joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4567bc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [esp + 0x60]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
add eax, ecx
mov dword [esp + 0x30], edx
sub edx, ecx
mov dword [esp], ecx
mov dword [esp + 0x2c], eax
mov eax, 0x7fffffff
cmp edx, eax
cmovae edx, eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x28], edx
mov edi, dword [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edi
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0xc]
push 0
push dword [esp + 0x60]
call fcn.004565ca
pop eax
pop ecx
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x456971
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
test edx, edx
jne 0x45697a
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], esi
cmp eax, dword [esp]
jb 0x4569c0
cmp edi, 0xffffffff
je 0x4569c0
push 0
push dword [esp + 0x2c]
push dword [esp + 0x34]
push edi
call dword [sym.imp.ws2_32.dll_recv]
mov esi, eax
cmp eax, 0xffffffff
jne 0x45687c
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor esi, esi
cmp eax, 0x274a
jne 0x4568cc
mov byte [esp + 0x18], 4
mov dword [esp + 8], esi
mov eax, dword [esp + 0x18]
cmp al, 4
mov dword [esp + 4], eax
je 0x456990
mov ebx, eax
mov edi, eax
mov ebp, esi
lea ecx, [esp + 4]
call fcn.0045253c
cmp al, 0xd
jne 0x456985
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0x38]
call fcn.004560e8
movzx ecx, bl
mov edx, esi
call fcn.00425168
mov edi, dword [esp + 0x24]
jmp 0x456805
mov ebp, eax
and dword [esp + 0x18], 0
lea ecx, [esp + 0x18]
shl eax, 0x18
mov esi, ebp
mov dword [esp + 0x1c], ebp
shr esi, 8
shld esi, eax, 8
call fcn.0040294c
cmp al, 0xd
jne 0x45695f
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x456952
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
lock inc dword [eax]
jle 0x4569c0
add edx, 8
lea ecx, [esp + 0xc]
push dword [ebx + 0xc]
push dword [ebx + 8]
push eax
call fcn.00425ef8
add esp, 0xc
push 4
pop ecx
call fcn.00425415
cmp byte [esp + 0xc], 4
je 0x45695f
mov ebx, dword [esp + 0xc]
cmp bl, 4
je 0x45695f
mov ebp, dword [esp + 0x10]
xor ecx, ecx
mov edx, esi
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
call fcn.00425415
mov edi, ebx
mov esi, ebp
jmp 0x45689b
and dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
and dword [esp + 4], 0
xor edi, edi
mov dword [esp + 8], ebp
xor ebx, ebx
jmp 0x45689b
mov eax, dword [esp + 0x54]
mov byte [eax], 5
jmp 0x4569b8
mov eax, dword [esp + 0x54]
mov dword [eax], ecx
mov dword [eax + 4], esi
jmp 0x4569b8
mov eax, dword [esp + 0x54]
mov dword [eax], edi
mov dword [eax + 4], ebp
jmp 0x4569b8
mov edx, dword [esp + 0x60]
mov eax, dword [esp]
mov ecx, dword [edx + 0xc]
add eax, esi
cmp eax, ecx
jbe 0x4569a5
mov ecx, eax
mov dword [edx + 0xc], eax
add dword [esp], esi
jb 0x4569c0
cmp ecx, eax
jb 0x4569c0
mov dword [edx + 8], eax
mov eax, dword [esp + 0x54]
mov byte [eax], 4
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4569c2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x58]
mov esi, 0x7fffffff
mov edx, dword [ecx + 4]
mov ebp, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmp eax, esi
cmovb esi, eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x28]
mov ebx, esp
mov ecx, ebx
push dword [esp + 0x50]
call fcn.0045675f
pop eax
mov edx, dword [esp]
cmp edx, 2
je 0x456b3c
mov ecx, dword [esp + 4]
mov esi, dword [esp + 8]
test edx, edx
jne 0x456b45
cmp ebp, 0xffffffff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], esi
je 0x456b67
push 0
push dword [esp + 0x28]
push dword [esp + 0x5c]
push ebp
call dword [sym.imp.ws2_32.dll_send]
mov ecx, ebx
mov edx, eax
call fcn.00451b8d
cmp byte [esp], 4
jne 0x456a55
mov esi, dword [esp + 4]
jmp 0x456a60
mov eax, dword [esp]
mov esi, dword [esp + 4]
cmp al, 4
jne 0x456a82
mov byte [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x14]
cmp al, 4
mov dword [esp + 0xc], eax
je 0x456b55
mov ebx, eax
mov edi, eax
jmp 0x456b13
lea ecx, [esp + 0x14]
mov edi, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
call fcn.0040294c
cmp al, 0xd
jne 0x456b09
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x456afd
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
lock inc dword [eax]
jle 0x456b67
add edx, 8
mov ecx, esp
push dword [ebx + 0xc]
push dword [ebx + 8]
push eax
call fcn.00425ef8
add esp, 0xc
push 4
pop ecx
call fcn.00425415
cmp byte [esp], 4
je 0x456b09
mov ebx, dword [esp]
cmp bl, 4
je 0x456b09
mov eax, dword [esp + 4]
mov edx, esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov eax, edi
movzx ecx, al
call fcn.00425415
mov esi, dword [esp + 0x1c]
mov edi, ebx
jmp 0x456b13
and dword [esp + 4], 0
mov dword [esp], 4
mov ebx, edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0xc]
call fcn.0045253c
cmp al, 0xd
jne 0x456b4d
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x2c]
call fcn.004560e8
movzx ecx, bl
mov edx, esi
call fcn.00425168
jmp 0x4569f0
mov eax, dword [esp + 0x48]
mov byte [eax], 5
jmp 0x456b5f
mov eax, dword [esp + 0x48]
mov dword [eax], ecx
jmp 0x456b5c
mov eax, dword [esp + 0x48]
mov dword [eax], edi
jmp 0x456b5c
mov eax, dword [esp + 0x48]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x456b69
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x54]
lea ebx, [esp + 0xc]
mov ebp, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x30], edi
mov edx, ebp
mov ecx, ebx
push 1
push dword [esp + 0x5c]
call fcn.004565ca
pop eax
pop ecx
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x456d12
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
test edx, edx
jne 0x456d1b
cmp edi, 0xffffffff
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], esi
je 0x456d45
and dword [esp + 0x1c], 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x70]
push dword [esp + 0x70]
push edi
call dword [sym.imp.ws2_32.dll_WSASend]
mov ecx, ebx
mov edx, eax
mov edi, ebx
call fcn.00451b8d
cmp byte [esp + 0xc], 4
jne 0x456c26
mov byte [esp + 0x20], 4
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], esi
cmp bl, 4
mov eax, ebx
mov dword [esp + 4], ebx
mov byte [esp + 3], bl
jne 0x456ce1
jmp 0x456d33
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
cmp bl, 4
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov eax, ebx
mov byte [esp + 3], bl
je 0x456d2b
lea ecx, [esp + 0x20]
call fcn.0040294c
cmp al, 0xd
jne 0x456cd9
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x456cc8
mov eax, dword [ebp + 4]
mov edx, dword [ebp]
lock inc dword [eax]
jle 0x456d45
add edx, 8
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00425ef8
add esp, 0xc
push 4
pop ecx
call fcn.00425415
cmp byte [esp + 0xc], 4
je 0x456cd5
mov eax, dword [esp + 0xc]
mov ebp, dword [esp + 0x18]
cmp al, 4
je 0x456cd9
mov ecx, dword [esp + 0x10]
mov edx, esi
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 8], ecx
movzx ecx, byte [esp + 3]
call fcn.00425415
mov eax, esi
mov ebx, esi
mov esi, dword [esp + 0x28]
mov byte [esp + 3], al
jmp 0x456ce1
and dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov ebp, dword [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
lea ecx, [esp + 4]
call fcn.0045253c
cmp al, 0xd
jne 0x456d23
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x34]
call fcn.004560e8
movzx ecx, byte [esp + 3]
mov edx, esi
call fcn.00425168
mov ebx, edi
mov edi, dword [esp + 0x30]
jmp 0x456b8d
mov eax, dword [esp + 0x50]
mov byte [eax], 5
jmp 0x456d3d
mov eax, dword [esp + 0x50]
mov dword [eax], ecx
jmp 0x456d3a
mov eax, dword [esp + 0x50]
mov dword [eax], ebx
jmp 0x456d3a
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x50]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x45d300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x45d322
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x45f8e2
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov edx, ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, esi
push edi
push 8
sub edx, esi
pop edi
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x45f8f8
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp edi, 1
jbe 0x45f94b
lea eax, [edi - 1]
add ebp, 0x20
mov edi, eax
push esi
call fcn.0045ffce
push esi
call fcn.0045fee2
push esi
call fcn.0045fa6d
add esp, 0xc
mov ecx, ebx
mov eax, dword [ebp]
add ebp, 4
xor dword [esi + ecx*4], eax
inc ecx
cmp ecx, 8
jb 0x45f92f
sub edi, 1
jne 0x45f918
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
push esi
call fcn.0045ffce
push esi
call fcn.0045fee2
pop ecx
shl edi, 5
pop ecx
add edi, ebp
mov eax, dword [edi]
lea edi, [edi + 4]
xor dword [esi + ebx*4], eax
inc ebx
cmp ebx, 8
jb 0x45f95e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x45fca2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x48f034]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0xf0], 0xa
call fcn.0045f7b0
push 0x10
lea eax, [esp + 0x20]
push eax
push esi
call fcn.0046e6e0
xor edi, edi
lea ebx, [esi + 0x10]
add esp, 0x14
mov dword [esp + 0x10], ebx
inc edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0045ff51
movzx ebp, byte [edi + 0x487743]
xor ebx, ebx
pop ecx
pop ecx
mov edx, dword [esp + ebx*4 + 0x24]
mov cl, bl
mov eax, edx
add cl, cl
and eax, 0x3000000
shr edx, 8
or eax, edx
mov esi, ebp
shr eax, 0x12
shr esi, cl
and esi, 3
xor esi, eax
xor esi, dword [esp + ebx*4 + 0x14]
mov eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
cmp ebx, 4
jb 0x45fd05
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0x10
push eax
push ebx
call fcn.0046e6e0
add esp, 0xc
add ebx, 0x10
inc edi
mov dword [esp + 0x10], ebx
cmp edi, 0xa
jbe 0x45fceb
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ddb6
add esp, 0x28
ret
Function at 0x45fd78
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x48f034]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x4c]
push esi
push eax
mov dword [edi + 0xf0], 0xe
call fcn.0045f7b0
push 0x10
pop ebx
push ebx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.0046e6e0
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0045f7b0
push ebx
lea eax, [esp + 0x44]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0046e6e0
add esp, 0x28
add edi, 0x20
mov dword [esp + 0x10], edi
push 2
pop ebp
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0045ff51
mov eax, ebp
shr eax, 1
xor ebx, ebx
pop ecx
pop ecx
movzx edi, byte [eax + 0x487743]
mov edx, dword [esp + ebx*4 + 0x34]
mov cl, bl
mov eax, edx
add cl, cl
and eax, 0x3000000
shr edx, 8
or eax, edx
mov esi, edi
shr eax, 0x12
shr esi, cl
and esi, 3
xor esi, eax
xor esi, dword [esp + ebx*4 + 0x14]
mov eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
cmp ebx, 4
jb 0x45fdfe
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0x10
pop ebx
push ebx
push eax
push edi
call fcn.0046e6e0
add esp, 0xc
cmp ebp, 0xe
je 0x45fecf
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0045ff51
movups xmm3, xmmword [esp + 0x3c]
push 0x18
movups xmm0, xmmword [esp + 0x30]
pop eax
push 8
movd xmm4, eax
pop eax
psrld xmm3, xmm4
push ebx
xorps xmm3, xmm0
movd xmm0, eax
movaps xmm2, xmm3
pslld xmm2, xmm0
movaps xmm1, xmm3
movd xmm0, ebx
xorps xmm2, xmm3
lea eax, [esp + 0x30]
pslld xmm1, xmm0
pslld xmm3, xmm4
push eax
xorps xmm2, xmm1
lea eax, [edi + 0x10]
xorps xmm2, xmm3
push eax
movups xmmword [esp + 0x38], xmm2
call fcn.0046e6e0
add ebp, 2
add edi, 0x20
add esp, 0x14
mov dword [esp + 0x10], edi
cmp ebp, 0xe
jbe 0x45fde0
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ddb6
add esp, 0x38
ret
Function at 0x4604e5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x260
mov eax, dword [0x48f034]
xor eax, esp
mov dword [esp + 0x25c], eax
cmp dword [esp + 0x26c], 0
mov eax, dword [esp + 0x268]
mov ecx, dword [esp + 0x270]
push ebp
mov ebp, dword [esp + 0x268]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x278]
push edi
mov dword [esp + 8], ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
je 0x4606b1
push ebx
push esi
push ecx
lea eax, [esp + 0x50]
push eax
call fcn.0045f972
mov ebp, dword [esp + 0x1c]
lea esi, [esp + 0x234]
pop ecx
pop ecx
push 2
pop eax
mov ebx, eax
push 0x10
push ebp
push esi
call fcn.0046e6e0
add esp, 0xc
add esi, 0x10
sub ebx, 1
jne 0x460554
push 4
lea eax, [esp + 0x23c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0046e6e0
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x258]
sub dword [esp + 0x1c], eax
add esp, 0xc
sub dword [esp + 0x18], eax
bswap edi
mov dword [esp + 0x14], edi
push 2
xor esi, esi
lea ebx, [esp + 0x23c]
pop ebp
lea eax, [esi + edi]
bswap eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 4
push eax
push ebx
call fcn.0046e6e0
add esp, 0xc
add ebx, 0x10
inc esi
cmp esi, ebp
jb 0x4605a4
mov edi, dword [esp + 0x27c]
lea eax, [esp + 0x22c]
mov ebp, dword [esp + 0x10]
mov esi, edi
push 2
pop ebx
cmp edi, ebx
cmovae esi, ebx
push esi
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x28], esi
push eax
call fcn.0046029c
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x34]
push dword [eax + 0xf0]
lea eax, [esp + 0x60]
push eax
call fcn.0045f8e2
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x268]
push esi
push eax
call fcn.0045f9fb
add esp, 0x24
test esi, esi
je 0x46068b
mov edi, dword [esp + 0x18]
lea ebx, [esp + 0x24c]
mov dword [esp + 0x10], esi
push 4
pop esi
push 4
lea eax, [ebx + ebp]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0046e6e0
push 4
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.0046e6e0
mov eax, dword [esp + 0x40]
xor dword [esp + 0x34], eax
lea eax, [esp + 0x34]
push 4
push eax
lea eax, [edi + ebx]
push eax
call fcn.0046e6e0
add esp, 0x24
add ebx, 4
sub esi, 1
jne 0x460636
sub dword [esp + 0x10], 1
jne 0x460633
mov edi, dword [esp + 0x27c]
mov esi, dword [esp + 0x20]
push 2
pop ebx
sub edi, esi
mov dword [esp + 0x27c], edi
je 0x4606af
add dword [esp + 0x18], 0x20
add ebp, 0x20
add dword [esp + 0x14], ebx
mov edi, dword [esp + 0x14]
mov dword [esp + 0x10], ebp
jmp 0x460598
pop esi
pop ebx
mov ecx, dword [esp + 0x264]
pop edi
pop ebp
xor ecx, esp
call fcn.0046ddb6
add esp, 0x260
ret

Function at 0x46112f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
neg edx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0xa
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x461144
pop edi
pop esi
ret
Function at 0x461158
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
push 0xa
neg edi
sub esi, edx
pop ebx
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, edi
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x46116e
pop edi
pop esi
pop ebx
ret
Function at 0x4635cb
Capabilities:
Encrypt data using curve25519

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx + 0x1f]
and byte [ecx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ecx + 0x1f], al
ret
Function at 0x468885
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x91c
mov eax, dword [0x48f034]
xor eax, esp
mov dword [esp + 0x918], eax
push ebx
mov ebx, dword [esp + 0x92c]
push ebp
push esi
mov esi, dword [esp + 0x92c]
push edi
push 0xf
mov dword [esp + 0x18], esi
lea edi, [esp + 0x274]
pop ebp
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.0046257b
lea eax, [ebx + 0x20]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0046257b
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [edi - 0x50]
push eax
call fcn.00461099
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [edi - 0x28]
push eax
call fcn.0046273c
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004617a5
push 0x4877e0
push edi
push edi
call fcn.004617a5
add esp, 0x40
add ebx, 0x40
add edi, 0x78
sub ebp, 1
jne 0x4688b9
push esi
call fcn.0046106e
lea eax, [esi + 0x28]
push eax
call fcn.0046107f
lea eax, [esi + 0x50]
push eax
call fcn.0046107f
lea eax, [esi + 0x78]
push eax
call fcn.0046106e
add esp, 0x10
inc ebp
push 0x3f
pop eax
mov dword [esp + 0x10], eax
mov edx, eax
mov bl, al
shr edx, 3
xor bh, bh
xor edi, edi
and bl, 7
add edx, dword [esp + 0x934]
mov al, byte [edx]
mov cl, bl
shr al, cl
lea edx, [edx + 8]
and al, 1
mov ecx, edi
shl al, cl
or bh, al
inc edi
cmp edi, 4
jb 0x468963
push 0x28
xor esi, esi
lea eax, [esp + 0x10c]
push esi
push eax
call fcn.0046ec60
push 0x28
lea eax, [esp + 0x140]
mov dword [esp + 0x118], ebp
push esi
push eax
call fcn.0046ec60
push 0x28
lea eax, [esp + 0x174]
mov dword [esp + 0x14c], ebp
push esi
push eax
call fcn.0046ec60
add esp, 0x24
movsx esi, bh
lea edi, [esp + 0x270]
mov eax, esi
xor eax, ebp
lea ebx, [eax - 1]
not eax
shr eax, 0x1f
shr ebx, 0x1f
and bl, al
lea eax, [edi - 0x50]
neg bl
and ebx, 1
push ebx
push eax
lea eax, [esp + 0x110]
push eax
call fcn.0046112f
push ebx
lea eax, [edi - 0x28]
push eax
lea eax, [esp + 0x144]
push eax
call fcn.0046112f
push ebx
lea eax, [esp + 0x174]
push edi
push eax
call fcn.0046112f
add esp, 0x24
add edi, 0x78
inc ebp
cmp ebp, 0x10
jb 0x4689c7
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x180]
push esi
push eax
call fcn.00468831
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0x74]
push esi
push eax
call fcn.004686fa
lea eax, [esp + 0x7c]
push eax
push esi
call fcn.004687e8
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x88]
push esi
push eax
call fcn.00462ff9
lea eax, [esp + 0x90]
push eax
push esi
call fcn.004687e8
mov eax, dword [esp + 0x40]
add esp, 0x30
dec eax
mov dword [esp + 0x10], eax
push 1
pop ebp
cmp eax, 0x40
jb 0x46894e
mov ecx, dword [esp + 0x928]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ddb6
add esp, 0x91c
ret

Function at 0x468b8f
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
xor bl, bl
test edx, edx
je 0x468bb3
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
or bl, al
inc ecx
sub edx, 1
jne 0x468ba5
pop esi
movzx eax, bl
pop ebx
ret
Function at 0x46a8a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 0x60
push ebx
push edi
call fcn.0046ec60
mov ebp, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x14], ebx
jbe 0x46a901
lea ecx, [ebp - 1]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
push esi
push edi
mov esi, ecx
push ebp
xor esi, ebx
push esi
push edi
call fcn.00468d9c
lea ecx, [edi + 0x20]
push ecx
lea eax, [ebp + 0x20]
push eax
push esi
push ecx
call fcn.00468d9c
mov ecx, dword [esp + 0x40]
add esp, 0x20
inc ebx
add ebp, 0x40
cmp ebx, dword [esp + 0x18]
jb 0x46a8cf
mov ebp, dword [esp + 0x14]
pop esi
lea eax, [edi + 0x40]
push 0x487fa8
push eax
push ebp
push eax
call fcn.00468d9c
add esp, 0x10
pop edi
pop ebp
pop ebx
ret
Function at 0x46c38d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
mov eax, dword [0x48f034]
xor eax, esp
mov dword [esp + 0xc8], eax
push ebx
mov ebx, dword [esp + 0xd4]
xor edx, edx
push ebp
mov ebp, dword [esp + 0xdc]
xor eax, eax
push edi
push 7
pop ecx
mov dword [esp + 0x14], edx
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 7
pop ecx
mov dword [esp + 0x34], edx
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
push 7
pop ecx
mov dword [esp + 0x10], ebx
lea edi, [esp + 0x58]
mov dword [esp + 0x54], edx
xor ebx, ebx
rep stosd dword es:[edi], eax
inc ebx
mov dword [esp + 0xc], 0x20
mov edi, 0xbf
push esi
test ebx, ebx
jne 0x46c41c
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0046a753
add esp, 0x18
lea eax, [edi + 0x40]
push eax
push ebp
call fcn.00468ded
mov esi, eax
push edi
push ebp
shl esi, 3
call fcn.00468ded
shl eax, 2
or esi, eax
lea eax, [edi - 0x40]
push eax
push ebp
call fcn.00468ded
add eax, eax
or esi, eax
lea eax, [edi - 0x80]
push eax
push ebp
call fcn.00468ded
or esi, eax
lea eax, [esp + 0x98]
push eax
push 0x488388
push 0xf
push esi
call fcn.0046a8a4
add esp, 0x30
test ebx, ebx
jne 0x46c4af
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x80]
push eax
push 1
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0046a306
add esp, 0x28
jmp 0x46c4e7
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00468dbd
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00468dbd
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.00468dbd
add esp, 0x18
xor ebx, ebx
lea eax, [edi + 0x20]
push eax
push ebp
call fcn.00468ded
lea ecx, [edi - 0x20]
mov esi, eax
push ecx
push ebp
shl esi, 3
call fcn.00468ded
shl eax, 2
or esi, eax
lea eax, [edi - 0x60]
push eax
push ebp
call fcn.00468ded
add eax, eax
or esi, eax
lea eax, [edi - 0xa0]
push eax
push ebp
call fcn.00468ded
or esi, eax
lea eax, [esp + 0x98]
push eax
push 0x487fc8
push 0xf
push esi
call fcn.0046a8a4
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0xb0]
push eax
push 1
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x6c]
push eax
call fcn.0046a306
add esp, 0x58
dec edi
sub dword [esp + 0x10], 1
jne 0x46c3f2
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x18]
pop esi
push eax
push ebx
call fcn.00468dda
lea eax, [esp + 0x3c]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.00468dda
lea eax, [esp + 0x64]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.00468dda
mov ecx, dword [esp + 0xec]
add esp, 0x18
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0046ddb6
add esp, 0xcc
ret