joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f59c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x51f6e5
push esi
push edi
push 0
push 0
push ebx
push 0x10041800
push 0
push 0
call fcn.006351fe
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x51f6c8
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x6c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x51f652
mov edx, dword [esi]
cmp edx, ecx
ja 0x51f652
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x51f642
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x51f6be
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x51f642
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x51f631
xor ecx, ecx
jmp 0x51f633
add ecx, edx
cmp ecx, eax
jae 0x51f639
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x51f69e
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x51f69e
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x51f695
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x51f6be
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x51f695
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x51f684
xor ecx, ecx
jmp 0x51f686
add ecx, edx
cmp ecx, eax
jae 0x51f68c
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x51f69e
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0x14]
jb 0x51f5c0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x101da834
call fcn.006333a7
call dword [0x101711a0]
push eax
mov dword [ebx + 0x68], 8
call dword [0x1017119c]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x526e5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x526fae
push esi
push edi
push 0
push 0
push ebx
push 0x100488e0
push 0
push 0
call fcn.006351fe
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x526f8e
mov eax, dword [ebx + 0x170]
lea esi, [ebx + 0x16c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x526f18
mov edx, dword [esi]
cmp edx, ecx
ja 0x526f18
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x526f08
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x526f84
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x526f08
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x526ef7
xor ecx, ecx
jmp 0x526ef9
add ecx, edx
cmp ecx, eax
jae 0x526eff
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x526f64
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x526f64
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x526f5b
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x526f84
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x526f5b
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x526f4a
xor ecx, ecx
jmp 0x526f4c
add ecx, edx
cmp ecx, eax
jae 0x526f52
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x526f64
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0xc]
jb 0x526e80
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x101da834
call fcn.006333a7
call dword [0x101711a0]
push eax
mov dword [ebx + 0x168], 8
call dword [0x1017119c]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x528a1c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x528b6e
push esi
push edi
push 0
push 0
push ebx
push 0x1004aec0
push 0
push 0
call fcn.006351fe
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x528b4e
mov eax, dword [ebx + 0x140]
lea esi, [ebx + 0x13c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x528ad8
mov edx, dword [esi]
cmp edx, ecx
ja 0x528ad8
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x528ac8
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x528b44
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x528ac8
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x528ab7
xor ecx, ecx
jmp 0x528ab9
add ecx, edx
cmp ecx, eax
jae 0x528abf
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x528b24
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x528b24
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x528b1b
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x528b44
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x528b1b
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x528b0a
xor ecx, ecx
jmp 0x528b0c
add ecx, edx
cmp ecx, eax
jae 0x528b12
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x528b24
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0x14]
jb 0x528a40
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x101da834
call fcn.006333a7
call dword [0x101711a0]
push eax
mov dword [ebx + 0x138], 8
call dword [0x1017119c]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52b46c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor edx, edx
push esi
mov esi, dword [eax]
cmp word [esi], 2
mov ebx, ecx
setne dl
xor eax, eax
push edi
mov ecx, 0x811c9dc5
dec edx
and edx, 0xffffffec
add edx, 0x1c
test edx, edx
jle 0x52b4ad
jmp 0x52b49c
movzx edi, byte [eax + esi]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, edi
cmp eax, edx
jl 0x52b49c
mov edx, dword [ebx + 0x20]
mov eax, edx
and eax, ecx
cmp dword [ebx + 0x24], eax
ja 0x52b4c2
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
mov edx, dword [ebx + 0x10]
mov ecx, dword [edx + eax*8]
mov ebx, dword [ebx + 4]
lea eax, [edx + eax*8]
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
lea ecx, [ecx]
cmp ecx, ebx
jne 0x52b4e4
mov eax, ebx
jmp 0x52b4e9
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp edi, eax
je 0x52b53f
mov eax, dword [edi + 8]
mov edx, esi
call fcn.0052812c
test al, al
jne 0x52b505
mov edi, dword [edi]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x52b4dc
mov edx, dword [edi + 8]
mov eax, esi
mov dword [ebp - 4], edi
call fcn.0052812c
test al, al
jne 0x52b52c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edi
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x52b55c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor edx, edx
push esi
push edi
mov edi, dword [eax]
cmp word [edi], 2
mov ecx, 0x811c9dc5
setne dl
xor eax, eax
dec edx
and edx, 0xffffffec
add edx, 0x1c
test edx, edx
jle 0x52b59d
jmp 0x52b58c
movzx esi, byte [eax + edi]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, esi
cmp eax, edx
jl 0x52b58c
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x20]
mov eax, edx
and eax, ecx
cmp dword [ebx + 0x24], eax
ja 0x52b5b5
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
mov edx, dword [ebx + 0x10]
mov ecx, dword [edx + eax*8]
mov ebx, dword [ebx + 4]
lea eax, [edx + eax*8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
mov esi, ecx
lea ecx, [ecx]
cmp ecx, ebx
jne 0x52b5d4
mov eax, ebx
jmp 0x52b5d9
mov eax, dword [eax + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x52b63b
mov eax, dword [esi + 8]
mov edx, edi
call fcn.0052812c
test al, al
jne 0x52b5f5
mov esi, dword [esi]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x52b5cc
mov dword [ebp - 0xc], esi
lea esp, [esp]
cmp dword [ebp - 4], ebx
jne 0x52b605
mov eax, ebx
jmp 0x52b60d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov eax, dword [edx]
cmp esi, eax
je 0x52b623
mov edx, dword [esi + 8]
mov eax, edi
call fcn.0052812c
test al, al
je 0x52b623
mov esi, dword [esi]
jmp 0x52b5fc
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
je 0x52b63b
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x52b7bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov edi, dword [edx + 8]
cmp word [edi], 2
mov ecx, 0x811c9dc5
setne bl
xor eax, eax
dec ebx
and ebx, 0xffffffec
add ebx, 0x1c
mov dword [ebp - 4], ebx
test ebx, ebx
jle 0x52b7fe
lea ebx, [ebx]
movzx ebx, byte [eax + edi]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, ebx
cmp eax, dword [ebp - 4]
jl 0x52b7ec
mov edi, dword [esi + 0x20]
mov eax, edi
and eax, ecx
cmp dword [esi + 0x24], eax
ja 0x52b813
shr edi, 1
or ecx, 0xffffffff
sub ecx, edi
add eax, ecx
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*8 + 4], edx
lea ecx, [ecx + eax*8]
jne 0x52b83c
cmp dword [ecx], edx
jne 0x52b834
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x52b844
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x52b844
cmp dword [ecx], edx
jne 0x52b847
mov edx, dword [edx]
mov dword [ecx], edx
mov edx, dword [ebp + 0xc]
mov edi, dword [edx]
mov eax, edx
cmp edx, dword [esi + 4]
je 0x52b869
mov ecx, dword [edx + 4]
mov dword [ecx], edi
mov ecx, dword [eax]
mov edx, dword [edx + 4]
push eax
mov dword [ecx + 4], edx
call fcn.00633415
add esp, 4
dec dword [esi + 8]
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x52bb5c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor edx, edx
push esi
mov esi, dword [eax]
cmp word [esi], 2
push edi
setne dl
xor eax, eax
mov ecx, 0x811c9dc5
dec edx
and edx, 0xffffffec
add edx, 0x1c
test edx, edx
jle 0x52bb9d
jmp 0x52bb8c
movzx edi, byte [eax + esi]
imul ecx, ecx, 0x1000193
inc eax
xor ecx, edi
cmp eax, edx
jl 0x52bb8c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov edi, eax
and edi, ecx
cmp dword [edx + 0x24], edi
ja 0x52bbb5
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 4]
lea eax, [eax + edi*8]
lea ecx, [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ebx, eax
je 0x52bbf8
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov ebx, dword [ebx]
cmp ebx, eax
je 0x52bbf8
mov ebx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.0052812c
test al, al
jne 0x52bc35
cmp ebx, dword [ebp - 0xc]
jne 0x52bbdc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
cmp ebx, esi
je 0x52bc14
push esi
push eax
push ebx
mov edx, ecx
call fcn.0052bd5c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [edx + 0x10]
mov esi, dword [eax + edi*8]
lea eax, [eax + edi*8]
cmp esi, dword [ecx]
jne 0x52bc68
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + edi*8 + 4], ecx
jmp 0x52bc90
mov eax, dword [ebx + 8]
mov edx, esi
call fcn.0052812c
test al, al
jne 0x52bc47
mov ebx, dword [ebx]
jmp 0x52bbf2
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
push ecx
lea edi, [ebp + 8]
call fcn.0050e5bc
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], ebx
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, ebx
jne 0x52bc73
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x52bc90
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [ebp + 8]
je 0x52bc90
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + edi*8 + 4]
lea edi, [eax + edi*8 + 4]
mov eax, dword [ecx + 4]
mov dword [edi], eax
push edx
call fcn.0052bcac
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5873ac
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x5873d2
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x5873c3
pop esi
pop ebx
movzx eax, cl
pop edi
ret

Function at 0x5888dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x588967
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x588966
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x58893f
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x588bfc
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
push esi
lea esi, [ecx - 1]
je 0x588c17
pop esi
mov dword [esp + 4], eax
jmp fcn.0058833c
test ecx, ecx
jne 0x588c1f
xor eax, eax
pop esi
ret
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.005882ac
shl esi, 5
add esp, 4
add eax, esi
pop esi
ret

Function at 0x58ee1c
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x5a0b9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x5a0bc4
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x5a0bcc
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x5a0bb0
test esi, esi
je 0x5a0cd3
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x5a0c13
cmp esi, 1
jbe 0x5a0cd3
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x5a0c13
cmp esi, 2
jbe 0x5a0cd3
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x5a0c13
cmp esi, 3
jbe 0x5a0cd3
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle 0x5a0cd3
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x5a0c3c
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x5a0c3c
inc edx
inc eax
cmp edx, edi
jl 0x5a0c2f
lea eax, [edi - 1]
test eax, eax
js 0x5a0c5b
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x5a0c5b
cmp byte [ecx], 0xff
jne 0x5a0c5b
dec ecx
dec eax
jns 0x5a0c4c
cmp edx, eax
jl 0x5a0cd3
jle 0x5a0c6c
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja 0x5a0cd3
movzx ecx, byte [ecx + 0x100c1d00]
jmp dword [ecx*4 + 0x100c1ce0]
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x5c6105
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x5c617b
test eax, eax
je 0x5c6147
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.0059ee6c
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x5c6147
push 0x3b
push 0x101a775c
push 0x66
push 0x10a
push 0x10
call fcn.0056880c
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x5c6177
cmp edi, 0x40a
je 0x5c616e
cmp edi, 0x43f
je 0x5c616e
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5c6173
mov eax, 0x20
cmp esi, eax
je 0x5c617b
push 0x41
jmp 0x5c612c
push ebx
push 0x46
push 0x101a775c
push 0x40
call fcn.005724cc
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x5c61b1
push 0x48
push 0x101a775c
push 0x41
push 0x10a
push 0x10
call fcn.0056880c
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x5c61c9
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.006371cc
add esp, 0xc
jmp 0x5c6326
cmp edi, 0x40a
je 0x5c61e9
cmp edi, 0x43f
je 0x5c61e9
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5c61ee
mov eax, 0x20
push 0x50
push 0x101a775c
push eax
call fcn.005753ec
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x5c6221
push 0x52
push 0x101a775c
push 0x41
push 0x10a
push 0x10
call fcn.0056880c
add esp, 0x14
jmp 0x5c6274
cmp ebp, 2
jne 0x5c62b4
cmp edi, 0x40a
je 0x5c624a
cmp edi, 0x43f
je 0x5c624a
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5c624f
mov eax, 0x20
push eax
push esi
call fcn.0057b88c
add esp, 8
test eax, eax
jg 0x5c628a
push 0x57
push 0x101a775c
push esi
call fcn.0057540c
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push 0x101a775c
push ebx
call fcn.0057253c
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x5c62a3
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x5c62e8
cmp edi, 0x40b
jne 0x5c62e8
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x5c62e8
cmp edi, 0x40a
je 0x5c62d4
cmp edi, 0x43f
je 0x5c62d4
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x5c62d9
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.006371cc
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja 0x5c6326
movzx ecx, byte [eax + 0x100e7358]
jmp dword [ecx*4 + 0x100e7344]
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.00569b3c
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x5cddac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0063753c
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.0058913c
add esp, 8
test eax, eax
jne 0x5cdde7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x5cde49
xor ebx, ebx
test ebp, ebp
jle 0x5cdfac
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x5cde2b
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x5cde04
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x5cddfc
jmp 0x5cdfac
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x40], eax
jle 0x5cdfac
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
mov dword [esp + 0x20], esi
cmp edi, esi
jle 0x5cdf88
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x5cdf1c
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x40]
jl 0x5cdeec
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x5d9c2b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0063753c
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, ebp
sub esi, ebp
mov edi, 4
jmp 0x5d9c4c
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec edi
jne 0x5d9c4c
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x10
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push edx
call fcn.005779ac
add esp, 0x14
pop edi
pop esi
pop ebp
test eax, eax
je 0x5d9c9c
cmp dword [esp], 0x10
jne 0x5d9c9c
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret