joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5869c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d28e0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004d71f2
add esp, 0xc
test eax, eax
jg 0x5869ed
or eax, 0xffffffff
jmp 0x586b36
mov dword [ebp - 4], 0
jmp 0x5869ff
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x586a1f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp eax, edx
jne 0x586a1f
jmp 0x5869f6
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x586a33
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jl 0x586a59
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx]
test eax, eax
jne 0x586a59
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xff
jne 0x586a59
jmp 0x586a2a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x586a69
or eax, 0xffffffff
jmp 0x586b36
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jle 0x586a7c
mov eax, dword [ebp - 4]
shl eax, 3
jmp 0x586b36
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
xor eax, edx
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x7e
ja case.0x586ab3.1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x586b5c]
jmp dword [eax*4 + 0x586b3c]
mov dword [ebp - 0xc], 7
jmp 0x586afe
mov dword [ebp - 0xc], 6
jmp 0x586afe
mov dword [ebp - 0xc], 5
jmp 0x586afe
mov dword [ebp - 0xc], 4
jmp 0x586afe
mov dword [ebp - 0xc], 3
jmp 0x586afe
mov dword [ebp - 0xc], 2
jmp 0x586afe
mov dword [ebp - 0xc], 1
jmp 0x586afe
or eax, 0xffffffff
jmp 0x586b36
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
jne 0x586b26
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
movzx eax, byte [ebp - 5]
and edx, eax
movzx ecx, byte [ebp - 5]
cmp edx, ecx
je 0x586b2d
or eax, 0xffffffff
jmp 0x586b36
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
lea eax, [eax + edx*8]
mov esp, ebp
pop ebp
ret
Function at 0x5b4fd0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x3070dd17
mov dword [edx + 0x14], 0x9159015a
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 0x68581511
mov dword [edx + 0x2c], 0x8eb44a87
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xd0], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0xd4], 0x30
mov eax, 1
pop ebp
ret

Function at 0x5b50a0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x84caa73b
mov dword [ecx + 0xc], 0xbb67ae85
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xfe94f82b
mov dword [edx + 0x14], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0xade682d1
mov dword [ecx + 0x24], 0x510e527f
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 0x2b3e6c1f
mov dword [edx + 0x2c], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], 0x137e2179
mov dword [ecx + 0x3c], 0x5be0cd19
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xd0], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x5c9080
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x5c9177
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x5c90f6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.005c8cc0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5c90c4
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x5c9230
call fcn.005c9108
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x5c91cf
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.005c8cc0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5c9188
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x5c9230
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.005c8cc0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5c922b
jmp 0x5c9230
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5c92c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x5c93c0
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x5c933f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005c8e20
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5c930d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x5c9479
call fcn.005c9351
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x5c9418
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005c8f50
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5c93d1
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x5c9479
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005c8f50
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5c9474
jmp 0x5c9479
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5d00b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.004d28e0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x5d00de
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
and ecx, 2
je 0x5d00de
mov dword [ebp - 8], str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jmp 0x5d00e5
mov dword [ebp - 8], str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], edx
jmp 0x5d00f6
mov eax, dword [ebp - 4]
sub eax, 3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x5d0256
cmp dword [ebp - 4], 3
jl 0x5d01a1
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
shl edx, 0x10
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
shl ecx, 8
or edx, ecx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 2]
or edx, ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
and ecx, 0x3f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov cl, byte [eax + ecx]
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x10]
shr eax, 6
and eax, 0x3f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
mov byte [ecx], al
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0x10]
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
jmp 0x5d023f
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
shl edx, 0x10
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 2
jne 0x5d01c3
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
shl ecx, 8
or ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
and ecx, 0x3f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov cl, byte [eax + ecx]
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 4], 1
jne 0x5d020c
mov dword [ebp - 0x14], 0x3d
jmp 0x5d021f
mov eax, dword [ebp - 0x10]
shr eax, 6
and eax, 0x3f
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 0x14]
mov byte [eax], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x3d
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
add eax, 3
mov dword [ebp + 0x10], eax
jmp 0x5d00ed
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x5d3710
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004d28e0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x5d375b
call fcn.0052db80
push str.BIO_connect
push 0x5f
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.0052df00
add esp, 0xc
xor eax, eax
jmp 0x5d3918
mov eax, dword [ebp + 0x10]
and eax, 8
neg eax
sbb eax, eax
neg eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00582c20
add esp, 8
test eax, eax
jne 0x5d377f
xor eax, eax
jmp 0x5d3918
mov edx, dword [ebp + 0x10]
and edx, 4
je 0x5d3802
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x5d3802
call fcn.0052db80
push str.BIO_connect
push 0x69
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.0052df00
add esp, 0xc
call fcn.0052db80
push str.BIO_connect
push 0x6b
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x89
push 0x20
call fcn.0052df00
add esp, 0xc
xor eax, eax
jmp 0x5d3918
mov edx, dword [ebp + 0x10]
and edx, 0x10
je 0x5d3882
push 4
lea eax, [ebp - 4]
push eax
push 1
push 6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x5d3882
call fcn.0052db80
push str.BIO_connect
push 0x73
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.0052df00
add esp, 0xc
call fcn.0052db80
push str.BIO_connect
push 0x75
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x8a
push 0x20
call fcn.0052df00
add esp, 0xc
xor eax, eax
jmp 0x5d3918
mov edx, dword [ebp + 0xc]
push edx
call fcn.005775e0
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.005775c0
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x5d3913
push 0xffffffffffffffff
call fcn.0053d710
add esp, 4
test eax, eax
jne 0x5d390f
call fcn.0052db80
push str.BIO_connect
push 0x7d
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.0052df00
add esp, 0xc
call fcn.0052db80
push str.BIO_connect
push 0x7f
push str.crypto_bio_bio_sock2.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x67
push 0x20
call fcn.0052df00
add esp, 0xc
xor eax, eax
jmp 0x5d3918
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x61d530
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d28e0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp + 0x14]
jne 0x61d568
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp eax, 0x6a
je 0x61d59a
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp edx, 0x6b
je 0x61d59a
call fcn.0052db80
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x89
push 4
call fcn.0052df00
add esp, 0xc
or eax, 0xffffffff
jmp 0x61d6d3
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp ecx, 0x6b
jne 0x61d673
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jmp 0x61d5cd
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jge 0x61d633
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
movzx eax, byte [ebp - 0xd]
cmp eax, 0xba
jne 0x61d5f3
jmp 0x61d633
movzx ecx, byte [ebp - 0xd]
cmp ecx, 0xbb
je 0x61d631
call fcn.0052db80
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x8a
push 4
call fcn.0052df00
add esp, 0xc
or eax, 0xffffffff
jmp 0x61d6d3
jmp 0x61d5c4
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jne 0x61d671
call fcn.0052db80
push str.RSA_padding_check_X931
push 0x56
push str.crypto_rsa_rsa_x931.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x8a
push 4
call fcn.0052df00
add esp, 0xc
or eax, 0xffffffff
jmp 0x61d6d3
jmp 0x61d67c
mov eax, dword [ebp + 0x14]
sub eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x61d6bc
call fcn.0052db80
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.0052ddd0
add esp, 0xc
push 0
push 0x8b
push 4
call fcn.0052df00
add esp, 0xc
or eax, 0xffffffff
jmp 0x61d6d3
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004cfb70
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x643730
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xec
call fcn.004d28e0
mov eax, dword [0x7c9564]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
push str.SHA512
mov ecx, dword [ebp + 8]
push ecx
call fcn.00528eb0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x643773
xor eax, eax
jmp 0x643814
push 0
mov edx, dword [ebp - 4]
push edx
push 0
lea eax, [ebp - 0x48]
push eax
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.005286f0
add esp, 0x18
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 4]
push edx
call fcn.005296c0
add esp, 4
cmp dword [ebp - 0xec], 0
jne 0x6437ba
push 0x40
lea eax, [ebp - 0x48]
push eax
call fcn.005494a0
add esp, 8
xor eax, eax
jmp 0x643814
movzx ecx, byte [ebp - 0x48]
and ecx, 0xf8
mov byte [ebp - 0x48], cl
movzx edx, byte [ebp - 0x29]
and edx, 0x3f
mov byte [ebp - 0x29], dl
movzx eax, byte [ebp - 0x29]
or eax, 0x40
mov byte [ebp - 0x29], al
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0xe8]
push edx
call fcn.00638580
add esp, 8
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00635000
add esp, 8
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.005494a0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d0e4d
mov esp, ebp
pop ebp
ret
Function at 0x644230
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x140
call fcn.004d28e0
mov eax, dword [0x7c9564]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004cfb70
add esp, 0xc
movzx edx, byte [ebp - 0x118]
and edx, 0xf8
mov byte [ebp - 0x118], dl
movzx eax, byte [ebp - 0xf9]
and eax, 0x7f
mov byte [ebp - 0xf9], al
movzx ecx, byte [ebp - 0xf9]
or ecx, 0x40
mov byte [ebp - 0xf9], cl
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0xf8]
push eax
call fcn.00638580
add esp, 8
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x54]
push eax
call fcn.00638a70
add esp, 0xc
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00638ac0
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.00637010
add esp, 8
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.00635490
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006350a0
add esp, 8
push 0x20
lea edx, [ebp - 0x118]
push edx
call fcn.005494a0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d0e4d
mov esp, ebp
pop ebp
ret
Function at 0x68c8a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x68c8be
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x68c900
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x68c91e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x68c960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x68c982
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x68c9e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x68ca02
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x68ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x68ca8a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x68caf0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x68cb1a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x68cb80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x68cbdf

Function at 0x68cc60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x68ccbf