joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1458898
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x41f0cc]
mov esi, dword [esp + 0x164]
mov edx, dword [esp + 0x160]
lea edi, [esp + 8]
mov ecx, 0x10
mov dword [esp + 0x148], eax
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + eax*4 + 0x28]
xor ecx, dword [esp + eax*4 + 0x3c]
xor ecx, dword [esp + eax*4 + 0x10]
xor ecx, dword [esp + eax*4 + 8]
rol ecx, 1
mov dword [esp + eax*4 + 0x48], ecx
inc eax
cmp eax, 0x40
jne 0x14588c9
movdqu xmm0, xmmword [edx]
mov esi, dword [edx + 0x10]
xor eax, eax
pshufd xmm1, xmm0, 0xe5
pshufd xmm3, xmm0, 0x4e
pshufd xmm2, xmm0, 0xe7
movd ecx, xmm0
mov edi, esi
mov dword [esp + 4], esi
movd ebp, xmm1
movd ebx, xmm3
movd edx, xmm2
mov dword [esp], edi
mov edi, edx
mov edx, ebx
mov ebx, ebp
mov esi, ebx
and ebp, edx
rol ebx, 0x1e
not esi
and esi, edi
or esi, ebp
mov ebp, ecx
rol ecx, 5
add esi, dword [esp]
add esi, ecx
mov ecx, dword [esp + eax*4 + 8]
inc eax
cmp eax, 0x14
lea ecx, [ecx + esi + 0x5a827999]
jne 0x1458913
xor eax, eax
mov esi, edi
mov edi, edx
mov edx, ebx
mov ebx, ebp
mov ebp, ecx
mov ecx, edi
xor ecx, ebx
rol ebx, 0x1e
xor ecx, edx
add ecx, esi
mov esi, ebp
rol esi, 5
add ecx, esi
mov esi, dword [esp + eax*4 + 0x58]
inc eax
cmp eax, 0x14
lea ecx, [esi + ecx + 0x6ed9eba1]
jne 0x1458946
xor eax, eax
mov esi, edx
mov edx, ebx
mov ebx, ebp
mov dword [esp], edi
mov ebp, edx
mov edi, edx
or ebp, esi
and edi, esi
and ebp, ebx
rol ebx, 0x1e
or edi, ebp
mov ebp, ecx
rol ecx, 5
add edi, dword [esp]
add edi, ecx
mov ecx, dword [esp + eax*4 + 0xa8]
inc eax
cmp eax, 0x14
lea ecx, [ecx + edi - 0x70e44324]
mov edi, esi
jne 0x1458975
xor eax, eax
mov esi, edi
mov edi, edx
mov edx, ebx
mov ebx, ebp
mov ebp, ecx
mov ecx, edi
xor ecx, ebx
rol ebx, 0x1e
xor ecx, edx
add ecx, esi
mov esi, ebp
rol esi, 5
add ecx, esi
mov esi, dword [esp + eax*4 + 0xf8]
inc eax
cmp eax, 0x14
lea ecx, [esi + ecx - 0x359d3e2a]
jne 0x14589af
movd xmm1, edx
movd xmm2, ebx
movd xmm4, ebp
movd xmm3, ecx
mov eax, dword [esp + 0x160]
punpckldq xmm2, xmm1
punpckldq xmm3, xmm4
punpcklqdq xmm3, xmm2
paddd xmm0, xmm3
movdqu xmmword [eax], xmm0
mov ecx, dword [esp + 4]
add ecx, edi
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x148]
call fcn.01466d40
add esp, 0x14c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1458dbe
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x41f0cc]
movaps xmm0, xmmword [0x410660]
mov edi, edx
mov esi, ecx
test ebx, ebx
mov dword [esp + 0x48], eax
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
jle 0x1458e1b
mov al, byte [edi]
xor al, 0x36
cmp ebx, 1
mov byte [esp], al
je 0x1458e1b
xor eax, eax
inc eax
mov cl, byte [edi + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, ebx
jge 0x1458e1b
cmp eax, 0x3f
mov eax, ecx
jl 0x1458e07
movaps xmm0, xmmword [0x410620]
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], eax
mov eax, esp
push 0x40
push eax
push esi
call fcn.01458a4b
add esp, 0xc
movaps xmm0, xmmword [0x410670]
mov eax, esp
test ebx, ebx
mov edx, eax
movaps xmmword [eax + 0x30], xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
jle 0x1458e86
mov al, byte [edi]
xor al, 0x5c
cmp ebx, 1
mov byte [esp], al
je 0x1458e86
xor eax, eax
inc eax
mov cl, byte [edi + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, ebx
jge 0x1458e86
cmp eax, 0x3f
mov eax, ecx
jl 0x1458e72
movaps xmm0, xmmword [0x410620]
xor eax, eax
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0xc3d2e1f0
mov dword [esi + 0xb4], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xb8], eax
lea eax, [esi + 0x60]
mov esi, 0x40
push esi
mov edi, edx
push edi
push eax
call fcn.01458a4b
add esp, 0xc
push esi
push edi
call fcn.01460482
add esp, 8
mov ecx, dword [esp + 0x48]
call fcn.01466d40
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x145e680
Capabilities:
Terminate process
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
call fcn.01460f2c
call fcn.01462f48
push esi
call fcn.0147287d
Function at 0x145e695
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41f0cc]
mov ebp, dword [esp + 0x4c]
xor esi, esi
inc esi
mov dword [esp + 0x28], eax
push dword [esp + 0x50]
push ebp
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.0146531f
add esp, 0x10
test eax, eax
je 0x145e7f8
mov edi, dword [esp + 0x54]
cmp eax, 1
je 0x145e6fa
cmp eax, 2
jne 0x145e761
mov ebx, dword [0x41d7f8]
push 2
call fcn.0146a693
add esp, 4
cmp ebx, 0
je 0x145e721
push edi
push ebp
push 0x41262b
push eax
jmp 0x145e717
mov ebx, dword [0x41d7f8]
push 2
call fcn.0146a693
add esp, 4
cmp ebx, 0
je 0x145e73e
push edi
push ebp
push 0x4123b3
push eax
call fcn.01427e65
jmp 0x145e7ce
push edi
push ebp
push 0x412772
push eax
call fcn.01427e65
add esp, 0x10
push 2
call fcn.0146a693
add esp, 4
push eax
jmp 0x145e759
push edi
push ebp
push 0x41246d
push eax
call fcn.01427e65
add esp, 0x10
push 2
call fcn.0146a693
add esp, 4
push eax
call fcn.01475251
add esp, 4
lea ebp, [esp + 8]
mov byte [ebp], 0
push 0xfffffffffffffff6
call dword [0x4863b4]
lea ebx, [esp + 4]
mov edi, eax
push ebx
push edi
call dword [0x486354]
mov eax, dword [ebx]
mov esi, dword [0x48644c]
or eax, 7
push eax
push edi
call esi
mov eax, esp
push 0
push eax
push 0x1f
push ebp
push edi
call dword [0x486440]
push dword [ebx]
push edi
call esi
movzx eax, byte [ebp]
cmp eax, 0xd
ja 0x145e7d5
mov ecx, 0x2401
bt ecx, eax
jae 0x145e7d5
push 2
call fcn.0146a693
add esp, 4
push eax
push 1
push 0x16
push 0x412a17
call fcn.01475dc9
add esp, 0x10
xor esi, esi
jmp 0x145e7f8
cmp al, 0x79
je 0x145e7dd
cmp al, 0x59
jne 0x145e7f5
push dword [esp + 0x50]
push dword [esp + 0x50]
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.0146562e
add esp, 0x10
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
call fcn.01466d40
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x145e80b
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41f0cc]
mov dword [esp + 0x28], eax
mov esi, dword [0x41d7f8]
push 2
call fcn.0146a693
add esp, 4
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
cmp esi, 0
je 0x145e84c
push edx
push ecx
push 0x412aac
push eax
call fcn.01427e65
add esp, 0x10
xor esi, esi
jmp 0x145e8b8
push edx
push ecx
push 0x412a2e
push eax
call fcn.01427e65
add esp, 0x10
push 2
call fcn.0146a693
add esp, 4
push eax
call fcn.01475251
add esp, 4
push 0xfffffffffffffff6
call dword [0x4863b4]
lea edi, [esp + 4]
mov esi, eax
push edi
push esi
call dword [0x486354]
mov eax, dword [edi]
mov ebx, dword [0x48644c]
or eax, 7
push eax
push esi
call ebx
mov eax, esp
lea ebp, [esp + 8]
push 0
push eax
push 0x1f
push ebp
push esi
call dword [0x486440]
push dword [edi]
push esi
call ebx
mov al, byte [ebp]
or al, 0x20
cmp al, 0x79
jne 0x145e8cb
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
call fcn.01466d40
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0146a693
add esp, 4
push eax
push 1
push 0x16
push 0x412b20
call fcn.01475dc9
jmp 0x145e845
Function at 0x145e8e9
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41f0cc]
mov dword [esp + 0x28], eax
mov esi, dword [0x41d7f8]
push 2
call fcn.0146a693
add esp, 4
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
cmp esi, 0
je 0x145e92a
push edx
push ecx
push 0x412c35
push eax
call fcn.01427e65
add esp, 0x10
xor esi, esi
jmp 0x145e996
push edx
push ecx
push 0x412b37
push eax
call fcn.01427e65
add esp, 0x10
push 2
call fcn.0146a693
add esp, 4
push eax
call fcn.01475251
add esp, 4
push 0xfffffffffffffff6
call dword [0x4863b4]
lea edi, [esp + 4]
mov esi, eax
push edi
push esi
call dword [0x486354]
mov eax, dword [edi]
mov ebx, dword [0x48644c]
or eax, 7
push eax
push esi
call ebx
mov eax, esp
lea ebp, [esp + 8]
push 0
push eax
push 0x1f
push ebp
push esi
call dword [0x486440]
push dword [edi]
push esi
call ebx
mov al, byte [ebp]
or al, 0x20
cmp al, 0x79
jne 0x145e9a9
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
call fcn.01466d40
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.0146a693
add esp, 4
push eax
push 1
push 0x16
push 0x412d29
call fcn.01475dc9
jmp 0x145e923
Function at 0x146576d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x41f0cc]
mov esi, ecx
mov ebx, 0x212
lea edi, [esp + 0x12]
mov dword [esp + 0x224], eax
push ebx
push 0
push edi
call fcn.01469e24
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [esp + 4], ebx
push eax
push 0x414f99
push 0x80000001
call dword [0x4862a0]
test eax, eax
je 0x14657f1
mov al, byte [0x41e040]
test al, al
je 0x14657cb
mov ecx, dword [0x41e048]
jmp 0x146585b
push 0x414fd5
call fcn.014605a8
add esp, 4
test eax, eax
mov dword [0x41e044], eax
je 0x146584c
push 0x414fe1
push eax
call dword [0x4863a4]
mov ecx, eax
jmp 0x146584e
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push edi
push ecx
push 0
push 0x414fc8
push dword [esp + 0x20]
call dword [0x4862a4]
test eax, eax
jne 0x1465818
cmp dword [esp + 8], 1
je 0x146581d
mov byte [esp + 0x12], 0
push dword [esp + 0xc]
call dword [0x486298]
cmp byte [esp + 0x12], 0
je 0x14657b7
mov eax, esp
lea ecx, [esp + 0x12]
mov edx, esi
push eax
call fcn.01465a04
add esp, 4
test eax, eax
jne 0x146599c
jmp 0x14657b7
xor ecx, ecx
mov dword [0x41e048], ecx
mov byte [0x41e040], 1
test ecx, ecx
je 0x14658f9
xor ebx, ebx
push edi
push ebx
push ebx
push 0x1c
push ebx
call ecx
test eax, eax
js 0x14658ad
push edi
call fcn.01476c84
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.01465a04
add esp, 4
test eax, eax
jne 0x146599c
push edi
push ebx
push ebx
push 0x1a
push ebx
call dword [0x41e048]
test eax, eax
js 0x14658f9
push edi
call fcn.01476c84
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.01465a04
add esp, 4
test eax, eax
jne 0x146599c
mov ebp, dword [0x486370]
mov ebx, 0x212
push ebx
push edi
push 0x414ff2
call ebp
sub ebx, eax
lea eax, [esp + eax + 0x12]
push ebx
push eax
push 0x414ffc
call ebp
test eax, eax
je 0x1465958
push edi
call fcn.01476c84
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.01465a04
add esp, 4
test eax, eax
jne 0x146599c
push 0x212
push edi
call dword [0x4863dc]
push edi
call fcn.01476c84
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.01465a04
add esp, 4
test eax, eax
je 0x14659b8
mov esi, dword [esp]
mov ecx, dword [esp + 0x224]
call fcn.01466d40
mov eax, esi
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
dec esi
jmp 0x146599f

Function at 0x147dfae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0147de2d
Function at 0x14c4efd
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, edx
mov eax, dword [esi + 4]
test eax, eax
jne 0x14c4f17
push esi
call fcn.014c4a13
add esp, 4
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, 2
je 0x14c4f35
cmp eax, 1
jne 0x14c4f8e
add esi, 8
push ebx
push edi
push esi
call fcn.014c7d3c
add esp, 0xc
jmp 0x14c4f8e
mov eax, dword [esi]
test eax, eax
jne 0x14c4f51
push 0x2f
push 0x406b64
push 0x406bae
call fcn.0152ce59
add esp, 0xc
mov eax, dword [esi]
push eax
push ebx
push 1
push edi
call fcn.0152efea
add esp, 0x10
cmp eax, ebx
jae 0x14c4f8e
mov eax, dword [esi]
test eax, eax
je 0x14c4f77
push eax
call fcn.0152e42b
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 3
push 0x406bc2
push dword [esi + 0x18]
call fcn.0150c067
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x14c7bed
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edx, dword [0x42b238]
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], edx
xor edx, edx
dec edx
mov esi, edx
movsx ebx, byte [ecx + esi + 1]
mov eax, ebx
add al, 0xbf
cmp al, 0x19
ja 0x14c7c1d
add ebx, 0xffffffbf
jmp 0x14c7c5a
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x14c7c2a
add ebx, 0xffffffb9
jmp 0x14c7c5a
mov eax, ebx
add al, 0xd0
cmp al, 9
ja 0x14c7c37
add ebx, 4
jmp 0x14c7c5a
cmp bl, 0x2b
je 0x14c7c51
cmp bl, 0x3d
je 0x14c7c58
cmp bl, 0x2f
jne 0x14c7cec
mov ebx, 0x3f
jmp 0x14c7c5a
mov ebx, 0x3e
jmp 0x14c7c5a
mov ebx, edx
mov dword [esp + esi*4 + 8], ebx
inc esi
cmp esi, 3
jl 0x14c7c0b
mov ebx, dword [esp + 4]
xor esi, esi
cmp ebx, 0xffffffff
je 0x14c7cee
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
je 0x14c7cee
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x14c7cd6
xor eax, eax
cmp edx, 0xffffffff
mov ecx, ebp
mov ebp, 3
sete al
and edx, 0x3f
sub ebp, eax
shl ebx, 0x12
shl edi, 0xc
or ebx, edi
shr ebx, 0x10
cmp ebp, 2
mov byte [ecx], bl
jb 0x14c7ce7
mov eax, dword [esp]
mov esi, 2
shl eax, 6
mov ebx, eax
and eax, 0xf00
or eax, edi
cmp ebp, 3
mov byte [ecx + 1], ah
jne 0x14c7cee
or edx, ebx
mov esi, 3
mov byte [ecx + 2], dl
jmp 0x14c7cee
cmp edx, 0xffffffff
jne 0x14c7cee
mov ecx, ebp
xor ebp, ebp
mov edx, 0x3f
inc ebp
jmp 0x14c7c9c
xor esi, esi
inc esi
jmp 0x14c7cee
xor esi, esi
mov ecx, dword [esp + 0x14]
call fcn.0151fa06
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x14d5a58
Capabilities:
Parse credit card information

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp edx, 3
jne 0x14d5a6d
mov eax, 0x40b93f
cmp esi, 0x3c
je 0x14d5ab8
cmp edx, 3
jne 0x14d5a7c
mov eax, 0x40b961
cmp esi, 0x3d
je 0x14d5ab8
cmp edx, 3
jne 0x14d5a8b
mov eax, 0x40b980
cmp esi, 0x3f
je 0x14d5ab8
cmp edx, 3
jne 0x14d5a9a
mov eax, 0x40b9ab
cmp esi, 0x40
je 0x14d5ab8
cmp edx, 3
jne 0x14d5aa9
mov eax, 0x40b9ca
cmp esi, 0x41
je 0x14d5ab8
cmp edx, 3
jne 0x14d5abb
mov eax, 0x40b9ea
cmp esi, 0x42
jne 0x14d5abb
pop esi
pop edi
ret
lea edi, [esi - 1]
cmp edi, 5
ja 0x14d5ad6
mov eax, 0x40ba07
jmp dword [edi*4 + 0x410180]
cmp esi, 0x14
je 0x14d5b03
cmp esi, 0x15
jne 0x14d5b0a
mov eax, 0x40ba93
jmp 0x14d5ab8
mov eax, 0x40ba82
jmp 0x14d5ab8
cmp ecx, 1
jne 0x14d5b19
mov eax, 0x40baa4
cmp esi, 0x1e
je 0x14d5ab8
cmp ecx, 1
jne 0x14d5b28
mov eax, 0x40bab8
cmp esi, 0x1f
je 0x14d5ab8
cmp ecx, 2
jne 0x14d5b37
mov eax, 0x40bacd
cmp esi, 0x1e
je 0x14d5ab8
cmp ecx, 2
jne 0x14d5b4a
mov eax, 0x40baed
cmp esi, 0x22
je 0x14d5ab8
cmp ecx, 2
jne 0x14d5b5d
mov eax, 0x40bb09
cmp esi, 0x1f
je 0x14d5ab8
cmp ecx, 2
jne 0x14d5b70
mov eax, 0x40bb23
cmp esi, 0x20
je 0x14d5ab8
cmp ecx, 2
jne 0x14d5b83
mov eax, 0x40bb3c
cmp esi, 0x21
je 0x14d5ab8
cmp ecx, 4
jne 0x14d5b96
mov eax, 0x40bb56
cmp esi, 0x1e
je 0x14d5ab8
cmp ecx, 4
jne 0x14d5ba9
mov eax, 0x40bb6d
cmp esi, 0x1f
je 0x14d5ab8
cmp ecx, 4
jne 0x14d5bbc
mov eax, 0x40bb84
cmp esi, 0x20
je 0x14d5ab8
cmp ecx, 3
jne 0x14d5bcf
mov eax, 0x40bb99
cmp esi, 0x1e
je 0x14d5ab8
cmp ecx, 3
jne 0x14d5be2
mov eax, 0x40bbb0
cmp esi, 0x1f
je 0x14d5ab8
lea eax, [esi - 0x32]
cmp eax, 4
jae 0x14d5bf6
mov eax, dword [esi*4 + 0x40c2d8]
jmp 0x14d5ab8
cmp edx, 1
jne 0x14d5c09
mov eax, 0x40bc2f
cmp esi, 0x3c
je 0x14d5ab8
cmp edx, 2
jne 0x14d5c1c
mov eax, 0x40bc47
cmp esi, 0x3c
je 0x14d5ab8
cmp edx, 4
jne 0x14d5c2f
mov eax, 0x40bc6a
cmp esi, 0x3c
je 0x14d5ab8
cmp edx, 4
jne 0x14d5c42
mov eax, 0x40bc89
cmp esi, 0x3d
je 0x14d5ab8
lea ecx, [esi - 0x50]
mov eax, 0x406b02
cmp ecx, 0x15
jae 0x14d5ab8
mov eax, dword [esi*4 + 0x40c270]
jmp 0x14d5ab8
Function at 0x14e1b9d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x42b238]
mov edi, dword [esp + 0x4c]
mov ebx, edx
mov esi, ecx
test bl, 0xf
mov dword [esp + 0x34], eax
je 0x14e1bd1
push 0x41f
push 0x4125cc
push 0x41263e
call fcn.0152ce59
add esp, 0xc
lea eax, [edi + 0x3c8]
test ebx, ebx
mov dword [esp], eax
movsd xmm0, qword [edi + 0x3c8]
movsd xmm1, qword [edi + 0x3d0]
movsd qword [esp + 0x2c], xmm1
movsd qword [esp + 0x24], xmm0
jle 0x14e1c72
mov ebp, 0x10
xor eax, eax
mov ecx, dword [esi + eax*4]
bswap ecx
mov dword [esp + eax*4 + 4], ecx
mov dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 4
jne 0x14e1c01
lea eax, [esp + 0x14]
push eax
push edi
call dword [edi + 0x3c4]
add esp, 8
xor eax, eax
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
shr ecx, 0x18
mov byte [esi + eax*4], cl
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
shr ecx, 0x10
mov byte [esi + eax*4 + 1], cl
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
mov byte [esi + eax*4 + 2], ch
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
mov byte [esi + eax*4 + 3], cl
mov ecx, dword [esp + eax*4 + 4]
mov dword [esp + eax*4 + 0x24], ecx
inc eax
cmp eax, 4
jne 0x14e1c25
add esi, 0x10
cmp ebx, ebp
lea ebx, [ebx - 0x10]
jg 0x14e1bff
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x2c]
mov eax, dword [esp]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov ecx, dword [esp + 0x34]
call fcn.0151fa06
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x14e71b3
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x14e71db
mov edx, dword [esp + 0xc]
xor eax, eax
movzx esi, byte [edx]
movzx edi, al
shr eax, 8
inc edx
xor edi, esi
xor eax, dword [edi*4 + 0x413ca0]
dec ecx
jne 0x14e71c3
jmp 0x14e71dd
xor eax, eax
pop esi
pop edi
ret
Function at 0x14e7a5a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x42b238]
mov edi, dword [esp + 0x24]
mov ebx, edx
mov esi, ecx
test bl, 7
mov dword [esp + 0xc], eax
je 0x14e7a8e
push 0x261
push 0x414cd4
push 0x41281a
call fcn.0152ce59
add esp, 0xc
mov ecx, dword [edi + 0x80]
mov eax, dword [edi + 0x84]
mov edx, edi
test ebx, ebx
je 0x14e7b09
mov dword [esp], ebx
xor ebp, ebp
mov ebx, edx
mov edx, dword [esi + ebp]
mov edi, dword [esi + ebp + 4]
bswap edx
bswap edi
xor edx, ecx
lea ecx, [esp + 4]
xor edi, eax
push ebx
push edi
call fcn.014e86d7
add esp, 8
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
mov edx, ecx
shr edx, 0x18
mov byte [esi + ebp], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + ebp + 1], dl
mov edx, eax
mov byte [esi + ebp + 2], ch
mov byte [esi + ebp + 3], cl
shr edx, 0x18
mov byte [esi + ebp + 4], dl
mov edx, eax
shr edx, 0x10
mov byte [esi + ebp + 5], dl
mov byte [esi + ebp + 6], ah
mov byte [esi + ebp + 7], al
add ebp, 8
cmp ebp, dword [esp]
jb 0x14e7aa7
jmp 0x14e7b0b
mov ebx, edx
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x84], eax
mov ecx, dword [esp + 0xc]
call fcn.0151fa06
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x14e7b7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x42b238]
mov edi, ecx
test dl, 7
mov dword [esp + 0x18], eax
je 0x14e7bb0
push 0x279
push 0x414cd4
push 0x41281a
mov esi, edx
call fcn.0152ce59
mov edx, esi
add esp, 0xc
mov eax, dword [esp + 0x30]
test edx, edx
mov ebx, dword [eax + 0x80]
mov ecx, dword [eax + 0x84]
je 0x14e7c52
mov dword [esp], edi
xor edi, edi
mov dword [esp + 4], edx
mov esi, dword [esp]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
mov ebp, dword [esi + edi]
mov eax, dword [esi + edi + 4]
bswap ebp
bswap eax
mov dword [esp + 0xc], eax
mov edx, ebp
push dword [esp + 0x30]
push eax
call fcn.014e7d36
mov edx, dword [esp + 0xc]
add esp, 8
mov ecx, dword [esp + 8]
xor ebx, dword [esp + 0x10]
mov eax, ebx
xor ecx, dword [esp + 0x14]
shr eax, 0x18
mov byte [esi + edi], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + edi + 1], al
mov eax, ecx
mov byte [esi + edi + 2], bh
mov byte [esi + edi + 3], bl
mov ebx, ebp
shr eax, 0x18
mov byte [esi + edi + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + edi + 5], al
mov byte [esi + edi + 6], ch
mov byte [esi + edi + 7], cl
mov eax, dword [esp + 0x30]
add edi, 8
mov esi, dword [esp + 0xc]
cmp edi, edx
mov ecx, esi
jb 0x14e7bd1
jmp 0x14e7c56
mov esi, ecx
mov ebp, ebx
mov dword [eax + 0x80], ebp
mov dword [eax + 0x84], esi
mov ecx, dword [esp + 0x18]
call fcn.0151fa06
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x14ecb6a
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [0x42b238]
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], ecx
mov eax, dword [eax + 0x10]
call dword [eax]
xor ebx, ebx
mov edi, eax
inc ebx
push 0x1c
push ebx
call fcn.014c75c3
add esp, 8
mov esi, eax
mov dword [esi], 0
mov dword [esi + 4], edi
cmp dword [edi], ebx
jne 0x14ecbfd
xorps xmm0, xmm0
xor edi, edi
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
call fcn.014f1a0a
mov byte [esp + edi], al
inc edi
cmp edi, 0x20
jne 0x14ecbb5
mov edi, esp
mov ebx, 0x20
and byte [edi], 0xf8
mov al, byte [edi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
push ebx
push edi
call fcn.014e5454
add esp, 8
mov dword [esi + 0x18], eax
push ebx
push edi
call fcn.0151738f
add esp, 8
mov eax, dword [esi + 0x18]
test eax, eax
je 0x14ecc52
mov ecx, dword [esi + 4]
add ecx, 0x1c
jmp 0x14ecc1b
push dword [edi + 0x1c]
push dword [0x42b164]
call fcn.014e5627
add esp, 8
test eax, eax
mov dword [esi + 0x18], eax
je 0x14ecc52
mov ecx, dword [esi + 4]
add ecx, 0x20
push eax
push ecx
call fcn.014ea977
add esp, 8
test eax, eax
je 0x14ecc47
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
push eax
call fcn.014c7790
add esp, 4
jmp 0x14ecc5d
push dword [esi + 0x18]
call fcn.014e36d6
add esp, 4
push esi
call fcn.014c7790
add esp, 4
xor esi, esi
mov ecx, dword [esp + 0x28]
call fcn.0151fa06
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x14ef3fd
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 0x10]
mov eax, dword [0x42b238]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movaps xmm0, xmmword [0x4159f0]
test edi, edi
mov dword [esp + 0x48], eax
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
jle 0x14ef45c
mov al, byte [ebx]
xor al, 0x36
cmp edi, 1
mov byte [esp], al
je 0x14ef45c
xor eax, eax
inc eax
mov cl, byte [ebx + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, edi
jge 0x14ef45c
cmp eax, 0x3f
mov eax, ecx
jl 0x14ef448
movaps xmm0, xmmword [0x4159b0]
mov esi, esp
xor eax, eax
movups xmmword [edx], xmm0
mov dword [edx + 0x50], eax
mov dword [edx + 0x58], eax
mov dword [edx + 0x54], eax
push 0x40
push esi
push edx
call fcn.014eea5a
add esp, 0xc
movaps xmm0, xmmword [0x415a00]
test edi, edi
movaps xmmword [esi + 0x30], xmm0
movaps xmmword [esi + 0x20], xmm0
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
jle 0x14ef4bc
mov al, byte [ebx]
xor al, 0x5c
cmp edi, 1
mov byte [esp], al
je 0x14ef4bc
xor eax, eax
inc eax
mov cl, byte [ebx + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, edi
jge 0x14ef4bc
cmp eax, 0x3f
mov eax, ecx
jl 0x14ef4a8
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x4159b0]
mov edi, 0x40
xor ecx, ecx
movups xmmword [eax + 0x5c], xmm0
mov dword [eax + 0xac], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb0], ecx
lea eax, [eax + 0x5c]
push edi
push esi
push eax
call fcn.014eea5a
add esp, 0xc
push edi
push esi
call fcn.0151738f
add esp, 8
mov ecx, dword [esp + 0x48]
call fcn.0151fa06
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret