joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478480
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.00580860
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x38]
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
test byte [edi + 0x10], 4
mov eax, dword [edi + 4]
lea ebp, [eax - 1]
je 0x4784bb
push edi
call fcn.004789b0
add esp, 4
mov esi, eax
jmp 0x4784d6
test eax, eax
jne 0x4784c3
xor esi, esi
jmp 0x4784d6
mov eax, dword [edi]
push dword [eax + ebp*4]
call fcn.00477f10
add esp, 4
shl ebp, 5
lea esi, [eax + ebp]
lea eax, [esi + 7]
cdq
and edx, 7
add edx, eax
sar edx, 3
cmp dword [esp + 0x48], ebx
jne 0x47851b
mov ebx, dword [edi + 0xc]
lea eax, [edx*8]
mov ecx, ebx
neg ecx
sbb ecx, ecx
and ecx, 0xff
mov dword [esp + 0x14], ecx
cmp eax, esi
jne 0x478513
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0x10], eax
jmp 0x47851d
mov eax, ebx
mov dword [esp + 0x10], eax
jmp 0x47851d
xor eax, eax
mov esi, dword [esp + 0x40]
cmp esi, 0xffffffff
jne 0x47855b
lea esi, [edx + eax]
mov dword [esp + 0x40], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x478604
test esi, esi
je 0x478691
push esi
push ecx
push dword [esp + 0x44]
call fcn.00599040
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
add eax, edx
cmp esi, eax
jge 0x47852d
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x30], eax
movups xmmword [esp + 0x20], xmm0
mov edx, dword [esp + 0x20]
psrldq xmm0, 4
movd ecx, xmm0
mov dword [esp + 0x24], ecx
test ecx, ecx
jle 0x4785a2
lea eax, [edx + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x47859e
dec ecx
test ecx, ecx
jg 0x478590
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x2c]
xor ebp, ebp
test ecx, ecx
cmove eax, ebp
test byte [edi + 0x10], 4
mov dword [esp + 0x2c], eax
lea ebp, [ecx - 1]
je 0x4785c9
lea eax, [esp + 0x20]
push eax
call fcn.004789b0
add esp, 4
jmp 0x4785e1
test ecx, ecx
jne 0x4785d1
xor eax, eax
jmp 0x4785e1
push dword [edx + ebp*4]
call fcn.00477f10
shl ebp, 5
add esp, 4
add eax, ebp
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0x10]
cmp esi, eax
jge 0x47852d
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
cmp dword [esp + 0x44], 1
mov eax, dword [esp + 0x3c]
jne 0x478619
mov dword [esp + 0x48], 1
jmp 0x478624
dec eax
mov dword [esp + 0x48], 0xffffffff
add eax, esi
mov dword [esp + 0x38], eax
xor ebp, ebp
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 4]
shl eax, 2
test esi, esi
je 0x478691
neg eax
mov dword [esp + 0x10], esi
mov esi, eax
mov eax, dword [edi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, esi
shr eax, 0x1f
neg al
shr edx, cl
and dl, al
mov eax, dword [esp + 0x38]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
add eax, dword [esp + 0x48]
mov dword [esp + 0x38], eax
neg ebx
mov eax, ebp
inc esi
sub eax, dword [esp + 0x1c]
shr eax, 0x1f
add ebp, eax
sub dword [esp + 0x10], 1
jne 0x478643
mov esi, dword [esp + 0x40]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x496330
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00580860
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4963b0
mov cl, byte [edi]
test cl, cl
je 0x4963b0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x496360
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x4965f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00580860
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x496673
mov cl, byte [edi]
test cl, cl
je 0x496673
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x496620
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x499c90
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.004578d0
add esp, 8
test esi, esi
jg 0x499ce7
je 0x499cc9
cmp esi, 0xffffffff
jne 0x499ce7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00499fc0
add esp, 4
test eax, eax
je 0x499ce7
push 0xa
push edi
call fcn.00458760
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x49a0c0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.00580860
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x49a108
call fcn.00461410
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.00461460
push 0
push 0x87
push 0x20
call fcn.00461490
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.00469170
add esp, 8
test eax, eax
jne 0x49a127
pop ebx
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x49a1a2
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x49a1a2
call fcn.00461410
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.00461460
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00461490
call fcn.00461410
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.00461460
push 0
push 0x89
push 0x20
call fcn.00461490
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
test bl, 0x10
je 0x49a213
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x49a213
call fcn.00461410
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.00461460
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00461490
call fcn.00461410
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.00461460
push 0
push 0x8a
push 0x20
call fcn.00461490
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.0046a3d0
add esp, 4
push eax
push esi
call fcn.0046a3c0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x49a2a1
push eax
call fcn.0049a080
add esp, 4
test eax, eax
jne 0x49a29a
call fcn.00461410
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.00461460
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00461490
call fcn.00461410
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.00461460
push 0
push 0x67
push 0x20
call fcn.00461490
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x4a8990
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x4a89d2
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
add edi, esi
add ebx, esi
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x4a89b1
pop edi
pop ebx
pop esi
ret
Function at 0x4c5290
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4c5359
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4c52b1
cmp al, 0x6b
jne 0x4c5359
inc ecx
cmp al, 0x6b
jne 0x4c5312
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4c52d2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4c52d2
cmp dl, 0xbb
jne 0x4c52e6
inc eax
cmp eax, esi
jl 0x4c52c0
sub esi, eax
test eax, eax
jne 0x4c5315
call fcn.00461410
push str.RSA_padding_check_X931
push 0x56
jmp 0x4c52f2
call fcn.00461410
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.00461460
push 0
push 0x8a
push 4
call fcn.00461490
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4c5347
call fcn.00461410
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.00461460
push 0
push 0x8b
push 4
call fcn.00461490
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.00598ac0
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.00461410
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.00461460
push 0
push 0x89
push 4
call fcn.00461490
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x4d2c30
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.00460ba0
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4d2c74
push 0
push 0
push edi
push 0x4d2c90
push 0
push 0
call fcn.005a4585
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4d2c74
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.004609d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x4e41f0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.00580860
mov eax, dword [0x64ef14]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.00481e90
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4e4272
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.00481370
push edi
mov esi, eax
call fcn.00481ec0
add esp, 0x1c
test esi, esi
jne 0x4e428c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0057ffc6
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004e3930
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004e4070
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057ffc6
add esp, 0xe4
ret
Function at 0x4fbe30
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.00599040
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x502080
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00580860
mov eax, dword [0x64ef14]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xd8]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], edi
call fcn.00478e90
push ebp
push 0
push edi
mov dword [esp + 0x2c], eax
call fcn.00564da0
add esp, 0x10
test eax, eax
je 0x502252
mov edi, dword [esp + 0xcc]
inc ebp
test edi, edi
mov edi, dword [esp + 0x10]
je 0x502134
push 0
push esi
push edi
push dword [esp + 0x28]
call fcn.004567e0
add esp, 0x10
test eax, eax
jle 0x502253
push esi
push edi
push ebx
call fcn.00598ac0
push esi
lea eax, [esp + 0x7c]
push edi
push eax
call fcn.00598ac0
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x50215d
add byte [ebx + eax], 1
jne 0x50215d
sub eax, 1
jns 0x502152
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push edi
call fcn.00481370
add esp, 0x18
test eax, eax
je 0x502253
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push ebx
call fcn.00481370
add esp, 0x18
test eax, eax
je 0x502253
xor eax, eax
test esi, esi
jle 0x5021fe
cmp esi, 0x20
jb 0x5021ed
mov ecx, esi
and ecx, 0x8000001f
jns 0x5021b5
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edx, esi
sub edx, ecx
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
add eax, 0x20
cmp eax, edx
jl 0x5021c0
cmp eax, esi
jge 0x5021fe
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x5021f1
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push edi
push esi
push eax
call fcn.00477800
add esp, 0xc
test eax, eax
je 0x502253
push dword [esp + 0x18]
push dword [esp + 0x28]
push edi
call fcn.00564df0
add esp, 0xc
test eax, eax
jg 0x502274
jne 0x502253
push ebp
push 0
push dword [esp + 0x20]
mov edi, 1
call fcn.00564da0
add esp, 0xc
test eax, eax
jne 0x502113
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.0057ffc6
add esp, 0xa0
ret
mov eax, 1
jmp 0x502255
Function at 0x503bd0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
cmp ebp, 2
je 0x503ca7
mov edi, dword [esp + 0x10]
test edi, edi
je 0x503c59
push edi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.004af140
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x503c2e
call fcn.00461410
push str.ossl_ecx_key_op
push 0xa9
push str.cryptoececx_backend.c
call fcn.00461460
push 0
push 0x66
push 0x10
call fcn.00461490
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
push dword [edi]
mov esi, dword [esp + 0x20]
call fcn.0047bec0
add esp, 4
test esi, esi
jne 0x503c44
mov esi, eax
jmp 0x503c5d
cmp esi, eax
je 0x503c5d
call fcn.00461410
push str.ossl_ecx_key_op
push 0xaf
jmp 0x503c10
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0
je 0x503c93
test esi, esi
je 0x503c93
cmp esi, 0x40a
je 0x503c88
cmp esi, 0x43f
je 0x503c88
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x503c8d
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x503cab
call fcn.00461410
push str.ossl_ecx_key_op
push 0xb5
jmp 0x503c10
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x503ccf
cmp esi, 0x43f
je 0x503ccf
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x503cdf
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.0049fc70
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x503d29
call fcn.00461410
push str.ossl_ecx_key_op
push 0xbc
push str.cryptoececx_backend.c
call fcn.00461460
push ebx
push 0x80010
push 0x10
call fcn.00461490
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x503d49
push dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
push eax
lea eax, [ebx + 0xc]
push eax
call fcn.00598ac0
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.0049fc00
mov edi, eax
add esp, 4
test edi, edi
jne 0x503d7c
call fcn.00461410
push str.ossl_ecx_key_op
push 0xc6
push str.cryptoececx_backend.c
call fcn.00461460
push edi
push 0x80010
jmp 0x503e53
cmp ebp, 2
jne 0x503dee
test esi, esi
je 0x503e22
cmp esi, 0x40a
je 0x503da9
cmp esi, 0x43f
je 0x503da9
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x503dae
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.00456b90
add esp, 0x10
test eax, eax
jle 0x503e5d
cmp esi, 0x40a
jne 0x503ddd
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x503e22
cmp esi, 0x40b
jne 0x503e22
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x503e22
cmp esi, 0x40a
je 0x503e0e
cmp esi, 0x43f
je 0x503e0e
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x503e13
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push edi
call fcn.00598ac0
add esp, 0xc
push ebx
call fcn.00503e70
add esp, 4
test eax, eax
jne 0x503d42
call fcn.00461410
push str.ossl_ecx_key_op
push 0xda
push str.cryptoececx_backend.c
call fcn.00461460
push 0
push 0xa6
push 0x10
call fcn.00461490
add esp, 0x18
push ebx
call fcn.0049fc20
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x5097b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.00580860
mov eax, dword [0x64ef14]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
test esi, esi
jns 0x509801
mov dword [eax], 0xffffffff
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0057ffc6
add esp, 0x2c
ret
push ebx
movzx ebx, byte [ecx]
push ebp
lea ebp, [ecx + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov byte [esp + 0x2b], bl
movzx eax, byte [edx + 6]
mov dword [esp + 0x10], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x10], ebx
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x509970
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x40]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x48], eax
test esi, esi
jne 0x509918
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.00508d80
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x5098b3
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x509970
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.0057ffc6
add esp, 0x2c
ret
Function at 0x50d470
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00580860
mov eax, dword [esp + 0x2c]
push esi
mov esi, dword [eax]
test esi, esi
jns 0x50d490
mov dword [eax], 0xffffffff
pop esi
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
test esi, esi
je 0x50d4bc
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x50d4bc
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x50d4a7
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x50d555
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x50d504
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x50d537
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x50d525
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x50d500
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x50d587
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push eax
push eax
call edx
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x50d575
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [eax], esi
pop esi
add esp, 0x14
ret
Function at 0x50da70
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi + 0x38]
or eax, dword [edi + 0x3c]
je 0x50da84
mov eax, 0xfffffffe
pop edi
ret
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, esi
add eax, dword [edi + 0x30]
adc ecx, dword [edi + 0x34]
cmp ecx, 0x20000000
ja 0x50db39
jb 0x50daa9
test eax, eax
jne 0x50db39
push ebx
mov ebx, dword [edi + 0x170]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
push ebp
mov ebp, dword [esp + 0x18]
test ebx, ebx
je 0x50daec
nop
test esi, esi
je 0x50dad5
mov al, byte [ebp]
dec esi
xor byte [ebx + edi + 0x40], al
inc ebp
inc ebx
and ebx, 0xf
jne 0x50dac0
jmp 0x50dad9
test ebx, ebx
jne 0x50db2c
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x40]
push eax
mov eax, dword [edi + 0x168]
call eax
add esp, 8
mov eax, esi
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x50db14
push eax
push ebp
lea eax, [edi + 0x60]
push eax
lea eax, [edi + 0x40]
push eax
mov eax, dword [edi + 0x164]
call eax
add ebp, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x50db2c
xor ecx, ecx
mov ebx, esi
test esi, esi
je 0x50db2c
mov al, byte [ecx + ebp]
xor byte [edi + ecx + 0x40], al
inc ecx
cmp ecx, esi
jb 0x50db20
pop ebp
mov dword [edi + 0x170], ebx
xor eax, eax
pop ebx
pop esi
pop edi
ret
pop esi
or eax, 0xffffffff
pop edi
ret