joyce8/EMBER2024-capa huggingface dataset:
Function at 0x504dfc
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2c4
mov eax, 0x614ef6
call fcn.005ca244
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.0050518b
call fcn.004758f0
push eax
lea ecx, [ebp - 0x94]
call fcn.004f0523
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00475900
mov ecx, eax
call fcn.004f0cf4
test al, al
je 0x504f12
push ebx
lea ecx, [ebp - 0x94]
call fcn.004f0760
push edi
push 0x80
push 3
push edi
push 1
push connect
lea ecx, [ebp - 0x94]
call fcn.004f0b96
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x2d0], eax
push edi
cmp eax, 0xffffffff
jne 0x504e83
push str.Error_opening_file
jmp 0x504ff3
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
je 0x504f8c
cmp edi, 0x400000
ja 0x504f9d
and dword [ebp - 0x2c8], 0
push edi
call fcn.005c9dac
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d0]
mov dword [ebp - 0x2cc], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x2c8], edi
je 0x504efb
push ebx
call fcn.005c9b6f
pop ecx
mov ecx, esi
call fcn.0050518b
push 0
push str.Could_not_read_file
jmp 0x504ff3
push dword [ebp + 0xc]
mov ecx, esi
push edi
push ebx
call fcn.0050503e
push dword [ebp - 0x2cc]
jmp 0x505021
call fcn.00475900
push eax
lea ecx, [ebp - 0x94]
call fcn.004f0743
call fcn.00475910
test al, al
je 0x504f33
call fcn.00475920
jmp 0x504f4a
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.004f0b96
push eax
call fcn.004fbb70
add esp, 0xc
mov edi, eax
test edi, edi
jne 0x504f5b
push eax
push str.Error_opening_zip_file
jmp 0x504ff3
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 1
push ebx
push edi
call fcn.004fb5b1
add esp, 0x14
test eax, eax
je 0x504f82
push 0
push str.Could_not_find_ziped_file
jmp 0x504ff3
mov ebx, dword [ebp - 0x98]
test ebx, ebx
jne 0x504f95
push 0
push str.File_is_empty
jmp 0x504ff3
cmp ebx, 0x400000
jbe 0x504fa6
push 0
push 0x62002c
jmp 0x504ff3
push ebx
call fcn.005c9dac
push 3
push ebx
push eax
push dword [ebp - 0x2cc]
mov dword [ebp - 0x2c8], eax
push edi
call fcn.004fbf30
add esp, 0x18
test eax, eax
je 0x504ffe
cmp eax, 0x600
je 0x504ffe
push dword [ebp - 0x2c8]
call fcn.005c9b6f
pop ecx
call fcn.00475910
test al, al
jne 0x504fec
push edi
call fcn.004fb40b
pop ecx
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.005051b3
mov bl, al
jmp 0x505029
call fcn.00475910
test al, al
jne 0x50500e
push edi
call fcn.004fb40b
pop ecx
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x2c8]
mov ecx, esi
push ebx
push edi
call fcn.0050503e
push edi
mov bl, al
call fcn.005c9b6f
pop ecx
lea ecx, [ebp - 0x94]
call fcn.004f065e
mov al, bl
call fcn.005ca1ff
ret 8
Function at 0x50a205
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x50a229
cmp dword [esi + 8], edi
jge 0x50a221
push esi
call fcn.005084fb
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x50a252
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x50a235
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x50a26f
mov edx, dword [esi]
cmp edx, dword [esi + 4]
jb 0x50a25d
xor eax, eax
jmp 0x50a265
mov al, byte [edx]
inc edx
mov dword [esi], edx
movzx eax, al
mov byte [ebp + ecx + 8], al
inc ecx
cmp ecx, 4
jl 0x50a254
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x50a2a4
push str.zlib_corrupt
call fcn.005083b6
add esp, 4
jmp 0x50a2e1
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x50a2b4
push str.read_past_buffer
jmp 0x50a29a
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x50a2cb
push edi
push esi
call fcn.005083c5
pop ecx
pop ecx
test eax, eax
je 0x50a2e1
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005e2c00
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x519a10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x519a7d
cmp dword [esi + 0x10], 0
je 0x519a7d
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005ca410
mov ebx, esp
test ebx, ebx
je 0x519a7d
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1b8
call fcn.004f06fc
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0047a000
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x51a784
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x6155ce
call fcn.005ca244
mov dword [ebp - 0x2d8], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2cc], ebx
call fcn.004758f0
push eax
lea ecx, [ebp - 0x94]
call fcn.004f0523
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00475900
mov ecx, eax
call fcn.004f0cf4
test al, al
je 0x51a872
push ebx
lea ecx, [ebp - 0x94]
call fcn.004f0760
push edi
push 0x80
push 3
push edi
push 1
push connect
lea ecx, [ebp - 0x94]
call fcn.004f0b96
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x51a815
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004f065e
jmp 0x51a953
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
test esi, esi
je 0x51a801
push esi
mov dword [ebp - 0x2c8], edi
call fcn.005c9dac
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2c8]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x2c8], esi
je 0x51a93e
push edi
call fcn.005c9b6f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004f065e
jmp 0x51a951
call fcn.00475900
push eax
lea ecx, [ebp - 0x94]
call fcn.004f0743
call fcn.00475910
test al, al
je 0x51a893
call fcn.00475920
jmp 0x51a8aa
push 2
push edi
lea ecx, [ebp - 0x94]
call fcn.004f0b96
push eax
call fcn.004fbb70
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x51a801
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
push dword [ebp - 0x2cc]
push ebx
call fcn.004fb5b1
add esp, 0x14
test eax, eax
jne 0x51a801
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x51a801
push esi
call fcn.005c9dac
push 3
push esi
mov edi, eax
push edi
push dword [ebp - 0x2d4]
push ebx
call fcn.004fbf30
add esp, 0x18
test eax, eax
je 0x51a92e
cmp eax, 0x600
je 0x51a92e
push edi
call fcn.005c9b6f
pop ecx
call fcn.00475910
test al, al
jne 0x51a85e
push ebx
call fcn.004fb40b
jmp 0x51a85d
call fcn.00475910
test al, al
jne 0x51a93e
push ebx
call fcn.004fb40b
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004f065e
test edi, edi
jne 0x51a9c5
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push connect
push dword [ebp - 0x2cc]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x51a9c1
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
test esi, esi
je 0x51a9c1
push esi
mov dword [ebp - 0x2d0], edi
call fcn.005c9dac
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x2d0]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x2d0], esi
je 0x51a9bd
push edi
call fcn.005c9b6f
pop ecx
xor edi, edi
test edi, edi
jne 0x51a9c5
xor eax, eax
jmp 0x51a9e0
mov ecx, dword [ebp - 0x2d8]
push esi
push edi
call fcn.0051a9e8
push 1
push edi
mov esi, eax
call fcn.005c9a24
pop ecx
pop ecx
mov eax, esi
call fcn.005ca1ff
ret 4
Function at 0x51bdd5
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
cmp esi, 0x4e
jne 0x51bdfd
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, 8
jne 0x51bebc
push ebx
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x51be75
push 0x20
pop edi
push edi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.005e3180
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], edi
push eax
push ebx
push 0x100e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x18], 0x1010003
jne 0x51be6a
xor eax, eax
inc eax
jmp 0x51bf36
cmp dword [ebp - 0x18], 0x2010003
jne 0x51beb8
jmp 0x51be62
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
jl 0x51bea3
cmp eax, dword [ebp - 0xc]
jg 0x51bea3
cmp eax, dword [ebp - 0x10]
jl 0x51bea3
cmp eax, dword [ebp - 8]
jle 0x51beb8
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 8
call fcn.0051c076
mov ebx, eax
mov eax, ebx
jmp 0x51bf36
mov eax, dword [ebp + 0xc]
mov ecx, 0x101
cmp esi, ecx
jne 0x51bf2a
cmp eax, 0x2e
je 0x51bef6
cmp eax, 8
je 0x51bef6
cmp eax, 0x1b
jne 0x51bf2a
push dword [ebp + 0x10]
push eax
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x594], 3
jmp 0x51bf1b
push dword [ebp + 0x10]
push eax
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
mov dword [ecx + 0x594], 2
mov ecx, dword [edi + 0x10]
call fcn.0051c0de
push ebx
push ebx
push 0x10
mov ecx, edi
call fcn.005000a6
mov eax, esi
jmp 0x51bf36
push dword [ebp + 0x10]
mov ecx, edi
push eax
push esi
call fcn.004fff71
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c978e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51ef50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x434
call fcn.005ca7c0
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0xc], ebx
test edi, edi
jne 0x51ef95
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push eax
push edi
call fcn.005f5dd4
add esp, 8
test eax, eax
js 0x51ef7e
mov eax, 8
call fcn.005ca7c0
xorps xmm0, xmm0
lea eax, [esp + 0x1c]
movsd qword [esp], xmm0
push 0x24
push eax
call fcn.0051ec90
mov esi, dword [ebp + 0xc]
add esp, 0x10
test esi, esi
je 0x51ef7e
push 0x6a63b4
push edi
call fcn.005ec510
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x51f060
mov edi, 0x400
test esi, esi
jle 0x51eff3
cmp esi, edi
cmovl edi, esi
push eax
push edi
lea eax, [esp + 0x40]
push 1
push eax
call fcn.005f6345
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x51f041
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.005ca7c0
lea eax, [esp + 0x40]
movsd qword [esp], xmm0
push edi
push eax
call fcn.0051ec90
add dword [esp + 0x1c], ebx
add esp, 0x10
mov eax, dword [esp + 0x10]
test esi, esi
jle 0x51efe5
sub esi, edi
test esi, esi
jg 0x51efe5
push dword [esp + 0x10]
call fcn.005e80f3
lea eax, [esp + 0x3c]
push 0x400
push eax
call fcn.004389e0
mov ebx, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [esp + 0x43c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005c978e
mov esp, ebp
pop ebp
ret
Function at 0x53a2e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x53a305
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
dec esi
jne 0x53a2f6
pop edi
movzx eax, dl
pop esi
ret

Function at 0x53a580
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.005ca7c0
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov esi, eax
test esi, esi
je 0x53a607
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
test eax, eax
je 0x53a607
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0x100
push eax
call fcn.004e4fe0
add esp, 0x10
lea ecx, [esp + 4]
test eax, eax
push 0
push ecx
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005c978e
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push dword [esp + 0x114]
lea eax, [esp + 0x10]
push 0xff
push eax
call fcn.004e4fe0
add esp, 0x10
mov byte [esp + 0x107], 0
call fcn.0053a440
test eax, eax
jle 0x53a68b
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x53a69f
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005c978e
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.005c978e
add esp, 0x108
ret
Function at 0x54bcc0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.0054bdb0
mov edi, eax
add esp, 8
test edi, edi
jne 0x54bd58
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 1
push 2
call fcn.00528200
push 0x641c54
push esi
push 0x642214
push dword [esp + 0x2c]
push str.fopen_
push 5
call fcn.00527840
add esp, 0x2c
call fcn.005eb749
cmp dword [eax], 2
jne 0x54bd3b
push 0xb2
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00528200
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0xb4
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00528200
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0x6beae0
call fcn.00523530
mov esi, eax
add esp, 4
test esi, esi
jne 0x54bd79
push edi
call fcn.005e80f3
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0
push esi
call fcn.00523170
push edi
push 1
push 0x6a
push esi
call fcn.005231a0
add esp, 0x18
mov eax, esi
pop edi
pop esi
ret
Function at 0x566580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.005ca7c0
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 4], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call fcn.0053d080
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.0053cee0
add esp, 0xc
test eax, eax
je 0x566682
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0053cbc0
add esp, 0xc
test eax, eax
je 0x566682
lea eax, [esp + 0x20]
push eax
call fcn.0053ce20
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x5666a0
push edi
call fcn.00521f10
push ebx
push edi
mov dword [esp + 0x28], eax
call fcn.00566b50
mov esi, eax
add esp, 0xc
test esi, esi
je 0x566682
push esi
call fcn.00567390
add esp, 4
test eax, eax
jle 0x566682
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.00566900
add esp, 0x18
test eax, eax
jle 0x566682
push dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
call fcn.005672b0
add esp, 0x14
test eax, eax
jle 0x566682
mov ecx, dword [esp + 0x18]
mov ebx, 1
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
push esi
call fcn.00566af0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005c978e
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x5666b8
cmp dword [edi], edx
je 0x5666e2
inc eax
add ecx, 4
cmp eax, 4
jl 0x5666a5
push 0x7b
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.00528200
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005c978e
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x566716
push 0x80
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.00528200
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005c978e
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x1c]
push ecx
push dword [esp + 0x18]
lea ecx, [esp + 0x44]
push dword [esp + 0x20]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c978e
add esp, 0x6c
ret
Function at 0x574ea0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.005ca7c0
mov eax, dword [0x6c6f60]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x574f06
cmp edi, dword [esi]
je 0x574efd
test ebp, ebp
je 0x574f80
test ebx, ebx
js 0x574f80
mov eax, 1
mov dword [esi], edi
jmp 0x574f0c
mov edi, dword [esi]
test edi, edi
je 0x574f80
test ebp, ebp
je 0x57509b
push edi
call fcn.00549e50
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x574f40
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.0053a6c0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x574f9b
push dword [esp + 0x10]
lea eax, [esi + 4]
push edi
push eax
call fcn.0053cc60
add esp, 0xc
test eax, eax
je 0x574f80
push ebx
push ebp
lea ebx, [esi + 4]
push ebx
call fcn.0053ce10
add esp, 0xc
test eax, eax
je 0x574f80
lea ebp, [esi + 0x4c]
push ebp
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.0053cbc0
add esp, 0xc
test eax, eax
jne 0x574fb7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005c978e
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x574f80
push ebx
lea eax, [esi + 0x50]
push ebp
push eax
call fcn.005e2c00
lea ebp, [esi + 0x4c]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x574fda
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x50]
add eax, ecx
push 0
push eax
call fcn.005e3180
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x574fe0
push edx
lea ebx, [esi + 0x1c]
push edi
push ebx
call fcn.0053cc60
add esp, 0xc
test eax, eax
je 0x574f80
push edi
call fcn.00549e50
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.0053ce10
add esp, 0x10
test eax, eax
je 0x574f80
xor ecx, ecx
jmp 0x575030
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x575030
push dword [esp + 0x10]
lea ebx, [esi + 0x34]
push edi
push ebx
call fcn.0053cc60
add esp, 0xc
test eax, eax
je 0x574f80
push edi
call fcn.00549e50
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.0053ce10
add esp, 0x10
test eax, eax
je 0x574f80
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 4]
push eax
call fcn.0053cee0
add esp, 8
test eax, eax
je 0x574f80
mov eax, 1
jmp 0x574f82
test eax, eax
je 0x575079
jmp 0x574fde
Function at 0x581180
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x58126c
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x5811fe
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax + 2], cl
movzx ecx, byte [edx + 0x652520]
mov byte [eax + 3], cl
jmp 0x58124f
shl edx, 0x10
cmp esi, 2
jne 0x58120e
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x652520]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x58123b
lea ecx, [esi + 0x3c]
jmp 0x581248
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + 0x652520]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x5811a0
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x5b0660
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov eax, dword [ebp + 4]
cmp eax, dword [ecx + 4]
jge 0x5b0677
mov edi, ecx
jmp 0x5b067b
mov edi, ebp
mov ebp, ecx
mov ebx, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x5b068b
mov eax, ebx
jmp 0x5b0695
push eax
push ebx
call fcn.00538040
add esp, 8
test eax, eax
jne 0x5b069d
pop edi
pop ebp
pop ebx
ret
push esi
xor esi, esi
cmp dword [ebp + 4], esi
jle 0x5b06bb
mov eax, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [eax + esi*4]
mov eax, dword [ebx]
xor edx, dword [ecx + esi*4]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ebp + 4]
jl 0x5b06a5
cmp esi, dword [edi + 4]
jge 0x5b06d0
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x5b06c0
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x5b06f4
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x5b06f1
dec ecx
test ecx, ecx
jg 0x5b06e3
mov dword [ebx + 4], ecx
pop edi
pop ebp
mov eax, 1
pop ebx
ret