joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5f70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0047a3d0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x4b5ff0
mov cl, byte [edi]
test cl, cl
je 0x4b5ff0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x4b5fa0
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x4b60e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0047a3d0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x4b6165
mov al, byte [ebx]
test al, al
je 0x4b6165
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.004c88f0
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or eax, esi
xor eax, edi
mov esi, eax
mov al, byte [ebx]
mov dword [esp + 0x10], esi
test al, al
jne 0x4b6107
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4be410
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4be4d9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4be431
cmp al, 0x6b
jne 0x4be4d9
inc ecx
cmp al, 0x6b
jne 0x4be492
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4be452
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4be452
cmp dl, 0xbb
jne 0x4be466
inc eax
cmp eax, esi
jl 0x4be440
sub esi, eax
test eax, eax
jne 0x4be495
call fcn.00486d10
push str.RSA_padding_check_X931
push 0x56
jmp 0x4be472
call fcn.00486d10
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.00486e10
push 0
push 0x8a
push 4
call fcn.00486ec0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4be4c7
call fcn.00486d10
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.00486e10
push 0
push 0x8b
push 4
call fcn.00486ec0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.0059ed80
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.00486d10
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.00486e10
push 0
push 0x89
push 4
call fcn.00486ec0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x4df2b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x4df2f2
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
add edi, esi
add ebx, esi
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x4df2d1
pop edi
pop ebx
pop esi
ret
Function at 0x4ea350
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4ea377
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4ea366
pop edi
movzx eax, dl
pop esi
ret
Function at 0x4f12b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0047a3d0
mov eax, dword [0x665024]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xc0]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebx
call fcn.0048b0c0
push ebp
push 0
push ebx
mov dword [esp + 0x2c], eax
call fcn.005269e0
add esp, 0x10
test eax, eax
je 0x4f14b1
mov ebx, dword [esp + 0xcc]
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x4f1364
push 0
push esi
push ebx
push dword [esp + 0x28]
call fcn.004e7ec0
add esp, 0x10
test eax, eax
jle 0x4f14b2
push esi
push ebx
push edi
call fcn.0059ed80
push esi
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.0059ed80
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x4f138d
add byte [edi + eax], 1
jne 0x4f138d
sub eax, 1
jns 0x4f1382
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push ebx
call fcn.0047e580
add esp, 0x18
test eax, eax
je 0x4f14b2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push edi
call fcn.0047e580
add esp, 0x18
test eax, eax
je 0x4f14b2
xor eax, eax
test esi, esi
jle 0x4f145d
cmp esi, 0x40
jb 0x4f1449
mov ecx, esi
and ecx, 0x8000003f
jns 0x4f13e9
dec ecx
or ecx, 0xffffffc0
inc ecx
mov edx, esi
sub edx, ecx
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
movups xmm0, xmmword [esp + eax + 0x4c]
movups xmm1, xmmword [esp + eax + 0x8c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x4c], xmm1
movups xmm0, xmmword [esp + eax + 0x5c]
movups xmm1, xmmword [esp + eax + 0x9c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x5c], xmm1
add eax, 0x40
cmp eax, edx
jl 0x4f13f0
cmp eax, esi
jge 0x4f145d
nop dword [eax]
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x4f1450
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push ebx
push esi
push eax
call fcn.00489a40
add esp, 0xc
test eax, eax
je 0x4f14b2
push dword [esp + 0x18]
push dword [esp + 0x28]
push ebx
call fcn.00526a30
add esp, 0xc
test eax, eax
jg 0x4f14d3
jne 0x4f14b2
push ebp
push 0
push dword [esp + 0x20]
mov ebx, 1
call fcn.005269e0
add esp, 0xc
test eax, eax
jne 0x4f1343
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.004797c8
add esp, 0xa0
ret
mov eax, 1
jmp 0x4f14b4
Function at 0x4f4280
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x4f4358
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4f430d
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.004bef50
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x4f42e2
call fcn.00486d10
push str.ossl_ecx_key_op
push 0xaa
push str.cryptoececx_backend.c
call fcn.00486e10
push 0
push 0x66
push 0x10
call fcn.00486ec0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
push dword [esi]
call fcn.004938e0
mov esi, dword [esp + 0x20]
add esp, 4
test esi, esi
jne 0x4f42f8
mov esi, eax
jmp 0x4f4311
cmp esi, eax
je 0x4f4311
call fcn.00486d10
push str.ossl_ecx_key_op
push 0xb0
jmp 0x4f42c4
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x4f4344
test esi, esi
je 0x4f4344
cmp esi, 0x40a
je 0x4f4339
cmp esi, 0x43f
je 0x4f4339
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4f433e
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x4f435c
call fcn.00486d10
push str.ossl_ecx_key_op
push 0xb6
jmp 0x4f42c4
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x4f4380
cmp esi, 0x43f
je 0x4f4380
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x4f4390
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.004a7ad0
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4f43da
call fcn.00486d10
push str.ossl_ecx_key_op
push 0xbd
push str.cryptoececx_backend.c
call fcn.00486e10
push ebx
push 0xc0100
push 0x10
call fcn.00486ec0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x4f43f6
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.0059ed80
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.004a7a50
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f4429
call fcn.00486d10
push str.ossl_ecx_key_op
push 0xc7
push str.cryptoececx_backend.c
call fcn.00486e10
push edi
push 0xc0100
jmp 0x4f44ff
cmp ebp, 2
jne 0x4f449b
test esi, esi
je 0x4f44ce
cmp esi, 0x40a
je 0x4f4456
cmp esi, 0x43f
je 0x4f4456
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4f445b
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.004e84b0
add esp, 0x10
test eax, eax
jle 0x4f4509
cmp esi, 0x40a
jne 0x4f448a
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x4f44ce
cmp esi, 0x40b
jne 0x4f44ce
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x4f44ce
cmp esi, 0x40a
je 0x4f44bb
cmp esi, 0x43f
je 0x4f44bb
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x4f44c0
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.0059ed80
add esp, 0xc
push ebx
call fcn.004f4520
add esp, 4
test eax, eax
jne 0x4f43ef
call fcn.00486d10
push str.ossl_ecx_key_op
push 0xdb
push str.cryptoececx_backend.c
call fcn.00486e10
push 0
push 0xa6
push 0x10
call fcn.00486ec0
add esp, 0x18
push ebx
call fcn.004a7a70
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4f8d70
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.0047a3d0
mov eax, dword [0x665024]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.0047ef80
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4f8df2
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.0047e580
push edi
mov esi, eax
call fcn.0047efb0
add esp, 0x1c
test esi, esi
jne 0x4f8e0c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00492980
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.004797c8
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004f8630
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004f85b0
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00492980
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004797c8
add esp, 0xe4
ret
Function at 0x4f8e80
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.0047a3d0
mov eax, dword [0x665024]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.0047ef80
add esp, 0xc
mov edi, eax
call fcn.0047eef0
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x4f908e
test esi, esi
je 0x4f908e
push 0
push edi
push esi
call fcn.0047e9f0
add esp, 0xc
test eax, eax
je 0x4f908e
push 0x20
push ebx
push esi
call fcn.0047ea30
add esp, 0xc
test eax, eax
je 0x4f908e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.0047e8c0
add esp, 0xc
test eax, eax
je 0x4f908e
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.0047e9f0
add esp, 0xc
test eax, eax
je 0x4f908e
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.0047ea30
add esp, 0xc
test eax, eax
je 0x4f908e
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.0047ea30
add esp, 0xc
test eax, eax
je 0x4f908e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.0047e8c0
add esp, 0xc
test eax, eax
je 0x4f908e
lea eax, [esp + 0x100]
push eax
call fcn.004fda10
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004f8630
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.004f85b0
push 0
push edi
push esi
call fcn.0047e9f0
add esp, 0x20
test eax, eax
je 0x4f908e
push 0x20
push ebp
push esi
call fcn.0047ea30
add esp, 0xc
test eax, eax
je 0x4f908e
push 0x20
push dword [esp + 0x20]
push esi
call fcn.0047ea30
add esp, 0xc
test eax, eax
je 0x4f908e
push ebx
push dword [esp + 0x14]
push esi
call fcn.0047ea30
add esp, 0xc
test eax, eax
je 0x4f908e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.0047e8c0
add esp, 0xc
test eax, eax
je 0x4f908e
lea eax, [esp + 0x140]
push eax
call fcn.004fda10
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.004f95c0
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00492980
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00492980
push edi
call fcn.0047efb0
push esi
call fcn.0047ee60
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004797c8
add esp, 0x174
ret
Function at 0x524330
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0047a3d0
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov esi, dword [esi + 0x64]
mov edx, dword [esi + 0x70]
test edx, edx
je 0x524399
test ebp, ebp
je 0x524379
nop
cmp edx, 0x40
jae 0x524379
mov al, byte [edx + esi + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ecx], al
inc ecx
mov dword [esp + 0x18], ecx
sub ebp, 1
jne 0x524360
mov dword [esi + 0x70], edx
test ebp, ebp
je 0x524446
cmp edx, 0x40
jne 0x524399
mov dword [esi + 0x70], 0
add dword [esi + 0x20], 1
jne 0x524399
inc dword [esi + 0x24]
mov edx, dword [esi + 0x20]
mov eax, ebp
and eax, 0x3f
sub ebp, eax
mov dword [esp + 0x10], eax
push edi
cmp ebp, 0x40
jb 0x5243ff
nop dword [eax]
mov eax, ebp
mov edi, edx
shr eax, 6
xor ecx, ecx
add edx, eax
cmp edx, eax
cmovae ecx, edx
neg edi
cmp edx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1c]
cmovae edi, eax
lea eax, [esi + 0x20]
push eax
push esi
shl edi, 6
push edi
push ebx
push ecx
call fcn.005771e0
mov eax, dword [esp + 0x24]
add esp, 0x14
add dword [esp + 0x1c], edi
sub ebp, edi
add ebx, edi
mov dword [esi + 0x20], eax
test eax, eax
jne 0x5243f8
inc dword [esi + 0x24]
mov edx, eax
cmp ebp, 0x40
jae 0x5243b0
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x524445
push 0x40
lea edi, [esi + 0x30]
push 0
push edi
call fcn.0059f880
lea eax, [esi + 0x20]
push eax
push esi
push 0x40
push edi
push edi
call fcn.005771e0
add esp, 0x20
xor edi, edi
test ebp, ebp
je 0x524442
mov edx, dword [esp + 0x1c]
sub ebx, edx
mov al, byte [esi + edi + 0x30]
lea ecx, [edi + edx]
xor al, byte [ebx + ecx]
inc edi
mov byte [ecx], al
cmp edi, ebp
jb 0x524431
mov dword [esi + 0x70], ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x529a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0047a3d0
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x529ac8
call fcn.00486d10
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00486e10
push 0
push 0x78
push 4
call fcn.00486ec0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.005297d0
add esp, 4
test eax, eax
jne 0x529b04
call fcn.00486d10
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00486e10
push 0
push 0xb2
push 4
call fcn.00486ec0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.0048afc0
push esi
call fcn.0048ad60
push esi
mov dword [esp + 0x2c], eax
call fcn.0048ad60
push esi
mov ebp, eax
call fcn.0048ad60
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x529c34
test ebp, ebp
je 0x529c41
test ebx, ebx
je 0x529c34
push 4
push ebp
call fcn.0048a6f0
push 4
push ebx
call fcn.0048a6f0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x529b6e
call fcn.0048a5b0
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x529b7c
call fcn.0048a5b0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x529c30
cmp dword [esi + 0x24], 0
je 0x529c30
push 4
push eax
call fcn.0048a6f0
push 4
push dword [esi + 0x24]
call fcn.0048a6f0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.005897b0
add esp, 0x3c
test eax, eax
je 0x529c30
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.005897b0
add esp, 0x2c
test eax, eax
je 0x529c30
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00529760
add esp, 0x10
test eax, eax
js 0x529c30
je 0x529bd0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00529760
add esp, 0x10
test eax, eax
js 0x529c30
je 0x529bd0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
test ebp, ebp
je 0x529c41
push ebp
call fcn.00489bb0
add esp, 4
test ebx, ebx
je 0x529c4e
push ebx
call fcn.00489bb0
add esp, 4
push dword [esp + 0x20]
call fcn.00489bb0
push esi
call fcn.0048ac60
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x536fc0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
push ebp
push esi
push edi
je 0x53714c
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
inc ebp
push esi
push dword [esp + 0x2c]
shr ebp, 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebp
push edi
push dword [esp + 0x28]
call fcn.00536df0
add esp, 0x1c
test eax, eax
je 0x537174
push ebx
push 0x186
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.004867f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x53704a
call fcn.00486d10
push str.tls1_prf_alg
push 0x187
push str.providersimplementationskdfs_tls1_prf.c
call fcn.00486e10
push ebx
push 0xc0100
push 0x39
call fcn.00486ec0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
push ebx
push dword [esp + 0x30]
sub edi, ebp
push dword [esp + 0x30]
add edi, dword [esp + 0x30]
push ebp
push edi
push dword [esp + 0x30]
call fcn.00536df0
add esp, 0x1c
test eax, eax
jne 0x537087
push 0x18d
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.004868d0
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
xor edi, edi
test esi, esi
je 0x53712e
mov edx, dword [esp + 0x2c]
cmp esi, 0x40
jb 0x53710d
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x5370ac
cmp ecx, ebx
jae 0x53710d
mov ecx, esi
mov ebp, ebx
and ecx, 0xffffffc0
mov eax, edx
sub ebp, edx
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ebx + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ebx + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x5370c0
cmp edi, esi
jae 0x53712e
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x537120
push 0x192
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.004868d0
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x28]
call fcn.00536df0
add esp, 0x1c
test eax, eax
jne 0x53717a
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x53d660
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x53d6c3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x53d6c3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x14]
cmp edx, eax
mov ebx, eax
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x53d696
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x1c], al
inc ecx
cmp ecx, ebx
jb 0x53d687
mov eax, dword [edi + 0x14]
cmp edx, eax
jbe 0x53d6c1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor ecx, ecx
test edx, edx
je 0x53d6c1
nop dword [eax]
mov eax, dword [edi + 0x14]
add eax, ecx
mov al, byte [eax + esi]
xor byte [edi + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x53d6b0
pop edi
pop ebx
pop esi
ret
Function at 0x53d940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0047a3d0
mov eax, dword [0x665024]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x53d9a0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x53d9c7
lea edi, [edx + 0x20]
jmp 0x53d9f2
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x53d9d1
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.004cb700
add esp, 0x14
test eax, eax
je 0x53db09
cmp dword [esp + 0x14], edi
jne 0x53db09
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.0059ed80
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x53da9f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x53da5f
test ecx, ecx
jne 0x53da5f
test eax, eax
je 0x53da82
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.0053d6d0
add esp, 0x1c
test eax, eax
je 0x53db09
test edi, edi
je 0x53dac2
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.0053d660
add esp, 0xc
jmp 0x53dac2
push dword [esp + 0x90]
push ebp
push esi
call fcn.0053d660
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0053d660
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.004cb6d0
add esp, 0x18
test eax, eax
je 0x53db09
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.004cb6d0
add esp, 0x18
test eax, eax
je 0x53db09
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004797c8
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004797c8
add esp, 0x74
ret