joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcf10
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.00456ee0
add esp, 8
test esi, esi
jg 0x4bcf67
je 0x4bcf49
cmp esi, 0xffffffff
jne 0x4bcf67
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004bd2a0
add esp, 4
test eax, eax
je 0x4bcf67
push 0xa
push edi
call fcn.00457d70
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x4bd3a0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.0057a200
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x4bd3e8
call fcn.00464f60
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
push 0
push 0x87
push 0x20
call fcn.00464fe0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.00476140
add esp, 8
test eax, eax
jne 0x4bd407
pop ebx
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4bd482
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x4bd482
call fcn.00464f60
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00464fe0
call fcn.00464f60
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
push 0
push 0x89
push 0x20
call fcn.00464fe0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
test bl, 0x10
je 0x4bd4f3
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x4bd4f3
call fcn.00464f60
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00464fe0
call fcn.00464f60
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
push 0
push 0x8a
push 0x20
call fcn.00464fe0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.00477320
add esp, 4
push eax
push esi
call fcn.0052d9f0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4bd581
push eax
call fcn.004bd360
add esp, 4
test eax, eax
jne 0x4bd57a
call fcn.00464f60
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.00464fe0
call fcn.00464f60
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.00464fb0
push 0
push 0x67
push 0x20
call fcn.00464fe0
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x4da010
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x4da052
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
add edi, esi
add ebx, esi
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x4da031
pop edi
pop ebx
pop esi
ret

Function at 0x4e9700
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x4ec8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0057a200
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x4ec8e8
call fcn.00464f60
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00464fb0
push 0
push 0x78
push 4
call fcn.00464fe0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.004ec5f0
add esp, 4
test eax, eax
jne 0x4ec924
call fcn.00464f60
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.00464fb0
push 0
push 0xb2
push 4
call fcn.00464fe0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004bc2b0
push esi
call fcn.004bc190
push esi
mov dword [esp + 0x2c], eax
call fcn.004bc190
push esi
mov ebp, eax
call fcn.004bc190
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x4eca54
test ebp, ebp
je 0x4eca61
test ebx, ebx
je 0x4eca54
push 4
push ebp
call fcn.0046eeb0
push 4
push ebx
call fcn.0046eeb0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x4ec98e
call fcn.0046ed80
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x4ec99c
call fcn.0046ed80
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4eca50
cmp dword [esi + 0x24], 0
je 0x4eca50
push 4
push eax
call fcn.0046eeb0
push 4
push dword [esi + 0x24]
call fcn.0046eeb0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.005391e0
add esp, 0x3c
test eax, eax
je 0x4eca50
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.005391e0
add esp, 0x2c
test eax, eax
je 0x4eca50
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.004ec580
add esp, 0x10
test eax, eax
js 0x4eca50
je 0x4ec9f0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.004ec580
add esp, 0x10
test eax, eax
js 0x4eca50
je 0x4ec9f0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
test ebp, ebp
je 0x4eca61
push ebp
call fcn.0046e680
add esp, 4
test ebx, ebx
je 0x4eca6e
push ebx
call fcn.0046e680
add esp, 4
push dword [esp + 0x20]
call fcn.0046e680
push esi
call fcn.004bc100
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x4f4d60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0057a200
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax + 0x64]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [ecx + 0x70]
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x4f4dc6
test edi, edi
je 0x4f4da6
nop
cmp edx, 0x40
jae 0x4f4da6
mov al, byte [edx + ecx + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
sub edi, 1
jne 0x4f4d90
mov dword [ecx + 0x70], edx
test edi, edi
je 0x4f4e7c
cmp edx, 0x40
jne 0x4f4dc6
mov dword [ecx + 0x70], 0
add dword [ecx + 0x20], 1
jne 0x4f4dc6
inc dword [ecx + 0x24]
mov eax, edi
lea edx, [ecx + 0x20]
and eax, 0x3f
mov dword [esp + 0x14], edx
sub edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push esi
cmp edi, 0x40
jb 0x4f4e29
mov esi, edi
shr esi, 6
add eax, esi
mov dword [esp + 0x14], eax
cmp eax, esi
jae 0x4f4df9
sub esi, eax
mov dword [esp + 0x14], 0
push edx
push ecx
shl esi, 6
push esi
push ebx
push ebp
call fcn.00444c00
mov edx, dword [esp + 0x2c]
add esp, 0x14
mov eax, dword [esp + 0x14]
sub edi, esi
mov ecx, dword [esp + 0x20]
add ebx, esi
add ebp, esi
mov dword [edx], eax
test eax, eax
jne 0x4f4e24
inc dword [ecx + 0x24]
cmp edi, 0x40
jae 0x4f4de0
cmp dword [esp + 0x10], 0
je 0x4f4e7b
push 0x40
lea edi, [ecx + 0x30]
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x24]
mov esi, dword [esp + 0x30]
push esi
push 0x40
push edi
push edi
call fcn.00444c00
mov eax, dword [esp + 0x30]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x4f4e78
sub ebx, ebp
mov esi, eax
lea ecx, [edx + ebp]
mov al, byte [ebx + ecx]
xor al, byte [edi + edx]
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x4f4e60
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], eax
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x4f89d0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.0045fe60
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4f8a14
push 0
push 0
push edi
push 0x4f8a30
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4f8a14
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.0045fc90
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x50d800
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0057a200
cmp dword [esp + 0xc], 0
je 0x50d93d
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
inc eax
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x30]
push edi
push esi
push dword [esp + 0x30]
shr eax, 1
push dword [esp + 0x30]
mov dword [esp + 0x1c], eax
push eax
push ebp
push dword [esp + 0x2c]
call fcn.0050d630
add esp, 0x1c
test eax, eax
jne 0x50d850
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
push 0x1b8
push str.providersimplementationskdfs_tls1_prf.c
push edi
call fcn.0045fc10
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x50d8a4
mov eax, dword [esp + 0x10]
sub ebp, eax
add ebp, dword [esp + 0x24]
push edi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push ebp
push dword [esp + 0x34]
call fcn.0050d630
add esp, 0x1c
test eax, eax
jne 0x50d8ac
push 0x1bd
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.0045fd20
add esp, 0x10
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
xor edx, edx
test edi, edi
je 0x50d91e
cmp edi, 0x20
jb 0x50d8ff
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x50d8c9
cmp ecx, ebx
jae 0x50d8ff
mov ecx, edi
mov ebp, ebx
and ecx, 0xffffffe0
mov eax, esi
sub ebp, esi
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x50d8d4
cmp edx, edi
jae 0x50d91e
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
mov esi, edi
sub esi, edx
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x50d910
push 0x1c2
push str.providersimplementationskdfs_tls1_prf.c
push edi
push ebx
call fcn.0045fd20
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x20]
call fcn.0050d630
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop ecx
ret
Function at 0x515820
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
xor esi, esi
lea ecx, [edx + 0x3f8]
push edi
lea edi, [eax + 0x3f8]
cmp eax, ecx
ja 0x51585f
cmp edi, edx
jb 0x51585f
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x515847
pop edi
pop esi
ret
mov edi, edx
lea ecx, [eax + 0x10]
sub edi, eax
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
lea ecx, [ecx + 0x20]
movups xmm1, xmmword [edx + esi*8]
add esi, 4
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [edi + ecx - 0x20]
movups xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp esi, 0x80
jl 0x515870
pop edi
pop esi
ret

Function at 0x5179f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x517a53
mov edx, dword [esp + 0x10]
test edx, edx
je 0x517a53
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi + 0x14]
cmp edx, ebx
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x517a21
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x1c], al
inc ecx
cmp ecx, ebx
jb 0x517a15
mov eax, dword [edi + 0x14]
cmp edx, eax
jbe 0x517a51
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor eax, eax
test edx, edx
je 0x517a51
nop word [eax + eax]
mov ecx, dword [edi + 0x14]
add ecx, eax
mov cl, byte [ecx + esi]
xor byte [edi + eax + 0x3c], cl
inc eax
cmp eax, edx
jb 0x517a40
pop edi
pop ebx
pop esi
ret
Function at 0x517c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.0057a200
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x80]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], eax
mov eax, dword [esp + 0x94]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x14], ecx
mov ecx, 1
push edi
mov dword [esp + 0x14], eax
movups xmmword [esp + 0x1c], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x517cd0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x2c], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x517cf6
mov al, 0x20
jmp 0x517d1e
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x517d00
movups xmm0, xmmword [esi + 0x3c]
mov al, 0x30
movups xmmword [esp + 0x3c], xmm0
movzx edi, al
lea eax, [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x58]
push eax
push dword [esi]
call fcn.00453240
add esp, 0x14
test eax, eax
je 0x517e4e
cmp dword [esp + 0x10], edi
jne 0x517e4e
push ebx
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x517dcf
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x517d8f
test ecx, ecx
jne 0x517d8f
test eax, eax
je 0x517db2
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.00517a60
add esp, 0x1c
test eax, eax
je 0x517e39
test edi, edi
je 0x517df2
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.005179f0
add esp, 0xc
jmp 0x517df2
push dword [esp + 0x90]
push ebp
push esi
call fcn.005179f0
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.005179f0
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.00453210
add esp, 0x18
test eax, eax
je 0x517e39
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.00453210
add esp, 0x18
test eax, eax
je 0x517e39
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00579e58
add esp, 0x74
ret
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00579e58
add esp, 0x74
ret
mov ecx, dword [esp + 0x7c]
xor eax, eax
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00579e58
add esp, 0x74
ret
Function at 0x51b502
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x51b41d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.00488bf0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x51b464
call fcn.00464f60
push str.ecx_gen
push 0x258
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.00464fb0
push edi
push 0x80010
push 0x39
call fcn.00464fe0
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x51b4af
push esi
push edi
call fcn.00488b80
mov esi, eax
add esp, 4
test esi, esi
jne 0x51b4b2
call fcn.00464f60
push str.ecx_gen
push 0x261
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.00464fb0
push esi
push 0x80010
push 0x39
call fcn.00464fe0
add esp, 0x18
push edi
call fcn.00488ba0
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x51b4df
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x51b4df
mov edx, dword [ebx + 8]
cmp edx, 2
je 0x51b4a3
cmp edx, 3
je 0x51b4a3
push ecx
push eax
push esi
push edi
call fcn.00526c40
add esp, 0x10
test eax, eax
je 0x51b4a3
jmp 0x51b4f3
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.00458590
add esp, 0x10
test eax, eax
jle 0x51b4a3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x51b4fb
jmp dword [eax*4 + 0x51b57c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.004abfb0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.004b50d0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004ab8f0
jmp 0x51b564
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004b3810
add esp, 0x10
test eax, eax
je 0x51b4a3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x526c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.0057a200
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x58]
mov edx, str.X25519
mov eax, dword [esp + 0x5c]
push ebx
push ebp
push esi
mov dword [esp + 0x18], eax
xor ebx, ebx
mov eax, dword [esp + 0x6c]
push edi
mov dword [esp + 0x18], eax
xor edi, edi
cmp dword [ecx + 0x50], ebx
mov eax, str.X448
mov dword [esp + 0x14], ecx
cmove eax, edx
push eax
call fcn.004fdbd0
mov ebp, dword [esp + 0x78]
mov esi, eax
add esp, 4
cmp ebp, dword [esi + 0x1c]
jae 0x526ccf
call fcn.00464f60
push str.ossl_ecx_dhkem_derive_private
push 0x15d
push str.providersimplementationskemecx_kem.c
call fcn.00464fb0
push dword [esi + 0x1c]
push ebp
push str.ikm_length_is_:_zu__should_be_at_least__zu
push 0xe6
push 0x39
call fcn.00464fe0
add esp, 0x20
jmp 0x526d76
mov eax, dword [esp + 0x14]
push dword [eax + 4]
push dword [eax]
push dword [esi + 0xc]
push str.HKDF
call fcn.004fe030
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x526d01
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00579e58
add esp, 0x54
ret
movzx eax, byte [esi + 1]
push ebp
push dword [esp + 0x1c]
mov byte [esp + 0x18], al
movzx eax, byte [esi]
push str.dkp_prk
push 2
mov byte [esp + 0x21], al
lea eax, [esp + 0x20]
push eax
push 0x5da908
push 0
push 0
push dword [esi + 0x10]
lea eax, [esp + 0x44]
push eax
push edi
call fcn.004fde80
add esp, 0x2c
test eax, eax
je 0x526d76
push 0
push 0
push 0x5da9f4
push 2
lea eax, [esp + 0x20]
push eax
push 0x5da908
push dword [esi + 0x10]
lea eax, [esp + 0x3c]
push eax
push dword [esi + 0x1c]
push dword [esp + 0x40]
push edi
call fcn.004fdcb0
add esp, 0x2c
mov ecx, 1
test eax, eax
cmovne ebx, ecx
lea eax, [esp + 0x20]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.004e36b0
mov ecx, dword [esp + 0x6c]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00579e58
add esp, 0x54
ret
Function at 0x53f030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.0057a200
mov eax, dword [0x5faea4]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
push esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov esi, dword [eax]
test esi, esi
jns 0x53f081
mov dword [eax], 0xffffffff
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00579e58
add esp, 0x2c
ret
push ebx
movzx ebx, byte [ecx]
push ebp
lea ebp, [ecx + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov byte [esp + 0x2b], bl
movzx eax, byte [edx + 6]
mov dword [esp + 0x10], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x10], ebx
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x53f1f0
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x40]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x48], eax
test esi, esi
jne 0x53f198
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.0053e600
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x53f133
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x53f1f0
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.00579e58
add esp, 0x2c
ret
Function at 0x53f210
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, 0x400
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, 0x80
mov esi, edx
mov ecx, edi
mov byte [ebp], 0
cmp dword [esp + 0x18], ecx
cmovle ecx, dword [esp + 0x18]
test eax, eax
cmovg esi, eax
cmp esi, edx
cmovg esi, edx
mov dword [esp + 0x14], esi
test ecx, ecx
jle 0x53f265
mov ebx, dword [esp + 0x1c]
mov edx, ebp
sub ebx, ebp
mov esi, ecx
mov al, byte [ebx + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x53f253
mov esi, dword [esp + 0x14]
movzx ebx, byte [ecx + ebp - 1]
cmp ecx, edi
jge 0x53f28a
mov edx, ebp
movzx eax, byte [edx]
lea edx, [edx + 1]
add eax, ebx
movzx eax, al
movzx ebx, byte [eax + 0x5e6248]
mov byte [ecx + ebp], bl
inc ecx
cmp ecx, edi
jl 0x53f270
mov ecx, dword [esp + 0x14]
lea ebx, [esi + 7]
sar ebx, 3
neg ecx
sub edi, ebx
and ecx, 7
movzx eax, byte [edi + ebp]
lea esi, [edi + ebp]
mov edx, 0xff
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x5e6248]
mov byte [esi], cl
test edi, edi
je 0x53f2d8
nop dword [eax + eax]
movzx eax, byte [esi + ebx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x5e6248]
mov byte [esi], cl
sub edi, 1
jne 0x53f2c0
lea esi, [ebp + 0xfc]
mov edi, 0x40
lea edx, [ebp + 0x7e]
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
sub edi, 1
jne 0x53f2e6
pop edi
pop esi
pop ebp
pop ebx
ret