joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd070
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.00457070
add esp, 8
test esi, esi
jg 0x4bd0c7
je 0x4bd0a9
cmp esi, 0xffffffff
jne 0x4bd0c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004bd400
add esp, 4
test eax, eax
je 0x4bd0c7
push 0xa
push edi
call fcn.00457ef0
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x4bd500
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.0057a390
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x4bd548
call fcn.004650f0
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.00465140
push 0
push 0x87
push 0x20
call fcn.00465170
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.00476290
add esp, 8
test eax, eax
jne 0x4bd567
pop ebx
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4bd5e2
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x4bd5e2
call fcn.004650f0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.00465140
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00465170
call fcn.004650f0
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.00465140
push 0
push 0x89
push 0x20
call fcn.00465170
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
test bl, 0x10
je 0x4bd653
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x4bd653
call fcn.004650f0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.00465140
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00465170
call fcn.004650f0
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.00465140
push 0
push 0x8a
push 0x20
call fcn.00465170
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.004774f0
add esp, 4
push eax
push esi
call fcn.004774e0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4bd6e1
push eax
call fcn.004bd4c0
add esp, 4
test eax, eax
jne 0x4bd6da
call fcn.004650f0
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.00465140
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00465170
call fcn.004650f0
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.00465140
push 0
push 0x67
push 0x20
call fcn.00465170
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x4da1d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x4da212
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
add edi, esi
add ebx, esi
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x4da1f1
pop edi
pop ebx
pop esi
ret

Function at 0x4e9980
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x4ecb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0057a390
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x4ecb68
call fcn.004650f0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00465140
push 0
push 0x78
push 4
call fcn.00465170
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.004ec870
add esp, 4
test eax, eax
jne 0x4ecba4
call fcn.004650f0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00465140
push 0
push 0xb2
push 4
call fcn.00465170
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004bc410
push esi
call fcn.004bc2f0
push esi
mov dword [esp + 0x2c], eax
call fcn.004bc2f0
push esi
mov ebp, eax
call fcn.004bc2f0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x4eccd4
test ebp, ebp
je 0x4ecce1
test ebx, ebx
je 0x4eccd4
push 4
push ebp
call fcn.0046efe0
push 4
push ebx
call fcn.0046efe0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x4ecc0e
call fcn.0046eeb0
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x4ecc1c
call fcn.0046eeb0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4eccd0
cmp dword [esi + 0x24], 0
je 0x4eccd0
push 4
push eax
call fcn.0046efe0
push 4
push dword [esi + 0x24]
call fcn.0046efe0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00539330
add esp, 0x3c
test eax, eax
je 0x4eccd0
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00539330
add esp, 0x2c
test eax, eax
je 0x4eccd0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.004ec800
add esp, 0x10
test eax, eax
js 0x4eccd0
je 0x4ecc70
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.004ec800
add esp, 0x10
test eax, eax
js 0x4eccd0
je 0x4ecc70
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
test ebp, ebp
je 0x4ecce1
push ebp
call fcn.0046e7b0
add esp, 4
test ebx, ebx
je 0x4eccee
push ebx
call fcn.0046e7b0
add esp, 4
push dword [esp + 0x20]
call fcn.0046e7b0
push esi
call fcn.004bc260
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x4f4fd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0057a390
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax + 0x64]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [ecx + 0x70]
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x4f5036
test edi, edi
je 0x4f5016
nop
cmp edx, 0x40
jae 0x4f5016
mov al, byte [edx + ecx + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
sub edi, 1
jne 0x4f5000
mov dword [ecx + 0x70], edx
test edi, edi
je 0x4f50ec
cmp edx, 0x40
jne 0x4f5036
mov dword [ecx + 0x70], 0
add dword [ecx + 0x20], 1
jne 0x4f5036
inc dword [ecx + 0x24]
mov eax, edi
lea edx, [ecx + 0x20]
and eax, 0x3f
mov dword [esp + 0x14], edx
sub edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push esi
cmp edi, 0x40
jb 0x4f5099
mov esi, edi
shr esi, 6
add eax, esi
mov dword [esp + 0x14], eax
cmp eax, esi
jae 0x4f5069
sub esi, eax
mov dword [esp + 0x14], 0
push edx
push ecx
shl esi, 6
push esi
push ebx
push ebp
call fcn.00444c00
mov edx, dword [esp + 0x2c]
add esp, 0x14
mov eax, dword [esp + 0x14]
sub edi, esi
mov ecx, dword [esp + 0x20]
add ebx, esi
add ebp, esi
mov dword [edx], eax
test eax, eax
jne 0x4f5094
inc dword [ecx + 0x24]
cmp edi, 0x40
jae 0x4f5050
cmp dword [esp + 0x10], 0
je 0x4f50eb
push 0x40
lea edi, [ecx + 0x30]
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x24]
mov esi, dword [esp + 0x30]
push esi
push 0x40
push edi
push edi
call fcn.00444c00
mov eax, dword [esp + 0x30]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x4f50e8
sub ebx, ebp
mov esi, eax
lea ecx, [edx + ebp]
mov al, byte [ebx + ecx]
xor al, byte [edi + edx]
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x4f50d0
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], eax
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4f8c30
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.0045ffc0
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4f8c74
push 0
push 0
push edi
push 0x4f8c90
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4f8c74
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.0045fdf0
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x50d990
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057a390
cmp dword [esp + 0xc], 0
je 0x50dacd
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
inc eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x30]
push edi
push esi
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push ebp
push dword [esp + 0x2c]
call fcn.0050d7c0
add esp, 0x1c
test eax, eax
jne 0x50d9e0
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push 0x1b8
push str.providersimplementationskdfs_tls1_prf.c
push edi
call fcn.0045fd70
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x50da34
mov eax, dword [esp + 0x10]
sub ebp, eax
add ebp, dword [esp + 0x24]
push edi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push ebp
push dword [esp + 0x34]
call fcn.0050d7c0
add esp, 0x1c
test eax, eax
jne 0x50da3c
push 0x1bd
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.0045fe80
add esp, 0x10
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
xor edx, edx
test edi, edi
je 0x50daae
cmp edi, 0x20
jb 0x50da8f
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x50da59
cmp ecx, ebx
jae 0x50da8f
mov ecx, edi
mov ebp, ebx
and ecx, 0xffffffe0
mov eax, esi
sub ebp, esi
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x50da64
cmp edx, edi
jae 0x50daae
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
mov esi, edi
sub esi, edx
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x50daa0
push 0x1c2
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.0045fe80
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x20]
call fcn.0050d7c0
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop ecx
ret
Function at 0x5159b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
xor esi, esi
lea ecx, [edx + 0x3f8]
push edi
lea edi, [eax + 0x3f8]
cmp eax, ecx
ja 0x5159ef
cmp edi, edx
jb 0x5159ef
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x5159d7
pop edi
pop esi
ret
mov edi, edx
lea ecx, [eax + 0x10]
sub edi, eax
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [edx + esi*8]
add esi, 4
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [edi + ecx - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp esi, 0x80
jl 0x515a00
pop edi
pop esi
ret

Function at 0x517b80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x517be3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x517be3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi + 0x14]
cmp edx, ebx
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x517bb1
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x1c], al
inc ecx
cmp ecx, ebx
jb 0x517ba5
mov eax, dword [edi + 0x14]
cmp edx, eax
jbe 0x517be1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor eax, eax
test edx, edx
je 0x517be1
nop word [eax + eax]
mov ecx, dword [edi + 0x14]
add ecx, eax
mov cl, byte [ecx + esi]
xor byte [edi + eax + 0x3c], cl
inc eax
cmp eax, edx
jb 0x517bd0
pop edi
pop ebx
pop esi
ret
Function at 0x517e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0057a390
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x80]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], eax
mov eax, dword [esp + 0x94]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x14], ecx
mov ecx, 1
push edi
mov dword [esp + 0x14], eax
movups xmmword [esp + 0x1c], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x517e60
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x2c], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x517e86
mov al, 0x20
jmp 0x517eae
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x517e90
movups xmm0, xmmword [esi + 0x3c]
mov al, 0x30
movups xmmword [esp + 0x3c], xmm0
movzx edi, al
lea eax, [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x58]
push eax
push dword [esi]
call fcn.004533c0
add esp, 0x14
test eax, eax
je 0x517fde
cmp dword [esp + 0x10], edi
jne 0x517fde
push ebx
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x517f5f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x517f1f
test ecx, ecx
jne 0x517f1f
test eax, eax
je 0x517f42
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.00517bf0
add esp, 0x1c
test eax, eax
je 0x517fc9
test edi, edi
je 0x517f82
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.00517b80
add esp, 0xc
jmp 0x517f82
push dword [esp + 0x90]
push ebp
push esi
call fcn.00517b80
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00517b80
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.00453390
add esp, 0x18
test eax, eax
je 0x517fc9
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.00453390
add esp, 0x18
test eax, eax
je 0x517fc9
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00579fe8
add esp, 0x74
ret
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00579fe8
add esp, 0x74
ret
mov ecx, dword [esp + 0x7c]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00579fe8
add esp, 0x74
ret
Function at 0x51b692
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x51b5ad
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.00488df0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x51b5f4
call fcn.004650f0
push str.ecx_gen
push 0x258
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.00465140
push edi
push 0x80010
push 0x39
call fcn.00465170
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x51b63f
push esi
push edi
call fcn.00488d80
mov esi, eax
add esp, 4
test esi, esi
jne 0x51b642
call fcn.004650f0
push str.ecx_gen
push 0x261
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.00465140
push esi
push 0x80010
push 0x39
call fcn.00465170
add esp, 0x18
push edi
call fcn.00488da0
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x51b66f
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x51b66f
mov edx, dword [ebx + 8]
cmp edx, 2
je 0x51b633
cmp edx, 3
je 0x51b633
push ecx
push eax
push esi
push edi
call fcn.00526dc0
add esp, 0x10
test eax, eax
je 0x51b633
jmp 0x51b683
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.00458700
add esp, 0x10
test eax, eax
jle 0x51b633
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x51b68b
jmp dword [eax*4 + 0x51b70c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.004ac1c0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.004b5240
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004abb00
jmp 0x51b6f4
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004b3a20
add esp, 0x10
test eax, eax
je 0x51b633
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x526dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.0057a390
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x58]
mov edx, str.X25519
mov eax, dword [esp + 0x5c]
push ebx
push ebp
push esi
mov dword [esp + 0x18], eax
xor ebx, ebx
mov eax, dword [esp + 0x6c]
push edi
mov dword [esp + 0x18], eax
xor edi, edi
cmp dword [ecx + 0x50], ebx
mov eax, str.X448
mov dword [esp + 0x14], ecx
cmove eax, edx
push eax
call fcn.004fdde0
mov ebp, dword [esp + 0x78]
mov esi, eax
add esp, 4
cmp ebp, dword [esi + 0x1c]
jae 0x526e4f
call fcn.004650f0
push str.ossl_ecx_dhkem_derive_private
push 0x15d
push str.providersimplementationskemecx_kem.c
call fcn.00465140
push dword [esi + 0x1c]
push ebp
push str.ikm_length_is_:_zu__should_be_at_least__zu
push 0xe6
push 0x39
call fcn.00465170
add esp, 0x20
jmp 0x526ef6
mov eax, dword [esp + 0x14]
push dword [eax + 4]
push dword [eax]
push dword [esi + 0xc]
push str.HKDF
call fcn.004fe240
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x526e81
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00579fe8
add esp, 0x54
ret
movzx eax, byte [esi + 1]
push ebp
push dword [esp + 0x1c]
mov byte [esp + 0x18], al
movzx eax, byte [esi]
push str.dkp_prk
push 2
mov byte [esp + 0x21], al
lea eax, [esp + 0x20]
push eax
push 0x5da908
push 0
push 0
push dword [esi + 0x10]
lea eax, [esp + 0x44]
push eax
push edi
call fcn.004fe090
add esp, 0x2c
test eax, eax
je 0x526ef6
push 0
push 0
push 0x5da9f4
push 2
lea eax, [esp + 0x20]
push eax
push 0x5da908
push dword [esi + 0x10]
lea eax, [esp + 0x3c]
push eax
push dword [esi + 0x1c]
push dword [esp + 0x40]
push edi
call fcn.004fdec0
add esp, 0x2c
mov ecx, 1
test eax, eax
cmovne ebx, ecx
lea eax, [esp + 0x20]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.004e3890
mov ecx, dword [esp + 0x6c]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00579fe8
add esp, 0x54
ret
Function at 0x53f190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.0057a390
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
test esi, esi
jns 0x53f1e1
mov dword [eax], 0xffffffff
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00579fe8
add esp, 0x2c
ret
push ebx
movzx ebx, byte [ecx]
push ebp
lea ebp, [ecx + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov byte [esp + 0x2b], bl
movzx eax, byte [edx + 6]
mov dword [esp + 0x10], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x10], ebx
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x53f350
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x40]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x48], eax
test esi, esi
jne 0x53f2f8
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.0053e760
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x53f293
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x53f350
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.00579fe8
add esp, 0x2c
ret
Function at 0x53f370
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, 0x400
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, 0x80
mov esi, edx
mov ecx, edi
mov byte [ebp], 0
cmp dword [esp + 0x18], ecx
cmovle ecx, dword [esp + 0x18]
test eax, eax
cmovg esi, eax
cmp esi, edx
cmovg esi, edx
mov dword [esp + 0x14], esi
test ecx, ecx
jle 0x53f3c5
mov ebx, dword [esp + 0x1c]
mov edx, ebp
sub ebx, ebp
mov esi, ecx
mov al, byte [ebx + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x53f3b3
mov esi, dword [esp + 0x14]
movzx ebx, byte [ecx + ebp - 1]
cmp ecx, edi
jge 0x53f3ea
mov edx, ebp
movzx eax, byte [edx]
lea edx, [edx + 1]
add eax, ebx
movzx eax, al
movzx ebx, byte [eax + 0x5e6248]
mov byte [ecx + ebp], bl
inc ecx
cmp ecx, edi
jl 0x53f3d0
mov ecx, dword [esp + 0x14]
lea ebx, [esi + 7]
sar ebx, 3
neg ecx
sub edi, ebx
and ecx, 7
movzx eax, byte [edi + ebp]
lea esi, [edi + ebp]
mov edx, 0xff
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x5e6248]
mov byte [esi], cl
test edi, edi
je 0x53f438
nop dword [eax + eax]
movzx eax, byte [esi + ebx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x5e6248]
mov byte [esi], cl
sub edi, 1
jne 0x53f420
lea esi, [ebp + 0xfc]
mov edi, 0x40
lea edx, [ebp + 0x7e]
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
sub edi, 1
jne 0x53f446
pop edi
pop esi
pop ebp
pop ebx
ret