joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512930
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push ebp
call fcn.004d5600
mov ebx, eax
add esp, 4
test ebx, ebx
jg 0x51294a
xor eax, eax
jmp 0x51294d
lea eax, [ebx - 1]
push 0x121
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x20]
push str.cryptopropertyproperty_parse.c
push eax
call fcn.004d9090
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5129cb
push ebp
call fcn.004d5780
and dword [esi + 4], 0xfffffffe
add esp, 4
xor ebp, ebp
test ebx, ebx
jle 0x5129c9
push edi
lea edi, [esi + 0x14]
nop word [eax + eax]
push ebp
push dword [esp + 0x18]
call fcn.004d57c0
inc ebp
lea edi, [edi + 0x18]
add esp, 8
movups xmm0, xmmword [eax]
movups xmmword [edi - 0x24], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi - 0x14], xmm0
mov eax, dword [esi + 4]
mov ecx, dword [edi - 0x18]
or ecx, eax
xor ecx, eax
and ecx, 1
xor ecx, eax
mov dword [esi + 4], ecx
cmp ebp, ebx
jl 0x512990
pop edi
mov dword [esi], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x517990
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.0054e2d0
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.VCRUNTIME140.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x517a49
call fcn.004dd410
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.004dd510
add esp, 0xc
push esi
push dword [esp + 0x14]
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.004dd5c0
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
add esp, 0x14
call esi
cmp dword [eax], 2
je 0x517a19
call esi
cmp dword [eax], 6
je 0x517a19
mov esi, 0x80002
mov edi, 0x4d
jmp 0x517a21
mov esi, 0x80
lea edi, [esi - 0x35]
call fcn.004dd410
push str.BIO_new_file
push edi
push str.crypto_bio_bss_file.c
call fcn.004dd510
push 0
push esi
push 0x20
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x6637e8
call fcn.004d84f0
mov esi, eax
add esp, 4
test esi, esi
jne 0x517a6c
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x8000
push esi
call fcn.004d7d90
push edi
push ebx
push 0x6a
push esi
call fcn.004d7dc0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x551b70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.0062f130
mov eax, dword [0x6d3f68]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xc0]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebx
call fcn.0056af30
push ebp
push 0
push ebx
mov dword [esp + 0x2c], eax
call fcn.005ce7a0
add esp, 0x10
test eax, eax
je 0x551d61
mov ebx, dword [esp + 0xcc]
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x551c24
push 0
push esi
push ebx
push dword [esp + 0x28]
call fcn.004cdc60
add esp, 0x10
test eax, eax
jle 0x551d62
push esi
push ebx
push edi
call sub.VCRUNTIME140.dll_memcpy
push esi
lea eax, [esp + 0x7c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x551c4d
add byte [edi + eax], 1
jne 0x551c4d
sub eax, 1
jns 0x551c42
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push ebx
call fcn.004d22b0
add esp, 0x18
test eax, eax
je 0x551d62
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push edi
call fcn.004d22b0
add esp, 0x18
test eax, eax
je 0x551d62
xor eax, eax
test esi, esi
jle 0x551d0d
cmp esi, 0x40
jb 0x551d00
mov ecx, esi
and ecx, 0xffffffc0
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
movups xmm0, xmmword [esp + eax + 0x4c]
movups xmm1, xmmword [esp + eax + 0x8c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x4c], xmm1
movups xmm0, xmmword [esp + eax + 0x5c]
movups xmm1, xmmword [esp + eax + 0x9c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x5c], xmm1
add eax, 0x40
cmp eax, ecx
jl 0x551ca0
cmp eax, esi
jge 0x551d0d
nop dword [eax]
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x551d00
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push ebx
push esi
push eax
call fcn.00509a70
add esp, 0xc
test eax, eax
je 0x551d62
push dword [esp + 0x18]
push dword [esp + 0x28]
push ebx
call fcn.005ce7f0
add esp, 0xc
test eax, eax
jg 0x551d83
jne 0x551d62
push ebp
push 0
push dword [esp + 0x20]
mov ebx, 1
call fcn.005ce7a0
add esp, 0xc
test eax, eax
jne 0x551c03
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.0062e5ad
add esp, 0xa0
ret
mov eax, 1
jmp 0x551d64
Function at 0x557310
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x5573e9
mov esi, dword [esp + 0x10]
test esi, esi
je 0x55739e
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.004ef620
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x557372
call fcn.004dd410
push str.ossl_ecx_key_op
push 0x9f
push str.cryptoececx_backend.c
call fcn.004dd510
push 0
push 0x66
push 0x10
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.004db430
add esp, 4
test esi, esi
jne 0x557389
mov esi, eax
jmp 0x5573a2
cmp esi, eax
je 0x5573a2
call fcn.004dd410
push str.ossl_ecx_key_op
push 0xa5
jmp 0x557354
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x5573d5
test esi, esi
je 0x5573d5
cmp esi, 0x40a
je 0x5573ca
cmp esi, 0x43f
je 0x5573ca
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5573cf
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x5573ed
call fcn.004dd410
push str.ossl_ecx_key_op
push 0xab
jmp 0x557354
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x557411
cmp esi, 0x43f
je 0x557411
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x557421
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.00530e90
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x55746b
call fcn.004dd410
push str.ossl_ecx_key_op
push 0xb2
push str.cryptoececx_backend.c
call fcn.004dd510
push ebx
push 0xc0100
push 0x10
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x557487
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.00530e10
mov edi, eax
add esp, 4
test edi, edi
jne 0x5574ba
call fcn.004dd410
push str.ossl_ecx_key_op
push 0xbc
push str.cryptoececx_backend.c
call fcn.004dd510
push edi
push 0xc0100
jmp 0x557590
cmp ebp, 2
jne 0x55752c
test esi, esi
je 0x55755f
cmp esi, 0x40a
je 0x5574e7
cmp esi, 0x43f
je 0x5574e7
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x5574ec
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.004ce240
add esp, 0x10
test eax, eax
jle 0x55759a
cmp esi, 0x40a
jne 0x55751b
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x55755f
cmp esi, 0x40b
jne 0x55755f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x55755f
cmp esi, 0x40a
je 0x55754c
cmp esi, 0x43f
je 0x55754c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x557551
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebx
call fcn.005575b0
add esp, 4
test eax, eax
jne 0x557480
call fcn.004dd410
push str.ossl_ecx_key_op
push 0xd0
push str.cryptoececx_backend.c
call fcn.004dd510
push 0
push 0xa6
push 0x10
call fcn.004dd5c0
add esp, 0x18
push ebx
call fcn.00530e30
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x55bfa0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.0062f130
mov eax, dword [0x6d3f68]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.004d2f50
mov edi, eax
add esp, 0xc
test edi, edi
je 0x55c022
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.004d22b0
push edi
mov esi, eax
call fcn.004d2f80
add esp, 0x1c
test esi, esi
jne 0x55c03c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.0062e5ad
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.0055b7e0
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0055b760
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0062e5ad
add esp, 0xe4
ret
Function at 0x55c0b0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.0062f130
mov eax, dword [0x6d3f68]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.004d2f50
add esp, 0xc
mov edi, eax
call fcn.004d2db0
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x55c2be
test esi, esi
je 0x55c2be
push 0
push edi
push esi
call fcn.004d2710
add esp, 0xc
test eax, eax
je 0x55c2be
push 0x20
push ebx
push esi
call fcn.004d2750
add esp, 0xc
test eax, eax
je 0x55c2be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.004d25e0
add esp, 0xc
test eax, eax
je 0x55c2be
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.004d2710
add esp, 0xc
test eax, eax
je 0x55c2be
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.004d2750
add esp, 0xc
test eax, eax
je 0x55c2be
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.004d2750
add esp, 0xc
test eax, eax
je 0x55c2be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.004d25e0
add esp, 0xc
test eax, eax
je 0x55c2be
lea eax, [esp + 0x100]
push eax
call fcn.00560d40
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0055b7e0
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.0055b760
push 0
push edi
push esi
call fcn.004d2710
add esp, 0x20
test eax, eax
je 0x55c2be
push 0x20
push ebp
push esi
call fcn.004d2750
add esp, 0xc
test eax, eax
je 0x55c2be
push 0x20
push dword [esp + 0x20]
push esi
call fcn.004d2750
add esp, 0xc
test eax, eax
je 0x55c2be
push ebx
push dword [esp + 0x14]
push esi
call fcn.004d2750
add esp, 0xc
test eax, eax
je 0x55c2be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.004d25e0
add esp, 0xc
test eax, eax
je 0x55c2be
lea eax, [esp + 0x140]
push eax
call fcn.00560d40
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0055c7e0
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00401320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.004d2f80
push esi
call fcn.004d2d20
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0062e5ad
add esp, 0x174
ret
Function at 0x5686f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x5687b9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x568711
cmp al, 0x6b
jne 0x5687b9
inc ecx
cmp al, 0x6b
jne 0x568772
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x568732
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x568732
cmp dl, 0xbb
jne 0x568746
inc eax
cmp eax, esi
jl 0x568720
sub esi, eax
test eax, eax
jne 0x568775
call fcn.004dd410
push str.RSA_padding_check_X931
push 0x56
jmp 0x568752
call fcn.004dd410
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.004dd510
push 0
push 0x8a
push 4
call fcn.004dd5c0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x5687a7
call fcn.004dd410
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.004dd510
push 0
push 0x8b
push 4
call fcn.004dd5c0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.004dd410
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.004dd510
push 0
push 0x89
push 4
call fcn.004dd5c0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x58be50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0062f130
cmp dword [esp + 0xc], 0
push ebp
push esi
push edi
je 0x58c004
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
inc eax
push esi
push ebp
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push edi
push dword [esp + 0x2c]
call fcn.0058bc80
add esp, 0x1c
test eax, eax
je 0x58c02c
push ebx
push 0x184
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.004d9090
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x58beea
call fcn.004dd410
push str.tls1_prf_alg
push 0x185
push str.providersimplementationskdfs_tls1_prf.c
call fcn.004dd510
push ebx
push 0xc0100
push 0x39
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x10]
sub edi, eax
add edi, dword [esp + 0x24]
push esi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push edi
push dword [esp + 0x34]
call fcn.0058bc80
add esp, 0x1c
test eax, eax
jne 0x58bf2c
push 0x18b
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.004d9180
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
xor edi, edi
test esi, esi
je 0x58bfe5
cmp esi, 0x40
jb 0x58bfca
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, ebx
add ecx, esi
cmp ebp, eax
ja 0x58bf51
cmp ecx, ebx
jae 0x58bfca
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, ebx
lea ecx, [ebx + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x34]
mov ebp, dword [esp + 0x1c]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add edi, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, edx
jb 0x58bf70
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x1c], edi
cmp edi, esi
jae 0x58bfe5
lea ecx, [edi + ebp]
mov edx, esi
mov ebp, ebx
sub ebp, dword [esp + 0x30]
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x58bfd7
push 0x190
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.004d9180
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x2c]
call fcn.0058bc80
add esp, 0x1c
test eax, eax
jne 0x58c033
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x5928d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x592943
mov edx, dword [esp + 0x10]
test edx, edx
je 0x592943
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov eax, dword [ebx + 0x14]
cmp edx, eax
mov edi, eax
cmovb edi, edx
test edi, edi
je 0x592913
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x592900
mov eax, dword [ebx + 0x14]
pop esi
cmp edx, eax
jbe 0x592941
sub edx, eax
cmp edx, 0x10
jbe 0x592925
mov edx, 0x10
jmp 0x592929
test edx, edx
je 0x592941
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x592930
pop edi
pop ebx
pop ebp
ret
Function at 0x592bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0062f130
mov eax, dword [0x6d3f68]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x592c20
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x592c47
lea edi, [edx + 0x20]
jmp 0x592c72
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x592c51
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.004cbd30
add esp, 0x14
test eax, eax
je 0x592d89
cmp dword [esp + 0x14], edi
jne 0x592d89
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x592d1f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x592cdf
test ecx, ecx
jne 0x592cdf
test eax, eax
je 0x592d02
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.00592950
add esp, 0x1c
test eax, eax
je 0x592d89
test edi, edi
je 0x592d42
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.005928d0
add esp, 0xc
jmp 0x592d42
push dword [esp + 0x90]
push ebp
push esi
call fcn.005928d0
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.005928d0
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.004cbd00
add esp, 0x18
test eax, eax
je 0x592d89
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.004cbd00
add esp, 0x18
test eax, eax
je 0x592d89
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.0062e5ad
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0062e5ad
add esp, 0x74
ret
Function at 0x5960c5
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x59600d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.00530e90
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x596054
call fcn.004dd410
push str.ecx_gen
push 0x238
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.004dd510
push edi
push 0xc0100
push 0x39
call fcn.004dd5c0
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x59609f
push esi
push edi
call fcn.00530e10
mov esi, eax
add esp, 4
test esi, esi
jne 0x5960a2
call fcn.004dd410
push str.ecx_gen
push 0x241
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.004dd510
push esi
push 0xc0100
push 0x39
call fcn.004dd5c0
add esp, 0x18
push edi
call fcn.00530e30
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.004ce240
add esp, 0x10
test eax, eax
jle 0x596093
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x5960be
jmp dword [eax*4 + 0x59613c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.0055c5e0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.00565890
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.0055bfa0
jmp 0x596127
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.00563c80
add esp, 0x10
test eax, eax
je 0x596093
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret