joyce8/EMBER2024-capa huggingface dataset:
Function at 0x507860
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0059cab0
mov eax, dword [esp + 0x2c]
push esi
mov esi, dword [eax]
test esi, esi
jns 0x507880
mov dword [eax], 0xffffffff
pop esi
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
test esi, esi
je 0x5078ac
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x5078ac
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x507897
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x507945
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x5078f4
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x507927
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x507915
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x5078f0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x507977
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push eax
push eax
call edx
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x507965
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [eax], esi
pop esi
add esp, 0x14
ret
Function at 0x507e40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0059cab0
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x507e5f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x507f30
jb 0x507e84
test eax, eax
jne 0x507f30
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x170]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x507ed3
nop
test esi, esi
je 0x507f22
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x18], ecx
jne 0x507ea0
lea eax, [ebp + 0x60]
push eax
mov eax, dword [ebp + 0x168]
lea ebx, [ebp + 0x40]
push ebx
call eax
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x507ed6
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x507efb
push eax
mov eax, dword [ebp + 0x164]
push edi
push ecx
push ebx
call eax
add edi, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x507f1e
mov ecx, esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x507f01
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x508f20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x170], 0
mov dword [esi + 0x16c], 0
cmp ebx, 0xc
jne 0x508f81
mov eax, dword [esp + 0x14]
lea edi, [ebx - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x509083
mov edi, dword [esp + 0x14]
lea edx, [esi + 0x60]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x4c], 0
push ebp
lea ebp, [esi + 0x40]
cmp ebx, 0x10
jb 0x50901d
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov dword [esp + 0x14], eax
nop dword [eax]
lea edx, [edi + 2]
mov eax, ecx
mov ebp, 4
nop word [eax + eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub ebp, 1
jne 0x508fd0
lea eax, [esi + 0x60]
push eax
mov eax, dword [esi + 0x168]
lea ebp, [esi + 0x40]
push ebp
call eax
add esp, 8
lea ecx, [esi + 0x41]
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x14], 1
jne 0x508fc0
lea edx, [esi + 0x60]
test ebx, ebx
je 0x50903f
mov ecx, ebp
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebx, 1
jne 0x509023
mov eax, dword [esi + 0x168]
push edx
push ebp
call eax
add esp, 8
mov eax, dword [esp + 0x1c]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
mov eax, dword [esi + 0x168]
bswap ecx
xor dword [esi + 0x48], ecx
push ebp
call eax
mov eax, dword [ebp]
add esp, 8
mov ecx, dword [ebp + 4]
mov edi, dword [esi + 0x4c]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
bswap edi
mov dword [esi + 0xc], ecx
pop ebp
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x178]
push eax
mov eax, dword [esi + 0x174]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret
Function at 0x50f900
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x50f914
mov dword [esp + 0x18], fcn.0050e0e0
jmp fcn.005073d0
mov dword [esp + 0x18], fcn.0050d380
jmp fcn.005070d0
Function at 0x511cd0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00502470
add esp, 4
test eax, eax
jne 0x511ce4
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.00492100

Function at 0x517d90
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xa8
push 0
lea eax, [esi + 0x40]
push eax
call fcn.0059e1f0
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
movzx eax, byte [edx]
mov dword [esi + 0xe4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ecx, 0xf3bcc908
mov dword [esi], ecx
xor eax, 0x6a09e667
mov dword [esi + 4], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
xor ecx, 0x84caa73b
mov dword [esi + 8], ecx
xor eax, 0xbb67ae85
mov dword [esi + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
xor ecx, 0xfe94f82b
mov dword [esi + 0x10], ecx
xor eax, 0x3c6ef372
mov dword [esi + 0x14], eax
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x1c]
xor ecx, 0x5f1d36f1
mov dword [esi + 0x18], ecx
xor eax, 0xa54ff53a
mov dword [esi + 0x1c], eax
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x24]
xor ecx, 0xade682d1
mov dword [esi + 0x20], ecx
xor eax, 0x510e527f
mov dword [esi + 0x24], eax
mov ecx, dword [edx + 0x28]
mov eax, dword [edx + 0x2c]
xor ecx, 0x2b3e6c1f
xor eax, 0x9b05688c
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x34]
xor ecx, 0xfb41bd6b
xor eax, 0x1f83d9ab
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
xor ecx, 0x137e2179
xor eax, 0x5be0cd19
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pop esi
ret
Function at 0x519ba0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
lea eax, [esi + 0x20]
push eax
call fcn.0059e1f0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret
Function at 0x5341d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0059cab0
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x534218
call fcn.00476d60
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00476e60
push 0
push 0x78
push 4
call fcn.00476f10
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.00533ef0
add esp, 4
test eax, eax
jne 0x534254
call fcn.00476d60
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00476e60
push 0
push 0xb2
push 4
call fcn.00476f10
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.00474f10
push esi
call fcn.00474cc0
push esi
mov dword [esp + 0x2c], eax
call fcn.00474cc0
push esi
mov ebp, eax
call fcn.00474cc0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x5343b6
test ebp, ebp
je 0x53438d
test ebx, ebx
je 0x534384
push 4
push ebp
call fcn.0046ffd0
push 4
push ebx
call fcn.0046ffd0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x5342be
call fcn.0046fea0
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x5342cc
call fcn.0046fea0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x534380
cmp dword [esi + 0x24], 0
je 0x534380
push 4
push eax
call fcn.0046ffd0
push 4
push dword [esi + 0x24]
call fcn.0046ffd0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00573a00
add esp, 0x3c
test eax, eax
je 0x534380
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00573a00
add esp, 0x2c
test eax, eax
je 0x534380
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00533e80
add esp, 0x10
test eax, eax
js 0x534380
je 0x534320
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00533e80
add esp, 0x10
test eax, eax
js 0x534380
je 0x534320
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.0046f590
add esp, 4
test ebx, ebx
je 0x53439a
push ebx
call fcn.0046f590
add esp, 4
push dword [esp + 0x20]
call fcn.0046f590
push esi
call fcn.00474bc0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x53438d
jmp 0x534384
Function at 0x543650
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0059cab0
cmp dword [esp + 0xc], 0
push ebp
push esi
push edi
je 0x543804
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
inc eax
push esi
push ebp
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push edi
push dword [esp + 0x2c]
call fcn.00543480
add esp, 0x1c
test eax, eax
je 0x54382c
push ebx
push 0x1bb
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.00476a70
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x5436ea
call fcn.00476d60
push str.tls1_prf_alg
push 0x1bc
push str.providersimplementationskdfs_tls1_prf.c
call fcn.00476e60
push ebx
push 0xc0100
push 0x39
call fcn.00476f10
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x10]
sub edi, eax
add edi, dword [esp + 0x24]
push esi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call fcn.00543480
add esp, 0x1c
test eax, eax
jne 0x54372c
push 0x1c2
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.00476b50
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
xor edi, edi
test esi, esi
je 0x5437e5
cmp esi, 0x40
jb 0x5437ca
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, esi
cmp ebp, eax
ja 0x543751
cmp ecx, ebx
jae 0x5437ca
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, ebx
lea ecx, [ebx + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, edx
jb 0x543770
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x1c], edi
cmp edi, esi
jae 0x5437e5
lea ecx, [edi + ebp]
mov edx, esi
mov ebp, ebx
sub ebp, dword [esp + 0x30]
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x5437d7
push 0x1c7
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.00476b50
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x2c]
call fcn.00543480
add esp, 0x1c
test eax, eax
jne 0x543833
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x54b050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x54b0c3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x54b0c3
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0x14]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x54b093
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x54b080
mov eax, dword [ebx + 0x14]
pop esi
cmp edx, eax
jbe 0x54b0c1
sub edx, eax
cmp edx, 0x10
jbe 0x54b0a5
mov edx, 0x10
jmp 0x54b0a9
test edx, edx
je 0x54b0c1
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x54b0b0
pop edi
pop ebx
pop ebp
ret
Function at 0x54b340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0059cab0
mov eax, dword [0x65fec0]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x88]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x54b3a0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x54b3c7
lea edi, [edx + 0x20]
jmp 0x54b3f2
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x54b3d1
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.004b3390
add esp, 0x14
test eax, eax
je 0x54b509
cmp dword [esp + 0x14], edi
jne 0x54b509
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.0059db90
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x54b49f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x54b45f
test ecx, ecx
jne 0x54b45f
test eax, eax
je 0x54b482
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.0054b0d0
add esp, 0x1c
test eax, eax
je 0x54b509
test edi, edi
je 0x54b4c2
mov eax, dword [esp + 0x1c]
push dword [eax + 0x80]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.0054b050
add esp, 0xc
jmp 0x54b4c2
push dword [esp + 0x90]
push ebp
push esi
call fcn.0054b050
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0054b050
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.004b3360
add esp, 0x18
test eax, eax
je 0x54b509
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.004b3360
add esp, 0x18
test eax, eax
je 0x54b509
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0059c3d3
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059c3d3
add esp, 0x74
ret
Function at 0x54e8d5
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x54e81d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.004e0370
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x54e864
call fcn.00476d60
push str.ecx_gen
push 0x24c
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.00476e60
push edi
push 0xc0100
push 0x39
call fcn.00476f10
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x54e8af
push esi
push edi
call fcn.004e02f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x54e8b2
call fcn.00476d60
push str.ecx_gen
push 0x255
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.00476e60
push esi
push 0xc0100
push 0x39
call fcn.00476f10
add esp, 0x18
push edi
call fcn.004e0310
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.00473f00
add esp, 0x10
test eax, eax
jle 0x54e8a3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x54e8ce
jmp dword [eax*4 + 0x54e94c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.004ec0b0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.004f5360
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004eba70
jmp 0x54e937
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004f3750
add esp, 0x10
test eax, eax
je 0x54e8a3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x579d70
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x84], 0xffffffff
je 0x579e44
push dword [edi]
call fcn.004718b0
mov esi, eax
add esp, 4
test esi, esi
js 0x579e44
mov eax, dword [esp + 0x14]
test eax, eax
je 0x579da1
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x579e3b
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x579dda
test esi, esi
jle 0x579e19
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x579dc4
jmp 0x579e19
mov eax, esi
mov byte [ecx + edi + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x579dfa
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.0059e1f0
add esp, 0xc
test esi, esi
jle 0x579e19
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x579e05
push esi
push ebp
push ebp
push dword [edi]
call fcn.00494b30
add esp, 0x10
pop ebx
test eax, eax
jg 0x579e3b
push esi
push ebp
call fcn.00401320
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
ret
pop ebp
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x588860
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0059cab0
mov edx, dword [esp + 0x18]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x34]
cmp ebp, 1
push esi
mov esi, dword [edx]
setne al
add eax, ebx
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x588899
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp ebp, 1
je 0x588964
mov ecx, dword [esp + 0x2c]
dec ecx
add ecx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x10], ecx
mov cl, byte [ecx]
mov byte [esp + 0xf], cl
movzx ebp, cl
je 0x5888d0
sub esi, ebp
mov eax, 1
sub esi, ebx
dec esi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [eax + ebp]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
push edi
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x588947
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, ebp
lea esi, [esi - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x588907
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
not ebx
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x3c]
movzx ecx, bl
mov ebx, dword [esp + 0x40]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edx], esi
pop edi
push dword [esp + 0x44]
push ecx
push ebx
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push edx
call fcn.00588540
add esp, 0x24
pop esi
pop ebp
pop ebx
add esp, 0x14
ret