joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53c110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov byte [ebp - 5], dl
test eax, eax
je 0x53c27f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x53c21c
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.0053bb50
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov dword [ebp - 4], ecx
jmp 0x53c21f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x53c1c0
test ecx, ecx
je 0x53c273
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53e410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
lea edx, [eax + 1]
mov dword [ebp - 4], 0
movzx ecx, byte [edx + 3]
movzx ebx, byte [eax]
movzx eax, byte [edx]
shl eax, 0x10
shl ebx, 0x18
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [ebp - 0x14], ebx
movzx eax, byte [edx + 6]
mov dword [ebp - 8], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [ebp - 8]
shl ecx, 8
or ecx, eax
mov byte [ebp - 9], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
mov edi, dword [ebp + 0x1c]
mov byte [ebp - 6], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov byte [ebp - 5], dl
test eax, eax
je 0x53e57f
mov edi, dword [ebp + 0xc]
sub dword [ebp + 8], edi
nop word [eax + eax]
dec eax
mov dword [ebp + 0x10], eax
test esi, esi
jne 0x53e51c
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
call fcn.0053ddd0
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edx, dword [ebp - 0x10]
mov eax, ebx
shr eax, 0x18
mov ecx, dword [ebp - 4]
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 7], al
mov eax, edx
shr eax, 8
inc ecx
mov byte [ebp - 9], bl
mov byte [ebp - 6], al
mov byte [ebp - 5], dl
mov dword [ebp - 4], ecx
jmp 0x53e51f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov al, byte [eax + edi]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [edi], al
and esi, 7
mov eax, dword [ebp + 0x10]
inc edi
test eax, eax
jne 0x53e4c0
test ecx, ecx
je 0x53e573
mov edi, dword [ebp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, ebx
shr eax, 8
mov byte [edi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [edi + 3], bl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 5], al
mov eax, edx
shr eax, 8
mov byte [edi + 6], al
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x547af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, ebx
shr eax, 3
mov dword [ebp - 4], eax
push esi
cmp ebx, 0xc8
jae 0x547b10
test bl, 7
je 0x547b2a
push 0x42a
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_sha_keccak1600.c
push str.r____25__sizeof_A_0__0______r___8___0
call fcn.005a8132
mov eax, dword [ebp - 4]
add esp, 0xc
mov esi, dword [ebp + 0x10]
cmp esi, ebx
jb 0x547d0a
push edi
nop word [eax + eax]
mov dword [ebp - 8], 0
test eax, eax
je 0x547ced
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 7]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 1]
cdq
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
mov dword [ebp + 0xc], ecx
shld ebx, edi, 8
shl edi, 8
or ebx, edx
or edi, eax
mov eax, edi
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
mov eax, ebx
and ecx, 0xff00ff
and eax, 0x55555555
mov dword [ebp - 0x10], ecx
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
and edi, 0xaaaaaaaa
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
or eax, edi
and ebx, 0xaaaaaaaa
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
lea eax, [ebx + ebx]
or eax, ebx
and ecx, 0xf0f0f0f0
and eax, 0xcccccccc
mov edi, ecx
shl edi, 4
or edi, ecx
and edi, 0xff00ff00
lea ecx, [eax*4]
mov ebx, edi
or ecx, eax
shr ebx, 8
and ecx, 0xf0f0f0f0
and edi, 0xffff00
mov edx, ecx
or ebx, edi
shl edx, 4
or edx, ecx
shr ebx, 8
and edx, 0xff00ff00
mov eax, edx
shl eax, 8
or eax, edx
xor edx, edx
and eax, 0xffff0000
or ebx, eax
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl eax, 8
and ecx, 0xffffff00
or ecx, eax
mov eax, dword [ebp - 0x10]
shr eax, 8
or eax, dword [ebp - 0x10]
shl ecx, 8
movzx eax, ax
or ecx, eax
mov eax, dword [ebp - 8]
or edx, ecx
mov ecx, dword [ebp + 8]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x547b52
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
jmp 0x547cf0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00547240
mov eax, dword [ebp - 4]
sub esi, ebx
add esp, 4
mov dword [ebp + 0x10], esi
cmp esi, ebx
jae 0x547b40
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x548080
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x5481fe
mov eax, dword [ebp + 8]
dec edi
push ebx
shr edi, 3
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [eax + 0xc]
lea edx, [eax + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
inc edi
nop
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebx]
and al, 0xdf
mov dword [ebp - 4], ecx
or al, 0x40
mov dword [ebp - 0x10], ecx
mov byte [ebx], al
movzx eax, byte [edx]
and al, 0xbf
mov dword [ebp - 0x18], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.0052e4c0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.0052e280
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0052b5c0
mov ebx, dword [ebp - 8]
push ebx
call fcn.0052e4c0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.0052e280
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0052b5c0
mov ecx, dword [ebp - 4]
add esp, 0x30
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
xor edx, ecx
xor ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor ebx, eax
mov dword [ebp - 4], ecx
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0xc]
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov edx, ecx
sub edi, 1
jne 0x5480b0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x550ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, 1
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 8]
shl ebx, cl
call fcn.004f7130
add esp, 8
test eax, eax
jne 0x550b01
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 3
jg 0x550b65
xor ecx, ecx
mov dword [ebp + 0x18], ecx
cmp dword [ebp + 0xc], ecx
jle 0x550c9f
xor esi, esi
xor eax, eax
test ebx, ebx
jle 0x550b46
nop dword [eax]
mov ecx, eax
xor ecx, dword [ebp + 0x14]
lea edx, [ecx - 1]
not ecx
shr edx, 0x1f
shr ecx, 0x1f
and edx, ecx
neg edx
and edx, 1
neg edx
and edx, dword [edi + eax*4]
inc eax
or esi, edx
cmp eax, ebx
jl 0x550b20
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
inc ecx
lea eax, [ebx*4]
mov dword [ebp + 0x18], ecx
add edi, eax
cmp ecx, dword [ebp + 0xc]
jl 0x550b14
jmp 0x550c9f
mov edx, dword [ebp + 0x14]
lea ecx, [esi - 2]
sar edx, cl
mov esi, 1
shl esi, cl
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x24], esi
lea eax, [esi - 1]
and ecx, eax
mov eax, edx
mov dword [ebp - 0x10], ecx
not eax
shr eax, 0x1f
lea ecx, [edx - 1]
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 1
and ecx, 1
neg ecx
mov dword [ebp - 0x20], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
mov eax, edx
neg ecx
xor eax, 2
and ecx, 1
xor edx, 3
neg ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [edx - 1]
shr eax, 0x1f
not edx
shr edx, 0x1f
neg ecx
and eax, edx
and ecx, 1
neg eax
xor edx, edx
and eax, 1
mov dword [ebp - 0xc], edx
neg ecx
neg eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], edx
jle 0x550c9f
lea eax, [ebx*4]
mov dword [ebp - 0x28], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0x18], eax
test esi, esi
jle 0x550c87
lea eax, [esi + esi*2]
lea edx, [edi + esi*4]
lea ecx, [edi + esi*8]
mov dword [ebp - 8], edx
lea eax, [edi + eax*4]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x10], eax
mov eax, dword [eax]
mov esi, ebx
mov ecx, dword [ecx]
and ecx, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
xor esi, dword [ebp - 0x10]
or ecx, eax
mov edx, dword [edx]
and edx, dword [ebp - 0x1c]
mov eax, dword [edi + ebx*4]
or edx, ecx
and eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
or eax, edx
mov edx, dword [ebp - 8]
and ecx, esi
mov esi, dword [ebp - 0x24]
neg ecx
and ecx, 1
inc ebx
neg ecx
add edx, 4
and ecx, eax
mov dword [ebp - 8], edx
or dword [ebp + 0x18], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
add eax, 4
add ecx, 4
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ecx
cmp ebx, esi
jl 0x550c25
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add edi, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0xc], edx
cmp edx, dword [ebp + 0xc]
jl 0x550c05
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [eax + 4], edi
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5535a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x553624
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x5535b9
cmp al, 0x6b
jne 0x553624
inc ecx
cmp al, 0x6b
jne 0x5535fb
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x5535d9
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x5535d9
cmp dl, 0xbb
jne 0x5535ed
inc eax
cmp eax, esi
jl 0x5535c7
sub esi, eax
test eax, eax
jne 0x5535fe
push 0x50
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x553630
push 0x48
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x553630
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x553612
push 0x59
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x553630
push esi
push ecx
push dword [ebp + 8]
call fcn.00594dc0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x3d
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004ace10
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x55bc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x55bca0
cmp edx, esi
jb 0x55bca0
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x55bc80
pop edi
pop esi
pop ebx
pop ebp
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
pxor xmm2, xmm3
pand xmm2, xmm4
movaps xmm0, xmm2
pxor xmm2, xmm3
pxor xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x55bcb0
pop esi
pop ebx
pop ebp
ret
Function at 0x55cff0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
lea eax, [ebp - 0x40]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.0052a3e0
mov al, byte [ebp - 0x21]
and byte [ebp - 0x40], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00560da0
lea eax, [ebp - 0xe0]
push eax
push dword [ebp + 8]
call fcn.00560d30
lea eax, [ebp - 0x40]
push 0x40
push eax
call fcn.004ad110
add esp, 0x24
mov esp, ebp
pop ebp
ret

Function at 0x55d050
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
lea eax, [ebp - 0x158]
push esi
push eax
call fcn.0052ad20
push 0x20
push dword [ebp + 0x18]
lea eax, [ebp - 0x158]
push eax
call fcn.0052adf0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0052a500
mov al, byte [ebp - 0x21]
and byte [ebp - 0x40], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x158]
push eax
call fcn.0052ad20
push 0x20
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.0052adf0
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push dword [ebp + 0xc]
push eax
call fcn.0052adf0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0052a500
lea eax, [ebp - 0x80]
push eax
call fcn.005650f0
add esp, 0x40
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00560da0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.00560d30
lea eax, [ebp - 0x158]
push eax
call fcn.0052ad20
push 0x20
lea eax, [ebp - 0x158]
push esi
push eax
call fcn.0052adf0
push 0x20
push dword [ebp + 0x14]
lea eax, [ebp - 0x158]
push eax
call fcn.0052adf0
push dword [ebp + 0x10]
lea eax, [ebp - 0x158]
push dword [ebp + 0xc]
push eax
call fcn.0052adf0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.0052a500
add esp, 0x40
lea eax, [ebp - 0x198]
push eax
call fcn.005650f0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.00561400
lea eax, [ebp - 0x158]
push 0xd8
push eax
call fcn.004ad110
lea eax, [ebp - 0x80]
push 0x40
push eax
call fcn.004ad110
lea eax, [ebp - 0x40]
push 0x40
push eax
call fcn.004ad110
add esp, 0x2c
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x55d360
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [ebp - 0x60], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [ebp - 0x70], xmm0
mov byte [ebp - 0x70], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x51], al
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00560da0
mov ecx, dword [ebp - 0xe8]
mov edx, dword [ebp - 0xc0]
lea eax, [ecx + edx]
sub edx, ecx
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0x28], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0xb8]
mov dword [ebp - 0x24], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x20], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd8]
mov dword [ebp - 0x44], edx
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x1c], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0xac]
mov dword [ebp - 0x18], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x14], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0xc], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x2c], edx
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0055da40
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x28]
push eax
push eax
call fcn.0055dc70
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0055f390
lea eax, [ebp - 0x70]
push 0x20
push eax
call fcn.004ad110
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x586460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [edx + 4]
mov esi, edx
push edi
mov edi, dword [ebp + 0x10]
cmp ecx, dword [edi + 4]
cmovge esi, edi
cmovge edi, edx
mov dword [ebp + 0xc], esi
push dword [edi + 4]
push ebx
call fcn.004f7130
add esp, 8
test eax, eax
jne 0x586495
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
cmp dword [esi + 4], eax
jle 0x5864b8
nop dword [eax]
mov ecx, dword [esi]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
xor esi, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], esi
inc eax
mov esi, dword [ebp + 0xc]
cmp eax, dword [esi + 4]
jl 0x5864a0
mov ecx, dword [edi + 4]
cmp eax, ecx
jge 0x5864d2
nop
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x5864c0
push ebx
mov dword [ebx + 4], ecx
call fcn.004f6fb0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5873d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x14]
push edi
push esi
xor edi, edi
call fcn.0051fa40
push esi
call fcn.0051f7f0
mov esi, eax
add esp, 8
test esi, esi
je 0x5875b3
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
add eax, eax
push eax
push esi
call fcn.004f7130
add esp, 8
test eax, eax
je 0x5875b2
mov eax, dword [ebx + 4]
lea ecx, [eax - 1]
test ecx, ecx
js 0x58758e
mov edi, ecx
nop
mov eax, dword [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shr ecx, 1
mov eax, edx
and eax, 0x20000
and ecx, 0x8000
or ecx, eax
mov eax, edx
and eax, 0x40000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x80000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x100000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x200000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x400000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x800000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x1000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x2000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x4000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x8000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x10000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x20000000
shr ecx, 1
or ecx, eax
mov eax, edx
and eax, 0x40000000
shr ecx, 1
or ecx, eax
and edx, reloc.WS2_32.dll_accept
mov eax, dword [esi]
shr ecx, 1
or ecx, edx
shr ecx, 1
mov dword [eax + edi*8 + 4], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
mov edx, ecx
and edx, 0x8000
mov eax, ecx
add edx, edx
and eax, 0x4000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x2000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x1000
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x800
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x400
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x200
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x100
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x80
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x40
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x20
or edx, eax
mov eax, ecx
add edx, edx
and eax, 0x10
or edx, eax
mov eax, ecx
add edx, edx
and eax, 8
or edx, eax
mov eax, ecx
add edx, edx
and eax, 4
or edx, eax
mov eax, ecx
add edx, edx
and eax, 2
or edx, eax
and ecx, 1
mov eax, dword [esi]
add edx, edx
or edx, ecx
mov dword [eax + edi*8], edx
sub edi, 1
jns 0x587420
mov eax, dword [ebx + 4]
xor edi, edi
add eax, eax
push esi
mov dword [esi + 4], eax
call fcn.004f6fb0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call fcn.005864f0
add esp, 0x10
mov ecx, 1
test eax, eax
cmovne edi, ecx
pop ebx
push dword [ebp + 0x14]
call fcn.0051f6f0
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret