joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5471b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x547289
mov esi, dword [esp + 0x10]
test esi, esi
je 0x54723e
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.004f5000
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x547212
call fcn.004bef90
push str.ossl_ecx_key_op
push 0xaa
push str.cryptoececx_backend.c
call fcn.004bf090
push 0
push 0x66
push 0x10
call fcn.004bf140
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.004c4650
add esp, 4
test esi, esi
jne 0x547229
mov esi, eax
jmp 0x547242
cmp esi, eax
je 0x547242
call fcn.004bef90
push str.ossl_ecx_key_op
push 0xb0
jmp 0x5471f4
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x547275
test esi, esi
je 0x547275
cmp esi, 0x40a
je 0x54726a
cmp esi, 0x43f
je 0x54726a
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x54726f
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x54728d
call fcn.004bef90
push str.ossl_ecx_key_op
push 0xb6
jmp 0x5471f4
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x5472b1
cmp esi, 0x43f
je 0x5472b1
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x5472c1
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.004de6c0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x54730b
call fcn.004bef90
push str.ossl_ecx_key_op
push 0xbd
push str.cryptoececx_backend.c
call fcn.004bf090
push ebx
push 0xc0100
push 0x10
call fcn.004bf140
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x547327
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.00611b10
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.004de640
mov edi, eax
add esp, 4
test edi, edi
jne 0x54735a
call fcn.004bef90
push str.ossl_ecx_key_op
push 0xc7
push str.cryptoececx_backend.c
call fcn.004bf090
push edi
push 0xc0100
jmp 0x547430
cmp ebp, 2
jne 0x5473cc
test esi, esi
je 0x5473ff
cmp esi, 0x40a
je 0x547387
cmp esi, 0x43f
je 0x547387
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x54738c
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.004b8da0
add esp, 0x10
test eax, eax
jle 0x54743a
cmp esi, 0x40a
jne 0x5473bb
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x5473ff
cmp esi, 0x40b
jne 0x5473ff
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x5473ff
cmp esi, 0x40a
je 0x5473ec
cmp esi, 0x43f
je 0x5473ec
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5473f1
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.00611b10
add esp, 0xc
push ebx
call fcn.00547450
add esp, 4
test eax, eax
jne 0x547320
call fcn.004bef90
push str.ossl_ecx_key_op
push 0xdb
push str.cryptoececx_backend.c
call fcn.004bf090
push 0
push 0xa6
push 0x10
call fcn.004bf140
add esp, 0x18
push ebx
call fcn.004de660
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x54be40
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.0060ff70
mov eax, dword [0x6ed0a4]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.004aa120
mov edi, eax
add esp, 0xc
test edi, edi
je 0x54bec2
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.004a9430
push edi
mov esi, eax
call fcn.004aa150
add esp, 0x1c
test esi, esi
jne 0x54bedc
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0060f4a4
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0054b680
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0054b600
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0060f4a4
add esp, 0xe4
ret
Function at 0x54bf50
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.0060ff70
mov eax, dword [0x6ed0a4]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.004aa120
add esp, 0xc
mov edi, eax
call fcn.004a9f80
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x54c15e
test esi, esi
je 0x54c15e
push 0
push edi
push esi
call fcn.004a9890
add esp, 0xc
test eax, eax
je 0x54c15e
push 0x20
push ebx
push esi
call fcn.004a98d0
add esp, 0xc
test eax, eax
je 0x54c15e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.004a9760
add esp, 0xc
test eax, eax
je 0x54c15e
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.004a9890
add esp, 0xc
test eax, eax
je 0x54c15e
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.004a98d0
add esp, 0xc
test eax, eax
je 0x54c15e
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.004a98d0
add esp, 0xc
test eax, eax
je 0x54c15e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.004a9760
add esp, 0xc
test eax, eax
je 0x54c15e
lea eax, [esp + 0x100]
push eax
call fcn.00550be0
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0054b680
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.0054b600
push 0
push edi
push esi
call fcn.004a9890
add esp, 0x20
test eax, eax
je 0x54c15e
push 0x20
push ebp
push esi
call fcn.004a98d0
add esp, 0xc
test eax, eax
je 0x54c15e
push 0x20
push dword [esp + 0x20]
push esi
call fcn.004a98d0
add esp, 0xc
test eax, eax
je 0x54c15e
push ebx
push dword [esp + 0x14]
push esi
call fcn.004a98d0
add esp, 0xc
test eax, eax
je 0x54c15e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.004a9760
add esp, 0xc
test eax, eax
je 0x54c15e
lea eax, [esp + 0x140]
push eax
call fcn.00550be0
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0054c680
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00401320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.004aa150
push esi
call fcn.004a9ef0
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0060f4a4
add esp, 0x174
ret
Function at 0x56fca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0060ff70
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x56fce8
call fcn.004bef90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004bf090
push 0
push 0x78
push 4
call fcn.004bf140
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.0056f9f0
add esp, 4
test eax, eax
jne 0x56fd24
call fcn.004bef90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.004bf090
push 0
push 0xb2
push 4
call fcn.004bf140
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004e7e20
push esi
call fcn.004e7bd0
push esi
mov dword [esp + 0x2c], eax
call fcn.004e7bd0
push esi
mov ebp, eax
call fcn.004e7bd0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x56fe86
test ebp, ebp
je 0x56fe5d
test ebx, ebx
je 0x56fe54
push 4
push ebp
call fcn.004a6280
push 4
push ebx
call fcn.004a6280
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x56fd8e
call fcn.004a6150
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x56fd9c
call fcn.004a6150
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x56fe50
cmp dword [esi + 0x24], 0
je 0x56fe50
push 4
push eax
call fcn.004a6280
push 4
push dword [esi + 0x24]
call fcn.004a6280
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.005c0e20
add esp, 0x3c
test eax, eax
je 0x56fe50
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.005c0e20
add esp, 0x2c
test eax, eax
je 0x56fe50
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.0056f980
add esp, 0x10
test eax, eax
js 0x56fe50
je 0x56fdf0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.0056f980
add esp, 0x10
test eax, eax
js 0x56fe50
je 0x56fdf0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.004a5850
add esp, 4
test ebx, ebx
je 0x56fe6a
push ebx
call fcn.004a5850
add esp, 4
push dword [esp + 0x20]
call fcn.004a5850
push esi
call fcn.004e7ad0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x56fe5d
jmp 0x56fe54
Function at 0x57d1c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0060ff70
cmp dword [esp + 0xc], 0
push ebp
push esi
push edi
je 0x57d374
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
inc eax
push esi
push ebp
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push edi
push dword [esp + 0x2c]
call fcn.0057cff0
add esp, 0x1c
test eax, eax
je 0x57d39c
push ebx
push 0x184
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.004a1ac0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x57d25a
call fcn.004bef90
push str.tls1_prf_alg
push 0x185
push str.providersimplementationskdfs_tls1_prf.c
call fcn.004bf090
push ebx
push 0xc0100
push 0x39
call fcn.004bf140
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x10]
sub edi, eax
add edi, dword [esp + 0x24]
push esi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call fcn.0057cff0
add esp, 0x1c
test eax, eax
jne 0x57d29c
push 0x18b
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.004a1ba0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
xor edi, edi
test esi, esi
je 0x57d355
cmp esi, 0x40
jb 0x57d33a
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, esi
cmp ebp, eax
ja 0x57d2c1
cmp ecx, ebx
jae 0x57d33a
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, ebx
lea ecx, [ebx + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, edx
jb 0x57d2e0
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x1c], edi
cmp edi, esi
jae 0x57d355
lea ecx, [edi + ebp]
mov edx, esi
mov ebp, ebx
sub ebp, dword [esp + 0x30]
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x57d347
push 0x190
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.004a1ba0
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x2c]
call fcn.0057cff0
add esp, 0x1c
test eax, eax
jne 0x57d3a3
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x583bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x583c33
mov edx, dword [esp + 0x10]
test edx, edx
je 0x583c33
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0x14]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x583c03
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x583bf0
mov eax, dword [ebx + 0x14]
pop esi
cmp edx, eax
jbe 0x583c31
sub edx, eax
cmp edx, 0x10
jbe 0x583c15
mov edx, 0x10
jmp 0x583c19
test edx, edx
je 0x583c31
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x583c20
pop edi
pop ebx
pop ebp
ret
Function at 0x583eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0060ff70
mov eax, dword [0x6ed0a4]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x88]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x583f10
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x583f37
lea edi, [edx + 0x20]
jmp 0x583f62
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x583f41
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.0050b410
add esp, 0x14
test eax, eax
je 0x584079
cmp dword [esp + 0x14], edi
jne 0x584079
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.00611b10
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x58400f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x583fcf
test ecx, ecx
jne 0x583fcf
test eax, eax
je 0x583ff2
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.00583c40
add esp, 0x1c
test eax, eax
je 0x584079
test edi, edi
je 0x584032
mov eax, dword [esp + 0x1c]
push dword [eax + 0x80]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.00583bc0
add esp, 0xc
jmp 0x584032
push dword [esp + 0x90]
push ebp
push esi
call fcn.00583bc0
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00583bc0
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.0050b3e0
add esp, 0x18
test eax, eax
je 0x584079
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.0050b3e0
add esp, 0x18
test eax, eax
je 0x584079
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0060f4a4
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0060f4a4
add esp, 0x74
ret
Function at 0x587340
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x58734d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.004de6c0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x587394
call fcn.004bef90
push str.ecx_gen
push 0x247
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.004bf090
push edi
push 0xc0100
push 0x39
call fcn.004bf140
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x5873df
push esi
push edi
call fcn.004de640
mov esi, eax
add esp, 4
test esi, esi
jne 0x5873e2
call fcn.004bef90
push str.ecx_gen
push 0x250
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.004bf090
push esi
push 0xc0100
push 0x39
call fcn.004bf140
add esp, 0x18
push edi
call fcn.004de660
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.004b8da0
add esp, 0x10
test eax, eax
jle 0x5873d3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x5873fe
jmp dword [eax*4 + 0x58747c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.0054c480
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.00555730
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.0054be40
jmp 0x587467
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.00553b20
add esp, 0x10
test eax, eax
je 0x5873d3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x5a6c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.0060ff70
mov eax, dword [0x6ed0a4]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
push esi
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
jns 0x5a6c91
mov dword [ecx], 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0060f4a4
add esp, 0x28
ret
push ebx
movzx ebx, byte [eax]
push ebp
lea ebp, [eax + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x10], ebx
movzx eax, byte [edx + 6]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x28]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2b], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x5a6e00
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x5a6da8
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.005a6230
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x5a6d43
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x5a6e00
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 6], dl
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.0060f4a4
add esp, 0x28
ret
Function at 0x5aa9e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0060ff70
mov eax, dword [esp + 0x2c]
push esi
mov esi, dword [eax]
test esi, esi
jns 0x5aaa00
mov dword [eax], 0xffffffff
pop esi
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
test esi, esi
je 0x5aaa2c
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x5aaa2c
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x5aaa17
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x5aaac5
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x5aaa74
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x5aaaa7
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x5aaa95
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x5aaa70
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x5aaaf7
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push eax
push eax
call edx
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x5aaae5
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [eax], esi
pop esi
add esp, 0x14
ret