joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a2b0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 8
call fcn.005c5c30
mov eax, dword [esp + 0xc]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 4]
mov dword [esp], ecx
movzx ecx, byte [eax + 7]
push esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ecx, 8
shl esi, 8
or ecx, eax
or edx, esi
shl ecx, 0x10
or ecx, edx
cmp dword [esp + 0x24], 0
mov dword [esp + 8], ecx
pop esi
je 0x51a326
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.0051c530
jmp 0x51a33f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.0051c650
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
add esp, 0x10
shr ecx, 0x18
mov byte [eax + 6], dl
mov byte [eax + 7], cl
add esp, 8
ret
Function at 0x51e310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.005c5c30
mov eax, dword [0x65db30]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, dword [esp + 0x48]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [esp + 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x31], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x30], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x32], al
mov byte [esp + 0x33], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x24], edx
mov byte [esp + 0x34], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ebx
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
test ebp, ebp
je 0x51e4e4
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x40]
sub eax, ebp
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
test esi, esi
jne 0x51e45d
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.0051a5a0
mov ebx, dword [esp + 0x2c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x3d], al
mov eax, dword [esp + 0x30]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x40], al
shr eax, 0x18
shr ecx, 8
shr edx, 0x10
add esp, 0xc
inc dword [esp + 0x1c]
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], bl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], dl
mov cl, byte [esp + esi + 0x30]
xor cl, byte [ebp]
inc esi
mov byte [eax + ebp], cl
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x51e3f5
cmp dword [esp + 0x1c], 0
je 0x51e4cb
mov eax, dword [esp + 0x2c]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x24]
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5718
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005c5718
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c5718
add esp, 0x2c
ret
Function at 0x525a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, edx
test ebp, ebp
je 0x525a77
test esi, esi
je 0x525a77
push edi
mov edi, dword [ecx + 0xc]
cmp esi, edi
jae 0x525a3a
mov edi, esi
xor eax, eax
test edi, edi
je 0x525a4c
mov dl, byte [eax + ebp]
xor byte [ecx + eax + 0x10], dl
inc eax
cmp eax, edi
jb 0x525a40
mov eax, dword [ecx + 0xc]
pop edi
cmp esi, eax
jbe 0x525a77
sub esi, eax
cmp esi, 0x10
jbe 0x525a60
mov esi, 0x10
xor eax, eax
test esi, esi
je 0x525a77
mov edx, dword [ecx + 0xc]
add edx, eax
mov dl, byte [edx + ebp]
xor byte [ecx + eax + 0x30], dl
inc eax
cmp eax, esi
jb 0x525a66
pop esi
pop ebp
ret

Function at 0x525a80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005c5c30
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, ebp
sub esi, ebp
mov edi, 4
jmp 0x525ab0
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec edi
jne 0x525ab0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x10
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push edx
call fcn.004cb390
add esp, 0x14
pop edi
pop esi
pop ebp
test eax, eax
je 0x525b00
cmp dword [esp], 0x10
jne 0x525b00
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x5292c0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.005c5c30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.004b85c0
mov ebx, eax
push ebx
push esi
call fcn.004b8730
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x52934c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x529326
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x529319
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004b87a0
push esi
call fcn.004b8460
mov edi, eax
add esp, 0x10
test edi, edi
je 0x52934c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.004b85c0
mov ebx, eax
push ebx
push esi
call fcn.004b8730
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x5293be
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5293a4
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x529397
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.004b87a0
push esi
call fcn.004b8460
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x529344
push esi
call fcn.004b8460
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x52c9d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005c5c30
mov edx, dword [esp + 8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x64]
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
inc edi
test byte [ecx + 0x30], 1
je 0x52ca1b
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 8]
lea ebx, [edi + ecx]
cmp ebx, eax
jbe 0x52ca0b
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
add dword [esi + 0x14], ecx
add dword [esi + 0x18], ecx
sub eax, ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], eax
jmp 0x52ca26
mov eax, dword [esp + 0x18]
cmp edi, dword [eax + 8]
ja 0x52ca04
mov esi, eax
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
movzx ebx, byte [ecx + eax - 1]
mov ecx, dword [edx + 0x3cc]
push ecx
call fcn.004c94b0
push eax
call fcn.004f2640
add esp, 8
test eax, 0x200000
je 0x52ca5f
or edx, 0xffffffff
sub edx, ebx
add dword [esi + 8], edx
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esi + 8]
lea eax, [ebx + edi]
mov esi, ebp
sub esi, eax
xor esi, eax
mov ecx, ebp
xor ecx, eax
or esi, ecx
xor esi, ebp
shr esi, 0x1f
mov eax, 0x100
dec esi
mov dword [esp + 0x18], eax
cmp ebp, eax
jae 0x52ca8b
mov eax, ebp
mov dword [esp + 0x18], ebp
xor edi, edi
test eax, eax
je 0x52cae7
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x14]
mov ecx, ebx
shr ecx, 0x1f
lea edx, [eax + ebp - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
lea esp, [esp]
mov edx, ebx
sub edx, edi
shr edx, 0x1f
mov eax, edi
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc edi
and esi, eax
cmp edi, dword [esp + 0x18]
jb 0x52cab0
mov ecx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea eax, [esi - 1]
shr eax, 0x1f
not esi
shr esi, 0x1f
and eax, esi
neg eax
inc ebx
and ebx, eax
sub ebp, ebx
mov dword [ecx + 8], ebp
mov dword [esp + 0x24], eax
not eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
pop ebp
pop edi
and eax, 1
pop esi
or eax, edx
pop ebx
pop ecx
ret
Function at 0x52cb30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.005c5c30
mov eax, dword [0x65db30]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 8]
push ebp
mov ebp, dword [esp + 0xb8]
mov dword [esp + 0x14], eax
sub eax, ebp
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
cmp eax, ebp
jb 0x52cb86
cmp ebp, 0x40
jbe 0x52cb9f
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.005c5718
add esp, 0xa8
ret
push ebx
lea ebx, [esp + 0x30]
neg ebx
and ebx, 0x3f
lea ecx, [ebp + 0x100]
lea ebx, [esp + ebx + 0x30]
mov dword [esp + 0x24], ebx
cmp eax, ecx
jbe 0x52cbc6
sub eax, ebp
sub eax, 0x100
mov dword [esp + 0xc], eax
push edi
push ebp
push esi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
call sub.MSVCR100.dll_memset
mov edi, dword [esp + 0x1c]
mov eax, edi
add esp, 0xc
xor ecx, ecx
cmp eax, dword [esp + 0x14]
jae 0x52cc7a
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0xc0]
sub eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [esp + 0x30], eax
jmp 0x52cc0a
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
mov edx, edi
xor edx, dword [esp + 0x24]
xor esi, ebx
lea eax, [edx - 1]
not edx
shr edx, 0x1f
shr eax, 0x1f
and eax, edx
mov edx, edi
xor edx, ebx
mov ebx, dword [esp + 0x28]
or esi, edx
neg eax
xor esi, edi
mov edx, eax
or edx, dword [esp + 0x1c]
shr esi, 0x1f
inc dword [esp + 0x10]
neg esi
and edx, esi
mov esi, dword [esp + 0x18]
and eax, ecx
mov dword [esp + 0x1c], edx
or esi, eax
mov eax, dword [esp + 0x30]
and dl, byte [eax + edi]
inc ecx
or byte [ecx + ebx - 1], dl
mov edx, ecx
sub edx, ebp
xor edx, ebp
mov eax, ecx
xor eax, ebp
or edx, eax
xor edx, ecx
shr edx, 0x1f
neg edx
inc edi
and ecx, edx
mov dword [esp + 0x18], esi
cmp edi, dword [esp + 0x14]
jb 0x52cc06
xor eax, eax
pop edi
test ebp, ebp
je 0x52ccae
mov ecx, esi
xor ecx, 0x20
mov dl, byte [ecx + ebx]
mov cl, byte [esi + ebx]
mov edx, dword [esp + 0x28]
mov byte [edx + eax], cl
inc esi
mov ecx, esi
sub ecx, ebp
xor ecx, ebp
mov edx, esi
xor edx, ebp
or ecx, edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
inc eax
and esi, ecx
cmp eax, ebp
jb 0x52cc81
mov ecx, dword [esp + 0xb0]
pop ebx
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.005c5718
add esp, 0xa8
ret
Function at 0x5350a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x134
call fcn.005c5c30
mov eax, dword [0x65db30]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x148]
push ebx
mov ebx, dword [esp + 0x140]
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x150]
mov dword [esp + 0x14], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x148]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x535105
cmp esi, dword [edi]
je 0x535101
cmp ebx, eax
je 0x53517e
cmp ebp, eax
jl 0x53517e
mov dword [edi], esi
jmp 0x53510b
mov esi, dword [edi]
cmp esi, eax
je 0x53517e
push esi
call fcn.004f59d0
add esp, 4
test al, 2
jne 0x53517e
test ebx, ebx
je 0x535278
push esi
mov dword [esp + 0x14], 1
call fcn.00524df0
add esp, 4
cmp eax, 0x90
jg 0x53517e
cmp eax, ebp
jge 0x535199
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 4]
push ecx
push esi
push edx
call fcn.004cd7c0
add esp, 0xc
test eax, eax
je 0x53517e
mov eax, dword [edi + 4]
push ebp
push ebx
push eax
call fcn.004cd970
add esp, 0xc
test eax, eax
je 0x53517e
mov eax, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call fcn.004cd990
add esp, 0xc
test eax, eax
jne 0x5351b8
xor eax, eax
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c5718
add esp, 0x134
ret
cmp ebp, 0x90
ja 0x53517e
push ebp
lea ecx, [esp + 0x24]
push ebx
push ecx
call sub.MSVCR100.dll_memcpy
mov eax, ebp
add esp, 0xc
mov dword [esp + 0x1c], eax
jmp 0x5351bc
mov eax, dword [esp + 0x1c]
cmp eax, 0x90
je 0x5351da
mov edx, 0x90
sub edx, eax
push edx
lea eax, [esp + eax + 0x24]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x20]
xor cl, 0x36
mov byte [esp + eax + 0xb0], cl
inc eax
cmp eax, 0x90
jl 0x5351e0
mov ebx, dword [esp + 0x18]
mov edx, dword [edi + 8]
push ebx
push esi
push edx
call fcn.004cd7c0
add esp, 0xc
test eax, eax
je 0x53529b
push esi
call fcn.00524df0
mov ecx, dword [edi + 8]
push eax
lea eax, [esp + 0xb8]
push eax
push ecx
call fcn.004cd970
add esp, 0x10
test eax, eax
je 0x53529b
xor eax, eax
mov dl, byte [esp + eax + 0x20]
xor dl, 0x5c
mov byte [esp + eax + 0xb0], dl
inc eax
cmp eax, 0x90
jl 0x535231
mov eax, dword [edi + 0xc]
push ebx
push esi
push eax
call fcn.004cd7c0
add esp, 0xc
test eax, eax
je 0x53529b
push esi
call fcn.00524df0
mov edx, dword [edi + 0xc]
push eax
lea ecx, [esp + 0xb8]
push ecx
push edx
call fcn.004cd970
add esp, 0x10
test eax, eax
je 0x53529b
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.004cdaa0
add esp, 8
test eax, eax
je 0x535294
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], 0
je 0x5352bf
lea edx, [esp + 0x20]
push 0x90
push edx
call fcn.004e60d0
lea eax, [esp + 0xb8]
push 0x90
push eax
call fcn.004e60d0
add esp, 0x10
mov eax, dword [esp + 0x14]
jmp 0x535180
Function at 0x542b20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
push esi
test edx, edx
je 0x542b37
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x542b3c
mov esi, 0x625ed0
test ebp, ebp
jle 0x542c05
push ebx
push edi
mov edi, dword [esp + 0x14]
inc edi
jmp 0x542b50
movzx edx, byte [edi - 1]
cmp ebp, 3
jl 0x542ba1
movzx ebx, byte [edi]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + 1]
shl edx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
mov ebx, edx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 2], bl
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [ecx + 3], dl
jmp 0x542be9
shl edx, 0x10
cmp ebp, 2
jne 0x542bb1
movzx ebx, byte [edi]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
cmp ebp, 1
jne 0x542bd8
lea edx, [ebp + 0x3c]
jmp 0x542be2
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub ebp, 3
add ecx, 4
add eax, 4
add edi, 3
test ebp, ebp
jg 0x542b50
pop edi
pop ebx
pop esi
mov byte [ecx], 0
pop ebp
ret
pop esi
mov byte [ecx], al
pop ebp
ret
Function at 0x54b7b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.005c5c30
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.005068e0
add esp, 8
test eax, eax
jne 0x54b7eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x54b84d
xor ebx, ebx
test ebp, ebp
jle 0x54b9b0
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x54b82f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x54b808
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x54b800
jmp 0x54b9b0
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x40], eax
jle 0x54b9b0
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
mov dword [esp + 0x20], esi
cmp edi, esi
jle 0x54b98c
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x54b920
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x40]
jl 0x54b8f0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x54e6b0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x54e72f
test eax, eax
je 0x54e6fb
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.004e6c30
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x54e6fb
push 0x3b
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.0049a370
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x54e72b
cmp edi, 0x40a
je 0x54e722
cmp edi, 0x43f
je 0x54e722
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x54e727
mov eax, 0x20
cmp esi, eax
je 0x54e72f
push 0x41
jmp 0x54e6e0
push ebx
push 0x46
push str.cryptoececx_meth.c
push 0x40
call fcn.004a3230
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x54e765
push 0x48
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0049a370
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x54e77d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
jmp case.0x54e8ae.1036
cmp edi, 0x40a
je 0x54e79d
cmp edi, 0x43f
je 0x54e79d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x54e7a2
mov eax, 0x20
push 0x50
push str.cryptoececx_meth.c
push eax
call fcn.004b69d0
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x54e7d5
push 0x52
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0049a370
add esp, 0x14
jmp 0x54e828
cmp ebp, 2
jne 0x54e868
cmp edi, 0x40a
je 0x54e7fe
cmp edi, 0x43f
je 0x54e7fe
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x54e803
mov eax, 0x20
push eax
push esi
call fcn.004b8e60
add esp, 8
test eax, eax
jg 0x54e83e
push 0x57
push str.cryptoececx_meth.c
push esi
call fcn.004b69f0
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.cryptoececx_meth.c
push ebx
call fcn.004a32a0
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x54e857
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x54e89c
cmp edi, 0x40b
jne 0x54e89c
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x54e89c
cmp edi, 0x40a
je 0x54e888
cmp edi, 0x43f
je 0x54e888
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x54e88d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x54e8ae.1036
movzx ecx, byte [eax + 0x54e908]
jmp dword [ecx*4 + 0x54e8f4]
push esi
push ebx
call fcn.005ac390
jmp 0x54e8d7
push esi
push ebx
call fcn.005ac270
jmp 0x54e8d7
push esi
push ebx
call fcn.0059e860
jmp 0x54e8d7
push esi
push ebx
call fcn.0059c3e0
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.0049e4a0
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x558ad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
push ebx
mov esi, ecx
call fcn.004c94b0
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, 0x72
mov eax, dword [esp + 0x14]
jne 0x558bc6
push ebp
mov ebx, esi
push edi
shr ebx, 1
and esi, 1
push eax
lea ebp, [esi + ebx]
push ebp
push ecx
call fcn.004a8840
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push eax
call fcn.00558860
add esp, 0x14
test eax, eax
je 0x558b4a
push 0x104
push str.cryptokdf_tls1_prf.c
push edi
call fcn.004a31f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x558b50
push 0x105
push str.cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.0049a370
add esp, 0x14
pop ebp
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x18]
add ebx, dword [esp + 0x10]
push edi
push edx
push ebp
push ebx
call fcn.004a7770
mov ecx, dword [esp + 0x24]
push eax
mov edx, esi
call fcn.00558860
add esp, 0x14
test eax, eax
jne 0x558b8e
push 0x10a
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.004a32c0
add esp, 0x10
pop ebp
pop esi
xor eax, eax
pop ebx
ret
test edi, edi
je 0x558ba9
mov eax, dword [esp + 0x1c]
mov ecx, esi
sub ecx, eax
mov ebp, edi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x558ba0
push 0x10f
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.004a32c0
add esp, 0x10
pop ebp
pop esi
mov eax, 1
pop ebx
ret
mov edx, dword [esp + 0x18]
push edi
push eax
push esi
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.00558860
add esp, 0x14
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
ret