joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c150
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6b1f2c], 0
push edi
mov edi, dword [ebp + 8]
jne 0x50c181
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
push ebx
push 0x190
lea eax, [ebp - 0x224]
mov dword [ebp - 0x8c], 1
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [ebp - 0x224]
add esp, 0xc
push eax
push 0x909
call ebx
mov dword [ebp - 0x8c], eax
cmp eax, 0x276c
jne 0x50c293
mov edx, 5
mov ecx, 2
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x90], ecx
push esi
nop
cmp edx, 1
jl 0x50c251
sub ecx, 1
mov dword [ebp - 0x90], ecx
jns 0x50c202
mov ecx, 9
dec edx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x94], edx
test edx, edx
je 0x50c251
movzx ecx, cl
movzx eax, dl
shl cx, 8
or cx, ax
lea eax, [ebp - 0x224]
push 0x190
push 0
push eax
movzx esi, cx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
call ebx
mov dword [ebp - 0x8c], eax
cmp eax, 0x276c
jne 0x50c251
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x90]
jmp 0x50c1e0
pop esi
test eax, eax
jne 0x50c297
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x94]
push eax
push str.Using_ws2_32.dll_version__d__d
lea eax, [ebp - 0x88]
push 0x50
push eax
call fcn.0042fc50
mov eax, dword [edi]
lea ecx, [ebp - 0x88]
add esp, 0x14
push ecx
push str.ws2_32_DLL_Version
mov ecx, edi
call dword [eax + 0x2c]
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x50c302
cmp eax, 0x276b
jne 0x50c2a5
push str.The_underlying_network_subsystem_is_not_ready_for_network_communication.
jmp 0x50c2fb
cmp eax, 0x276c
jne 0x50c2b3
push str.The_version_of_Windows_Sockets_support_requested_is_not_provided_by_this_particular_Windows_Sockets_implementation.
jmp 0x50c2fb
cmp eax, 0x2734
jne 0x50c2c1
push str.A_blocking_Windows_Sockets_1.1_operation_is_in_progress.
jmp 0x50c2fb
cmp eax, 0x2753
jne 0x50c2cf
push str.Limit_on_the_number_of_tasks_supported_by_the_Windows_Sockets_implementation_has_been_reached.
jmp 0x50c2fb
cmp eax, 0x271e
jne 0x50c2dd
push str.The_lpWSAData_is_not_a_valid_pointer.
jmp 0x50c2fb
lea eax, [ebp - 0x8c]
push eax
push str.WSAStartup_error:_0x_x
lea eax, [ebp - 0x38]
push 0x32
push eax
call fcn.0042fc10
add esp, 0x10
lea ecx, [ebp - 0x38]
push ecx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
push edi
mov byte [0x6b1f2c], 0
call fcn.00507420
mov ecx, dword [ebp - 4]
add esp, 4
xor eax, eax
cmp dword [ebp - 0x8c], eax
sete al
xor ecx, ebp
pop ebx
pop edi
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
Function at 0x52a740
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [str.expand_32_byte_k]
push esi
mov esi, dword [ebp + 8]
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 8], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
mov edx, dword [ebp + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0xc], ecx
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x40], 0x40
mov dword [esi + 0x2c], ecx
pop esi
pop ebp
ret
Function at 0x532aa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f36c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov edi, dword [ebp + 0x14]
xorps xmm0, xmm0
mov ebx, dword [ebp + 0x10]
movq qword [ebp - 0x1c], xmm0
movzx eax, byte [esi + 0x24]
push eax
push str.readExpectedMessage
push edi
mov dword [ebp - 0x14], 0
call fcn.00430cf0
cmp byte [esi + 0x24], 0
mov dword [ebp - 4], 0
je 0x532b18
cmp dword [esi + 0x28], 0
jne 0x532b18
mov eax, dword [edi]
mov ecx, edi
push str.No_m_pHandler.
call dword [eax + 0x14]
cmp dword [esi + 4], 0
mov dword [esi + 0x34], 0
jne 0x532b30
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
nop dword [eax]
mov eax, dword [esi + 0x10]
cmp eax, 5
jne 0x532b5c
cmp dword [0x6bf904], 0xa
jge 0x532b53
mov eax, dword [edi]
mov ecx, edi
push str.sshRp.m_totalTimeoutMs_wf_is_too_small__2_
call dword [eax + 0x14]
inc dword [0x6bf904]
mov dword [esi + 0x10], 0x7530
jmp 0x532b60
test eax, eax
je 0x532b91
cmp dword [esi + 4], 0
jne 0x532b6e
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x532b7e
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x532b91
sub eax, ecx
cmp eax, dword [esi + 0x10]
ja 0x532bbe
mov ecx, dword [ebp - 0x20]
push edi
push ebx
push esi
call fcn.005358e0
test al, al
je 0x532bed
mov ecx, ebx
call fcn.004efcb0
test al, al
jne 0x532bed
cmp byte [ebp + 0xc], al
je 0x532bba
cmp dword [esi + 0x34], 0x5d
je 0x532b30
mov bl, 1
jmp 0x532bef
mov ecx, ebx
call fcn.004efd30
mov byte [ebx + 0x10], 1
cmp byte [edi + 0xad], 0
je 0x532bed
mov eax, dword [edi]
mov ecx, edi
push str.Too_much_time_elapsed_waiting_for_response.
call dword [eax + 0x14]
push dword [esi + 0x10]
mov ecx, edi
push str.totalTimeoutMs
call fcn.00431470
xor bl, bl
lea ecx, [ebp - 0x1c]
call fcn.00430db0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x10
Function at 0x533160
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ff1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x78]
mov esi, dword [ebp + 0x14]
xorps xmm0, xmm0
mov edi, dword [ebp + 0x10]
push str.readUntilRcvWindowAdjust
push esi
mov dword [ebp - 0x7c], eax
movq qword [ebp - 0x78], xmm0
mov dword [ebp - 0x70], 0
call fcn.00430cc0
mov dword [ebp - 4], 0
call sub.KERNEL32.dll_GetTickCount
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebx + 0xb0], 0
jne 0x533306
nop dword [eax]
push 0x5c
lea eax, [ebp - 0x6c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x6c], vtable.SshReadParams.0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x64], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xea60
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
call fcn.004118f0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x7c]
mov ecx, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x60], 0
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x5c], eax
call fcn.004efd30
mov ecx, dword [ebp - 0x80]
push esi
push edi
push dword [ebp - 0x7c]
call fcn.005358e0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x5332a5
push esi
call fcn.00480960
test al, al
jne 0x533330
mov ecx, edi
call fcn.004efce0
test al, al
jne 0x533372
cmp byte [ebp - 0x3d], al
jne 0x533364
cmp byte [ebp - 0x3f], al
jne 0x533356
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x84]
cmp eax, 0xea60
ja 0x53333e
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0
mov dword [ebp - 0x6c], vtable.SshReadParams.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], 0
call fcn.00411b10
cmp dword [ebx + 0xb0], 0
je 0x5331e0
mov bl, 1
lea ecx, [ebp - 0x78]
call fcn.00430db0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
mov ecx, esi
push str.aborted_by_user_application.
call dword [eax + 0x14]
jmp 0x53337f
mov ecx, dword [ebp - 0x80]
push esi
push edi
call fcn.0052c740
mov eax, dword [esi]
mov ecx, esi
push str.No_WINDOW_ADJUST_seems_to_be_coming...
call dword [eax + 0x14]
jmp 0x53337f
mov eax, dword [esi]
mov ecx, esi
push str.Received_CHANNEL_CLOSE
call dword [eax + 0x14]
jmp 0x53337f
mov eax, dword [esi]
mov ecx, esi
push str.Received_DISCONNECT
call dword [eax + 0x14]
jmp 0x53337f
push esi
push str.sshWindowAdjust1
mov ecx, edi
call fcn.004efde0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x6c], vtable.SshReadParams.0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], 0
call fcn.00411b10
xor bl, bl
jmp 0x533308
Function at 0x535eb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x535f03
cmp dword [esi + 4], 0
jne 0x535ecb
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 4], eax
cmp dword [esi + 0x10], 0x3e8
jae 0x535edb
mov dword [esi + 0x10], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 4]
cmp eax, ecx
jbe 0x535f03
sub eax, ecx
cmp eax, dword [esi + 0x10]
jbe 0x535f03
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.004efd30
mov byte [esi + 0x10], 1
mov al, 1
pop esi
pop ebp
ret 0xc
xor al, al
pop esi
pop ebp
ret 0xc

Function at 0x539f10
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x539f2e
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x53a02e
nop word [eax + eax]
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jb 0x539ff1
mov ebx, edx
shr ebx, 4
nop dword [eax]
movzx eax, byte [edi]
sub edx, 0x10
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
sub ebx, 1
jne 0x539f60
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x53a002
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x539ff5
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x539f40
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x53b700
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea ecx, [esi + 0x28]
call fcn.00414900
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, eax
test edx, edx
je 0x53b77b
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x53b73b
mov eax, dword [eax]
mov dword [esi + 0x118], eax
jmp 0x53b745
mov dword [esi + 0x118], 0
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
lea eax, [ecx + 3]
push eax
lea eax, [ecx + 2]
push eax
lea eax, [ecx + 1]
push eax
push ecx
push str._b._b._b._b
lea eax, [ebp - 0x2c]
push 0x28
push eax
call fcn.0042fcf0
add esp, 0x1c
lea eax, [ebp - 0x2c]
lea ecx, [esi + 0xa0]
push eax
call fcn.00425470
jmp 0x53b786
lea ecx, [esi + 0xa0]
call fcn.00422240
mov ecx, dword [ebp - 4]
mov byte [esi + 0x114], 0
xor ecx, ebp
pop esi
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
Function at 0x53d3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x80
xor edx, edx
mov ecx, 0x20
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x684850
lea edi, [edx + 0x1f]
mov esi, eax
sub ebx, eax
nop dword [eax]
mov ecx, dword [ebx + esi]
lea esi, [esi + 4]
add ecx, dword [esi - 4]
add edx, ecx
movzx ecx, dl
shr edx, 8
mov dword [esi - 4], ecx
sub edi, 1
jne 0x53d3f0
lea ecx, [edx + 0x80]
add dword [eax + 0x7c], ecx
lea edx, [ebp - 0x80]
mov ecx, dword [eax + 0x7c]
lea esi, [ebp - 0x70]
shr ecx, 7
sub edx, eax
and ecx, 1
neg ecx
sub esi, eax
movd xmm0, ecx
lea ecx, [edi + 4]
pshufd xmm2, xmm0, 0
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax - 0x20]
movups xmm0, xmmword [edx + eax - 0x20]
pxor xmm0, xmm1
pand xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm1, xmmword [eax - 0x10]
movups xmm0, xmmword [esi + eax - 0x20]
pxor xmm0, xmm1
pand xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
sub ecx, 1
jne 0x53d433
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53d880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
dec eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
movd xmm0, eax
lea edx, [ebx + 0xfc]
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0xfc]
cmp ebx, eax
pshufd xmm3, xmm0, 0
mov eax, dword [ebp + 0x14]
ja 0x53d8b9
cmp edx, esi
jae 0x53d8f1
lea ecx, [eax + 0xfc]
cmp ebx, ecx
ja 0x53d8c7
cmp edx, eax
jae 0x53d8f1
lea ecx, [edi + 0xfc]
cmp ebx, ecx
ja 0x53d8d5
cmp edx, edi
jae 0x53d8f1
lea edx, [esi + 0xfc]
cmp edi, edx
ja 0x53d8e3
cmp ecx, esi
jae 0x53d8f1
lea edx, [eax + 0xfc]
cmp edi, edx
ja 0x53d92b
cmp ecx, eax
jb 0x53d92b
sub edi, eax
mov dword [ebp + 0x18], 0x40
sub esi, eax
sub ebx, eax
nop
mov ecx, dword [eax]
lea eax, [eax + 4]
mov edx, dword [eax + esi - 4]
xor edx, ecx
and edx, dword [ebp - 4]
xor ecx, edx
mov dword [eax + edi - 4], ecx
mov ecx, dword [eax + esi - 4]
xor ecx, edx
sub dword [ebp + 0x18], 1
mov dword [eax + ebx - 4], ecx
jne 0x53d900
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, edi
mov dword [ebp + 0x18], esi
sub dword [ebp + 0x18], eax
lea ecx, [eax + 0x10]
mov edi, ebx
mov dword [ebp - 4], 8
sub edi, eax
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
sub edi, esi
sub ebx, esi
sub dword [ebp - 4], 1
lea esi, [esi + 0x20]
movups xmm1, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm0, xmmword [esi - 0x20]
movaps xmm2, xmm1
pxor xmm2, xmm0
pand xmm2, xmm3
movaps xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [edi + esi - 0x20], xmm0
movups xmm0, xmmword [esi - 0x20]
pxor xmm2, xmm0
movups xmmword [ebx + esi - 0x20], xmm2
movups xmm1, xmmword [ecx - 0x20]
movups xmm0, xmmword [eax + ecx - 0x20]
movaps xmm2, xmm1
pxor xmm2, xmm0
pand xmm2, xmm3
movaps xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [edx + ecx - 0x20], xmm0
movups xmm0, xmmword [eax + ecx - 0x20]
mov eax, dword [ebp - 8]
pxor xmm2, xmm0
movups xmmword [eax + ecx - 0x20], xmm2
mov eax, dword [ebp + 0x18]
jne 0x53d950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53de70
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x20
push dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [ebp - 5]
add esp, 0xc
and byte [ebp - 0x24], 0xf8
and al, 0x3f
mov edx, dword [ebp + 0x10]
or al, 0x40
mov byte [ebp - 5], al
xor ecx, ecx
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
mov dword [ebp + ecx*4 - 0x1a4], eax
inc ecx
cmp ecx, 0x20
jb 0x53deb0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.0053df40
lea eax, [ebp - 0x124]
push eax
push eax
call fcn.0053d9d0
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0053d480
lea eax, [ebp - 0xa4]
push eax
call fcn.0053d3c0
add esp, 0x20
xor eax, eax
nop dword [eax]
mov cl, byte [ebp + eax*4 - 0xa4]
mov byte [esi + eax], cl
inc eax
cmp eax, 0x20
jb 0x53df10
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005ebe04
mov esp, ebp
pop ebp
ret

Function at 0x53eab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x7c]
lea esi, [edi + 0x74]
mov ebx, eax
mov dword [ebp - 4], eax
xor ebx, 0x7f
mov edi, 5
dec ebx
shr ebx, 0x1f
mov ecx, dword [esi - 0x10]
lea esi, [esi - 0x18]
mov eax, dword [esi + 0xc]
xor ecx, 0xff
xor eax, 0xff
mov edx, dword [esi + 0x1c]
dec eax
dec ecx
shr eax, 0x1f
xor edx, 0xff
shr ecx, 0x1f
dec edx
and ecx, eax
shr edx, 0x1f
mov eax, dword [esi + 0x10]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [esi + 0x14]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [esi + 0x18]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
and ecx, edx
and ebx, ecx
sub edi, 1
jne 0x53ead1
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edi]
sub ecx, 0xed
not ecx
shr ecx, 0x1f
and ecx, ebx
not ecx
inc ecx
mov eax, ecx
and eax, 0x7f
sub edx, eax
mov eax, 0x1e
mov dword [edi + 0x7c], edx
movzx edx, cl
nop dword [eax]
sub dword [edi + eax*4], edx
dec eax
test eax, eax
jg 0x53eb60
and ecx, 0xed
sub dword [edi], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x540550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov ecx, dword [ebp + 8]
xor edx, edx
push ebx
push esi
mov ebx, 0x6848d0
lea eax, [ecx + 8]
sub ebx, ecx
mov dword [ebp - 0xc], eax
mov esi, eax
push edi
mov eax, 0x6848d4
xor edi, edi
sub eax, ecx
mov dword [ebp - 8], eax
mov eax, ebx
nop dword [eax + eax]
add edx, dword [edi*4 + 0x6848d0]
lea esi, [esi + 0x10]
mov ebx, dword [esi - 0x18]
movzx ecx, byte [esi - 0x18]
sub ebx, edx
sub cl, dl
shr ebx, 0x1f
add ebx, dword [edi*4 + 0x6848d4]
mov edx, dword [esi - 0x14]
mov byte [ebp + edi - 0x2c], cl
sub edx, ebx
movzx ecx, byte [esi - 0x14]
sub cl, bl
shr edx, 0x1f
add edx, dword [eax + esi - 0x10]
mov ebx, dword [esi - 0x10]
mov byte [ebp + edi - 0x2b], cl
sub ebx, edx
movzx ecx, byte [esi - 0x10]
sub cl, dl
shr ebx, 0x1f
mov edx, dword [esi - 0xc]
mov byte [ebp + edi - 0x2a], cl
mov ecx, dword [ebp - 8]
add ebx, dword [ecx + esi - 0x10]
movzx ecx, byte [esi - 0xc]
sub edx, ebx
sub cl, bl
shr edx, 0x1f
mov byte [ebp + edi - 0x29], cl
add edi, 4
cmp edi, 0x20
jl 0x540580
mov eax, dword [ebp - 0xc]
lea esi, [edx - 1]
xor edi, edi
movzx edx, byte [ebp + edi - 0x2b]
lea eax, [eax + 0x10]
xor edx, dword [eax - 0x14]
movzx ecx, byte [ebp + edi - 0x2c]
and edx, esi
xor dword [eax - 0x14], edx
movzx edx, byte [ebp + edi - 0x2a]
xor edx, dword [eax - 0x10]
xor ecx, dword [eax - 0x18]
and edx, esi
xor dword [eax - 0x10], edx
and ecx, esi
movzx edx, byte [ebp + edi - 0x29]
add edi, 4
xor edx, dword [eax - 0xc]
xor dword [eax - 0x18], ecx
and edx, esi
xor dword [eax - 0xc], edx
cmp edi, 0x20
jl 0x5405f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x540640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
add esi, 2
mov edi, 0x1f
sub ebx, edx
nop dword [eax]
mov cl, byte [ebx + edx]
lea edx, [edx + 4]
mov al, byte [edx - 4]
lea esi, [esi + 4]
and cl, 3
and al, 3
shl cl, 2
xor cl, al
mov byte [esi - 6], cl
mov ecx, dword [ebx + edx - 4]
mov eax, dword [edx - 4]
shr ecx, 2
and cl, 3
shr eax, 2
shl cl, 2
and al, 3
xor cl, al
mov byte [esi - 5], cl
mov ecx, dword [ebx + edx - 4]
mov eax, dword [edx - 4]
shr ecx, 4
and cl, 3
shr eax, 4
shl cl, 2
and al, 3
xor cl, al
mov byte [esi - 4], cl
mov ecx, dword [ebx + edx - 4]
mov eax, dword [edx - 4]
shr ecx, 6
and cl, 3
shr eax, 6
shl cl, 2
and al, 3
xor cl, al
mov byte [esi - 3], cl
sub edi, 1
jne 0x540660
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov cl, byte [ebx + 0x7c]
mov al, byte [edi + 0x7c]
and cl, 3
shl cl, 2
and al, 3
xor cl, al
mov byte [edx + 0x7c], cl
mov ecx, dword [ebx + 0x7c]
mov eax, dword [edi + 0x7c]
shr ecx, 2
and cl, 3
shr eax, 2
shl cl, 2
and al, 3
xor cl, al
mov byte [edx + 0x7d], cl
mov ecx, dword [ebx + 0x7c]
mov eax, dword [edi + 0x7c]
shr ecx, 4
and cl, 3
shr eax, 4
pop edi
shl cl, 2
and al, 3
xor cl, al
pop esi
mov byte [edx + 0x7e], cl
pop ebx
pop ebp
ret
Function at 0x586160
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0
push 0x14
call fcn.0055b3e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x58618c
mov eax, 7
jmp 0x586236
movzx ecx, byte [0x6b2d54]
test ecx, ecx
je 0x5861a8
push 0xc8
call fcn.00564f50
add esp, 4
test eax, eax
je 0x5861ba
push 0x14
push 0
mov edx, dword [ebp - 4]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x586207
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x5965b0
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x586207
push 0x14
push 0
mov eax, dword [ebp - 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x58622c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x10]
push eax
call dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret