joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f5c20
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.006f5e10
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x5f5c68
call fcn.005a4a00
push str.BIO_connect
push 0x5f
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
push 0
push 0x87
push 0x20
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.005a62b0
add esp, 8
test eax, eax
je 0x5f5cf7
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x5f5cfe
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x5f5cfe
call fcn.005a4a00
push str.BIO_connect
push 0x69
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005a4bb0
call fcn.005a4a00
push str.BIO_connect
push 0x6b
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
push 0
push 0x89
push 0x20
call fcn.005a4bb0
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x5f5d6f
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x5f5d6f
call fcn.005a4a00
push str.BIO_connect
push 0x73
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005a4bb0
call fcn.005a4a00
push str.BIO_connect
push 0x75
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
push 0
push 0x8a
push 0x20
call fcn.005a4bb0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.005a6430
add esp, 4
push eax
push esi
call fcn.005a6420
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5f5dfb
push eax
call fcn.005f5b30
add esp, 4
test eax, eax
jne 0x5f5cf7
call fcn.005a4a00
push str.BIO_connect
push 0x7d
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005a4bb0
call fcn.005a4a00
push str.BIO_connect
push 0x7f
push str.crypto_bio_bio_sock2.c
call fcn.005a4b00
push 0
push 0x67
push 0x20
call fcn.005a4bb0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x611520
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x6115e9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x611541
cmp al, 0x6b
jne 0x6115e9
inc ecx
cmp al, 0x6b
jne 0x6115a2
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x611562
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x611562
cmp dl, 0xbb
jne 0x611576
inc eax
cmp eax, esi
jl 0x611550
sub esi, eax
test eax, eax
jne 0x6115a5
call fcn.005a4a00
push str.RSA_padding_check_X931
push 0x56
jmp 0x611582
call fcn.005a4a00
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.005a4b00
push 0
push 0x8a
push 4
call fcn.005a4bb0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x6115d7
call fcn.005a4a00
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.005a4b00
push 0
push 0x8b
push 4
call fcn.005a4bb0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.0070d1d0
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.005a4a00
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.005a4b00
push 0
push 0x89
push 4
call fcn.005a4bb0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x62a600
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xc0]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebx
call fcn.005cd980
push ebp
push 0
push ebx
mov dword [esp + 0x2c], eax
call fcn.00644600
add esp, 0x10
test eax, eax
je 0x62a7f1
mov ebx, dword [esp + 0xcc]
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x62a6b4
push 0
push esi
push ebx
push dword [esp + 0x28]
call fcn.0059e250
add esp, 0x10
test eax, eax
jle 0x62a7f2
push esi
push ebx
push edi
call fcn.0070d1d0
push esi
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.0070d1d0
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x62a6dd
add byte [edi + eax], 1
jne 0x62a6dd
sub eax, 1
jns 0x62a6d2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push ebx
call fcn.0058eeb0
add esp, 0x18
test eax, eax
je 0x62a7f2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push edi
call fcn.0058eeb0
add esp, 0x18
test eax, eax
je 0x62a7f2
xor eax, eax
test esi, esi
jle 0x62a79d
cmp esi, 0x40
jb 0x62a790
mov ecx, esi
and ecx, 0xffffffc0
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
movups xmm0, xmmword [esp + eax + 0x4c]
movups xmm1, xmmword [esp + eax + 0x8c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x4c], xmm1
movups xmm0, xmmword [esp + eax + 0x5c]
movups xmm1, xmmword [esp + eax + 0x9c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x5c], xmm1
add eax, 0x40
cmp eax, ecx
jl 0x62a730
cmp eax, esi
jge 0x62a79d
nop dword [eax]
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x62a790
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push ebx
push esi
push eax
call fcn.0058b110
add esp, 0xc
test eax, eax
je 0x62a7f2
push dword [esp + 0x18]
push dword [esp + 0x28]
push ebx
call fcn.00644650
add esp, 0xc
test eax, eax
jg 0x62a813
jne 0x62a7f2
push ebp
push 0
push dword [esp + 0x20]
mov ebx, 1
call fcn.00644600
add esp, 0xc
test eax, eax
jne 0x62a693
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.006f4f1e
add esp, 0xa0
ret
mov eax, 1
jmp 0x62a7f4
Function at 0x62cc40
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x62cd19
mov esi, dword [esp + 0x10]
test esi, esi
je 0x62ccce
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.005daa70
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x62cca2
call fcn.005a4a00
push str.ossl_ecx_key_op
push 0xaa
push str.cryptoececx_backend.c
call fcn.005a4b00
push 0
push 0x66
push 0x10
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.005aa0a0
add esp, 4
test esi, esi
jne 0x62ccb9
mov esi, eax
jmp 0x62ccd2
cmp esi, eax
je 0x62ccd2
call fcn.005a4a00
push str.ossl_ecx_key_op
push 0xb0
jmp 0x62cc84
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x62cd05
test esi, esi
je 0x62cd05
cmp esi, 0x40a
je 0x62ccfa
cmp esi, 0x43f
je 0x62ccfa
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x62ccff
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x62cd1d
call fcn.005a4a00
push str.ossl_ecx_key_op
push 0xb6
jmp 0x62cc84
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x62cd41
cmp esi, 0x43f
je 0x62cd41
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x62cd51
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.005c4120
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x62cd9b
call fcn.005a4a00
push str.ossl_ecx_key_op
push 0xbd
push str.cryptoececx_backend.c
call fcn.005a4b00
push ebx
push 0xc0100
push 0x10
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x62cdb7
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.0070d1d0
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.005c40a0
mov edi, eax
add esp, 4
test edi, edi
jne 0x62cdea
call fcn.005a4a00
push str.ossl_ecx_key_op
push 0xc7
push str.cryptoececx_backend.c
call fcn.005a4b00
push edi
push 0xc0100
jmp 0x62cec0
cmp ebp, 2
jne 0x62ce5c
test esi, esi
je 0x62ce8f
cmp esi, 0x40a
je 0x62ce17
cmp esi, 0x43f
je 0x62ce17
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x62ce1c
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.0059e830
add esp, 0x10
test eax, eax
jle 0x62ceca
cmp esi, 0x40a
jne 0x62ce4b
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x62ce8f
cmp esi, 0x40b
jne 0x62ce8f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x62ce8f
cmp esi, 0x40a
je 0x62ce7c
cmp esi, 0x43f
je 0x62ce7c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x62ce81
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.0070d1d0
add esp, 0xc
push ebx
call fcn.0062cee0
add esp, 4
test eax, eax
jne 0x62cdb0
call fcn.005a4a00
push str.ossl_ecx_key_op
push 0xdb
push str.cryptoececx_backend.c
call fcn.005a4b00
push 0
push 0xa6
push 0x10
call fcn.005a4bb0
add esp, 0x18
push ebx
call fcn.005c40c0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x6318d0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.0058fba0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x631952
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.0058eeb0
push edi
mov esi, eax
call fcn.0058fbd0
add esp, 0x1c
test esi, esi
jne 0x63196c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.006f4f1e
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00631110
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00631090
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006f4f1e
add esp, 0xe4
ret
Function at 0x6319e0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.0058fba0
add esp, 0xc
mov edi, eax
call fcn.0058fa00
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x631bee
test esi, esi
je 0x631bee
push 0
push edi
push esi
call fcn.0058f310
add esp, 0xc
test eax, eax
je 0x631bee
push 0x20
push ebx
push esi
call fcn.0058f350
add esp, 0xc
test eax, eax
je 0x631bee
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.0058f1e0
add esp, 0xc
test eax, eax
je 0x631bee
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.0058f310
add esp, 0xc
test eax, eax
je 0x631bee
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.0058f350
add esp, 0xc
test eax, eax
je 0x631bee
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.0058f350
add esp, 0xc
test eax, eax
je 0x631bee
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.0058f1e0
add esp, 0xc
test eax, eax
je 0x631bee
lea eax, [esp + 0x100]
push eax
call fcn.00636670
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00631110
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.00631090
push 0
push edi
push esi
call fcn.0058f310
add esp, 0x20
test eax, eax
je 0x631bee
push 0x20
push ebp
push esi
call fcn.0058f350
add esp, 0xc
test eax, eax
je 0x631bee
push 0x20
push dword [esp + 0x20]
push esi
call fcn.0058f350
add esp, 0xc
test eax, eax
je 0x631bee
push ebx
push dword [esp + 0x14]
push esi
call fcn.0058f350
add esp, 0xc
test eax, eax
je 0x631bee
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.0058f1e0
add esp, 0xc
test eax, eax
je 0x631bee
lea eax, [esp + 0x140]
push eax
call fcn.00636670
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.00632110
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00401320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.0058fbd0
push esi
call fcn.0058f970
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f4f1e
add esp, 0x174
ret
Function at 0x655720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.006f5e10
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x655768
call fcn.005a4a00
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.005a4b00
push 0
push 0x78
push 4
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.00655470
add esp, 4
test eax, eax
jne 0x6557a4
call fcn.005a4a00
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.005a4b00
push 0
push 0xb2
push 4
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.005cd880
push esi
call fcn.005cd630
push esi
mov dword [esp + 0x2c], eax
call fcn.005cd630
push esi
mov ebp, eax
call fcn.005cd630
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x655906
test ebp, ebp
je 0x6558dd
test ebx, ebx
je 0x6558d4
push 4
push ebp
call fcn.0058bd00
push 4
push ebx
call fcn.0058bd00
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x65580e
call fcn.0058bbd0
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x65581c
call fcn.0058bbd0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x6558d0
cmp dword [esi + 0x24], 0
je 0x6558d0
push 4
push eax
call fcn.0058bd00
push 4
push dword [esi + 0x24]
call fcn.0058bd00
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.006a6890
add esp, 0x3c
test eax, eax
je 0x6558d0
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.006a6890
add esp, 0x2c
test eax, eax
je 0x6558d0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00655400
add esp, 0x10
test eax, eax
js 0x6558d0
je 0x655870
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00655400
add esp, 0x10
test eax, eax
js 0x6558d0
je 0x655870
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.0058b2d0
add esp, 4
test ebx, ebx
je 0x6558ea
push ebx
call fcn.0058b2d0
add esp, 4
push dword [esp + 0x20]
call fcn.0058b2d0
push esi
call fcn.005cd530
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x6558dd
jmp 0x6558d4
Function at 0x662c50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.006f5e10
cmp dword [esp + 0xc], 0
push ebp
push esi
push edi
je 0x662e04
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
inc eax
push esi
push ebp
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push edi
push dword [esp + 0x2c]
call fcn.00662a80
add esp, 0x1c
test eax, eax
je 0x662e2c
push ebx
push 0x184
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.00587530
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x662cea
call fcn.005a4a00
push str.tls1_prf_alg
push 0x185
push str.providersimplementationskdfs_tls1_prf.c
call fcn.005a4b00
push ebx
push 0xc0100
push 0x39
call fcn.005a4bb0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x10]
sub edi, eax
add edi, dword [esp + 0x24]
push esi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call fcn.00662a80
add esp, 0x1c
test eax, eax
jne 0x662d2c
push 0x18b
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.00587610
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
xor edi, edi
test esi, esi
je 0x662de5
cmp esi, 0x40
jb 0x662dca
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, esi
cmp ebp, eax
ja 0x662d51
cmp ecx, ebx
jae 0x662dca
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, ebx
lea ecx, [ebx + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, edx
jb 0x662d70
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x1c], edi
cmp edi, esi
jae 0x662de5
lea ecx, [edi + ebp]
mov edx, esi
mov ebp, ebx
sub ebp, dword [esp + 0x30]
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x662dd7
push 0x190
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.00587610
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x2c]
call fcn.00662a80
add esp, 0x1c
test eax, eax
jne 0x662e33
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x669650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x6696c3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x6696c3
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0x14]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x669693
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x669680
mov eax, dword [ebx + 0x14]
pop esi
cmp edx, eax
jbe 0x6696c1
sub edx, eax
cmp edx, 0x10
jbe 0x6696a5
mov edx, 0x10
jmp 0x6696a9
test edx, edx
je 0x6696c1
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x6696b0
pop edi
pop ebx
pop ebp
ret
Function at 0x669940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.006f5e10
mov eax, dword [0x8312b0]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x88]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x6699a0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x6699c7
lea edi, [edx + 0x20]
jmp 0x6699f2
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x6699d1
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.005f0eb0
add esp, 0x14
test eax, eax
je 0x669b09
cmp dword [esp + 0x14], edi
jne 0x669b09
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.0070d1d0
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x669a9f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x669a5f
test ecx, ecx
jne 0x669a5f
test eax, eax
je 0x669a82
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.006696d0
add esp, 0x1c
test eax, eax
je 0x669b09
test edi, edi
je 0x669ac2
mov eax, dword [esp + 0x1c]
push dword [eax + 0x80]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.00669650
add esp, 0xc
jmp 0x669ac2
push dword [esp + 0x90]
push ebp
push esi
call fcn.00669650
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.00669650
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.005f0e80
add esp, 0x18
test eax, eax
je 0x669b09
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.005f0e80
add esp, 0x18
test eax, eax
je 0x669b09
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.006f4f1e
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006f4f1e
add esp, 0x74
ret