joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e6920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov byte [ebp - 5], dl
test eax, eax
je 0x4e6a8f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4e6a2c
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.004e6360
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov dword [ebp - 4], ecx
jmp 0x4e6a2f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4e69d0
test ecx, ecx
je 0x4e6a83
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e8c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov byte [ebp - 5], dl
test eax, eax
je 0x4e8d7f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x4e8d1c
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.004e85d0
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov dword [ebp - 4], ecx
jmp 0x4e8d1f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x4e8cc0
test ecx, ecx
je 0x4e8d73
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f22f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, ebx
shr eax, 3
mov dword [ebp - 4], eax
push esi
cmp ebx, 0xc8
jae 0x4f2310
test bl, 7
je 0x4f232a
push 0x42a
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_sha_keccak1600.c
push str.r____25__sizeof_A_0__0______r___8___0
call fcn.0055026e
mov eax, dword [ebp - 4]
add esp, 0xc
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jb 0x4f250a
push edi
nop word [eax + eax]
mov dword [ebp - 8], 0
test eax, eax
je 0x4f24ed
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 7]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 1]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
mov dword [ebp + 0xc], ecx
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
mov eax, edi
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
mov eax, ebx
and ecx, 0xff00ff
and eax, 0x55555555
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
and edi, 0xaaaaaaaa
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
or eax, edi
and ebx, 0xaaaaaaaa
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
lea eax, [ebx + ebx]
or eax, ebx
and ecx, 0xf0f0f0f0
and eax, 0xcccccccc
mov edi, ecx
shl edi, 4
or edi, ecx
and edi, 0xff00ff00
lea ecx, [eax*4]
mov ebx, edi
or ecx, eax
shr ebx, 8
and ecx, 0xf0f0f0f0
and edi, 0xffff00
mov edx, ecx
or ebx, edi
shl edx, 4
or edx, ecx
shr ebx, 8
and edx, 0xff00ff00
mov eax, edx
shl eax, 8
or eax, edx
xor edx, edx
and eax, 0xffff0000
or ebx, eax
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl eax, 8
and ecx, 0xffffff00
or ecx, eax
mov eax, dword [ebp - 0x10]
shr eax, 8
or eax, dword [ebp - 0x10]
shl ecx, 8
movzx eax, ax
or ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
mov ecx, dword [ebp + 8]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x4f2352
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
jmp 0x4f24f0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f1a40
mov eax, dword [ebp - 4]
sub esi, ebx
add esp, 4
mov dword [ebp + 0x10], esi
cmp esi, ebx
jae 0x4f2340
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f2880
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4f29fe
mov eax, dword [ebp + 8]
dec edi
push ebx
shr edi, 3
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [eax + 0xc]
lea edx, [eax + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
inc edi
nop
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebx]
and al, 0xdf
mov dword [ebp - 4], ecx
or al, 0x40
mov dword [ebp - 0x10], ecx
mov byte [ebx], al
movzx eax, byte [edx]
and al, 0xbf
mov dword [ebp - 0x18], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.004d8cc0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.004d8a80
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004d5db0
mov ebx, dword [ebp - 8]
push ebx
call fcn.004d8cc0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.004d8a80
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004d5db0
mov ecx, dword [ebp - 4]
add esp, 0x30
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
xor edx, ecx
xor ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor ebx, eax
mov dword [ebp - 4], ecx
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0xc]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub edi, 1
jne 0x4f28b0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4fb2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, 1
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
shl ebx, cl
call fcn.004a1900
add esp, 8
test eax, eax
jne 0x4fb301
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 3
jg 0x4fb365
xor ecx, ecx
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0xc], ecx
jle 0x4fb49f
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x4fb346
nop dword [eax]
mov ecx, eax
xor ecx, dword [ebp + 0x14]
lea edx, [ecx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
neg edx
and edx, 1
neg edx
and edx, dword [edi + eax*4]
inc eax
or esi, edx
cmp eax, ebx
jl 0x4fb320
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
inc ecx
lea eax, [ebx*4]
mov dword [ebp + 0x18], ecx
add edi, eax
cmp ecx, dword [ebp + 0xc]
jl 0x4fb314
jmp 0x4fb49f
mov edx, dword [ebp + 0x14]
lea ecx, [esi - 2]
sar edx, cl
mov esi, 1
shl esi, cl
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], esi
lea eax, [esi - 1]
and ecx, eax
mov eax, edx
mov dword [ebp - 0x10], ecx
not eax
shr eax, 0x1f
lea ecx, [edx - 1]
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 1
and ecx, 1
neg ecx
mov dword [ebp - 0x20], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 2
and ecx, 1
xor edx, 3
neg ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [edx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
neg ecx
and eax, edx
and ecx, 1
neg eax
xor edx, edx
and eax, 1
mov dword [ebp - 0xc], edx
neg ecx
neg eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], edx
jle 0x4fb49f
lea eax, [ebx*4]
mov dword [ebp - 0x28], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0x18], eax
test esi, esi
jle 0x4fb487
lea eax, [esi + esi*2]
lea edx, [edi + esi*4]
lea ecx, [edi + esi*8]
mov dword [ebp - 8], edx
lea eax, [edi + eax*4]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [eax]
mov esi, ebx
mov ecx, dword [ecx]
and ecx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
xor esi, dword [ebp - 0x10]
or ecx, eax
mov edx, dword [edx]
and edx, dword [ebp - 0x1c]
mov eax, dword [edi + ebx*4]
or edx, ecx
and eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
or eax, edx
mov edx, dword [ebp - 8]
and ecx, esi
mov esi, dword [ebp - 0x24]
neg ecx
and ecx, 1
inc ebx
neg ecx
add edx, 4
and ecx, eax
mov dword [ebp - 8], edx
or dword [ebp + 0x18], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add eax, 4
add ecx, 4
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ecx
cmp ebx, esi
jl 0x4fb425
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add edi, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0xc], edx
cmp edx, dword [ebp + 0xc]
jl 0x4fb405
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [eax + 4], edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fdda0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x4fde24
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4fddb9
cmp al, 0x6b
jne 0x4fde24
inc ecx
cmp al, 0x6b
jne 0x4fddfb
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4fddd9
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4fddd9
cmp dl, 0xbb
jne 0x4fdded
inc eax
cmp eax, esi
jl 0x4fddc7
sub esi, eax
test eax, eax
jne 0x4fddfe
push 0x50
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x4fde30
push 0x48
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x4fde30
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4fde12
push 0x59
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x4fde30
push esi
push ecx
push dword [ebp + 8]
call fcn.0053f3e0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x3d
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004575d0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x506450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x5064a0
cmp edx, esi
jb 0x5064a0
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x506480
pop edi
pop esi
pop ebx
pop ebp
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
pxor xmm2, xmm3
pand xmm2, xmm4
movaps xmm0, xmm2
pxor xmm2, xmm3
pxor xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x5064b0
pop esi
pop ebx
pop ebp
ret
Function at 0x5077f0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
lea eax, [ebp - 0x40]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.004d4bd0
mov al, byte [ebp - 0x21]
and byte [ebp - 0x40], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.0050b5a0
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 8]
call fcn.0050b530
lea eax, [ebp - 0x40]
push 0x40
push eax
call fcn.004578d0
add esp, 0x24
mov esp, ebp
pop ebp
ret

Function at 0x507850
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
lea eax, [ebp - 0x158]
push esi
push eax
call fcn.004d5510
push 0x20
push dword [ebp + 0x18]
lea eax, [ebp - 0x158]
push eax
call fcn.004d55e0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004d4cf0
mov al, byte [ebp - 0x21]
and byte [ebp - 0x40], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x158]
push eax
call fcn.004d5510
push 0x20
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.004d55e0
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push dword [ebp + 0xc]
push eax
call fcn.004d55e0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004d4cf0
lea eax, [ebp - 0x80]
push eax
call fcn.0050f8e0
add esp, 0x40
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.0050b5a0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.0050b530
lea eax, [ebp - 0x158]
push eax
call fcn.004d5510
push 0x20
lea eax, [ebp - 0x158]
push esi
push eax
call fcn.004d55e0
push 0x20
push dword [ebp + 0x14]
lea eax, [ebp - 0x158]
push eax
call fcn.004d55e0
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push dword [ebp + 0xc]
push eax
call fcn.004d55e0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004d4cf0
add esp, 0x40
lea eax, [ebp - 0x198]
push eax
call fcn.0050f8e0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.0050bc00
lea eax, [ebp - 0x158]
push 0xd8
push eax
call fcn.004578d0
lea eax, [ebp - 0x80]
push 0x40
push eax
call fcn.004578d0
lea eax, [ebp - 0x40]
push 0x40
push eax
call fcn.004578d0
add esp, 0x2c
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x507b60
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [ebp - 0x60], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [ebp - 0x70], xmm0
mov byte [ebp - 0x70], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x51], al
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0050b5a0
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0xc0]
lea eax, [ecx + edx]
sub edx, ecx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0x28], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0x24], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x20], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x1c], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x18], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x14], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xc], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x2c], edx
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00508240
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
push eax
call fcn.00508470
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.00509b90
lea eax, [ebp - 0x70]
push 0x20
push eax
call fcn.004578d0
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x530c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [edx + 4]
mov esi, edx
push edi
mov edi, dword [ebp + 0x10]
cmp ecx, dword [edi + 4]
cmovge esi, edi
cmovge edi, edx
mov dword [ebp + 0xc], esi
push dword [edi + 4]
push ebx
call fcn.004a1900
add esp, 8
test eax, eax
jne 0x530c75
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
cmp dword [esi + 4], eax
jle 0x530c98
nop dword [eax]
mov ecx, dword [esi]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
xor esi, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], esi
inc eax
mov esi, dword [ebp + 0xc]
cmp eax, dword [esi + 4]
jl 0x530c80
mov ecx, dword [edi + 4]
cmp eax, ecx
jge 0x530cb2
nop
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x530ca0
push ebx
mov dword [ebx + 4], ecx
call fcn.004a1780
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x531bb0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
push esi
xor edi, edi
call fcn.004ca220
push esi
call fcn.004c9fd0
mov esi, eax
add esp, 8
test esi, esi
je 0x531d93
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.004a1900
add esp, 8
test eax, eax
je 0x531d92
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x531d6e
mov edi, ecx
nop
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x531c00
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.004a1780
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.00530cd0
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push dword [ebp + 0x14]
call fcn.004c9ed0
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret