecx + esi], al
mov ecx, ebx
sub ecx, edi
mov eax, ebx
xor ecx, edi
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
inc esi
cmp esi, edi
jb 0x5d5294
xor eax, eax
inc eax
pop ebx
jmp 0x5d52cb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.006fedff
leave
ret
Function at 0x5d62af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
inc ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov ecx, dword [esi + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x5d632a
mov edx, dword [ebp + 0x10]
lea eax, [ebx + edx]
cmp eax, ecx
ja 0x5d632e
add dword [esi + 0x14], edx
sub ecx, edx
add dword [esi + 0x18], edx
sub dword [esi + 0xc], edx
mov dword [esi + 8], ecx
mov eax, dword [esi + 0x14]
push dword [edi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [ebp + 0x17], al
mov dword [ebp - 4], ebx
call fcn.00531d8c
push eax
call fcn.005310d3
mov edi, dword [esi + 8]
mov dword [ebp - 0x10], edi
pop ecx
pop ecx
and eax, 0x200000
je 0x5d6335
sub edi, ebx
xor eax, eax
dec edi
inc eax
mov dword [esi + 8], edi
jmp 0x5d63d8
cmp ebx, ecx
jbe 0x5d62ec
xor eax, eax
jmp 0x5d63d8
mov ecx, dword [ebp - 8]
mov eax, edi
add ecx, ebx
mov ebx, edi
sub ebx, ecx
xor eax, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edi
shr ebx, 0x1f
dec ebx
cmp edi, eax
cmovb eax, edi
mov dword [ebp - 8], eax
test eax, eax
je 0x5d63af
mov eax, dword [esi + 0x14]
dec edi
mov edx, dword [ebp - 4]
add eax, edi
mov esi, dword [ebp - 4]
shr edx, 0x1f
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp + 8], eax
mov ecx, esi
mov eax, edi
sub ecx, edi
shr eax, 0x1f
shr ecx, 0x1f
xor cl, al
xor al, dl
or cl, al
mov eax, dword [ebp + 8]
dec cl
movzx edx, cl
movzx ecx, byte [eax]
movzx eax, byte [ebp + 0x17]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [ebp - 0xc]
inc edi
dec dword [ebp + 8]
cmp edi, dword [ebp - 8]
jb 0x5d6374
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
not ebx
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
inc eax
and eax, ecx
sub edi, eax
mov dword [esi + 8], edi
mov dword [ebp + 0x14], ecx
not ecx
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
and ecx, 1
or eax, ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5db2ba
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
push esi
mov esi, dword [ebp + 8]
push ecx
push 0x20
push eax
call fcn.00558b36
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.005ddf42
lea eax, [ebp - 0xe4]
push eax
push esi
call fcn.005ddeea
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0054ec79
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop esi
call fcn.006fedff
leave
ret

Function at 0x5db326
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x19c]
push edi
mov edi, dword [ebp + 0x14]
push eax
call fcn.00558e6a
push 0x20
lea eax, [ebp - 0x19c]
push esi
push eax
call fcn.00558f17
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00558ba8
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x19c]
push eax
call fcn.00558e6a
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00558f17
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.00558f17
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00558ba8
lea eax, [ebp - 0x84]
push eax
call fcn.005e113c
add esp, 0x40
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.005ddf42
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push esi
call fcn.005ddeea
lea eax, [ebp - 0x19c]
push eax
call fcn.00558e6a
push 0x20
lea eax, [ebp - 0x19c]
push esi
push eax
call fcn.00558f17
push 0x20
lea eax, [ebp - 0x19c]
push edi
push eax
call fcn.00558f17
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.00558f17
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.00558ba8
add esp, 0x40
lea eax, [ebp - 0xc4]
push eax
call fcn.005e113c
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.005de24f
lea eax, [ebp - 0x19c]
push 0xd8
push eax
call fcn.0054ec79
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.0054ec79
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0054ec79
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor eax, eax
xor ecx, ebp
inc eax
pop edi
pop esi
pop ebx
call fcn.006fedff
leave
ret
Function at 0x5db653
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x8d5f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
and byte [ebp - 0x24], 0xf8
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.005ddf42
pop ecx
pop ecx
xor esi, esi
mov edx, dword [ebp + esi - 0xc4]
mov ecx, dword [ebp + esi - 0xec]
lea eax, [edx + ecx]
sub edx, ecx
mov dword [ebp + esi - 0x4c], eax
mov dword [ebp + esi - 0x74], edx
add esi, 4
cmp esi, 0x28
jb 0x5db69c
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.005dba52
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x4c]
push eax
push eax
call fcn.005dbcbb
lea eax, [ebp - 0x4c]
push eax
push ebx
call fcn.005dd33f
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.0054ec79
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.006fedff
leave
ret

Function at 0x5db76c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
neg edx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0xa
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x5db781
pop edi
pop esi
pop ebp
ret

Function at 0x5db796
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0xa
neg edi
sub esi, edx
pop ebx
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, edi
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x5db7ac
pop edi
pop esi
pop ebx
pop ebp
ret