joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462e92
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
xor eax, eax
inc eax
pop ebp
ret

Function at 0x463267
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
xor eax, eax
inc eax
pop ebp
ret
Function at 0x466049
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x466060
xor eax, eax
jmp 0x466101
push ebx
push esi
push dword [edi]
call fcn.0046030a
mov ebx, dword [ebp + 0xc]
mov esi, eax
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], esi
test ebx, ebx
je 0x4660fc
mov ecx, dword [edi + 0x84]
cmp ecx, esi
jne 0x4660a4
test esi, esi
jle 0x4660de
mov edx, ebx
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
xor al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
sub ebx, 1
jne 0x466091
mov ebx, dword [ebp + 0xc]
jmp 0x4660de
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x4660c2
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.00559fa0
add esp, 0xc
test esi, esi
jle 0x4660de
lea ecx, [edi + 0x24]
mov edx, ebx
mov edi, esi
mov al, byte [ecx + 0x40]
xor al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
sub edi, 1
jne 0x4660cd
mov edi, dword [ebp + 8]
push esi
push ebx
push ebx
push dword [edi]
call fcn.0046066d
add esp, 0x10
test eax, eax
jne 0x4660fc
push esi
push ebx
call fcn.00457860
pop ecx
pop ecx
xor eax, eax
jmp 0x4660ff
xor eax, eax
inc eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x4761f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
test esi, esi
je 0x47623a
mov al, byte [esi]
test al, al
je 0x47623a
push ebx
mov ebx, 0x100
push edi
mov edi, ebx
movsx eax, al
or eax, edi
add edi, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
inc esi
mov al, byte [esi]
test al, al
jne 0x476210
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop ebx
jmp 0x47623c
xor eax, eax
pop esi
pop ebp
ret

Function at 0x476454
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
je 0x4764a2
mov al, byte [edi]
test al, al
je 0x4764a2
push ebx
mov ebx, 0x100
movsx eax, al
push eax
call fcn.00469bc8
or eax, ebx
add ebx, 0x100
pop ecx
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol esi, cl
xor esi, eax
inc edi
mov al, byte [edi]
test al, al
jne 0x47646e
mov eax, esi
shr eax, 0x10
xor eax, esi
pop ebx
jmp 0x4764a4
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x47c8e3
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x47c95c
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x47c8fc
cmp al, 0x6b
jne 0x47c95c
inc ecx
cmp al, 0x6b
jne 0x47c934
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x47c91c
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x47c91c
cmp dl, 0xbb
jne 0x47c926
inc eax
cmp eax, esi
jl 0x47c90a
sub esi, eax
test eax, eax
jne 0x47c937
push 0x50
jmp 0x47c928
push 0x48
push str.d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x47c968
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x47c94b
push 0x59
push str.d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x47c968
push esi
push ecx
push dword [ebp + 8]
call fcn.005594a0
add esp, 0xc
mov eax, esi
jmp 0x47c97a
push 0x3d
push str.d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004559e9
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x47f564
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x1c], 2
push ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x20
pop ebx
je 0x47f5e5
cmp dword [ebp + 0x10], 0
je 0x47f5b4
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push 0
call fcn.004688d8
add esp, 0x10
cmp dword [ebp - 4], 0xffffffff
je 0x47f5b4
push 0x3b
push str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.004559e9
add esp, 0x14
xor eax, eax
jmp 0x47f790
cmp dword [ebp + 0x14], 0
je 0x47f5e1
cmp edi, 0x40a
je 0x47f5da
cmp edi, 0x43f
je 0x47f5da
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x47f5dc
mov eax, ebx
cmp dword [ebp + 0x18], eax
je 0x47f5e5
push 0x41
jmp 0x47f597
push esi
push 0x46
mov esi, str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push esi
push 0x40
call fcn.00455348
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x47f618
push 0x48
push esi
push 0x41
push 0x10a
push 0x10
call fcn.004559e9
add esp, 0x14
jmp 0x47f6df
cmp dword [ebp + 0x1c], 0
jne 0x47f632
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
call fcn.005594a0
add esp, 0xc
jmp 0x47f77d
cmp edi, 0x40a
je 0x47f652
cmp edi, 0x43f
je 0x47f652
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x47f654
mov eax, ebx
push 0x50
push esi
push eax
call fcn.00473a38
mov esi, eax
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], esi
test esi, esi
jne 0x47f68a
push 0x52
mov edi, str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push edi
push 0x41
push 0x10a
push 0x10
call fcn.004559e9
mov eax, dword [ebp - 4]
add esp, 0x14
jmp 0x47f6d3
cmp dword [ebp + 0x1c], 2
jne 0x47f70e
cmp edi, 0x40a
je 0x47f6ae
cmp edi, 0x43f
je 0x47f6ae
xor ebx, ebx
cmp edi, 0x40b
setne bl
add ebx, 0x38
push ebx
push esi
call fcn.0049474f
pop ecx
pop ecx
test eax, eax
jg 0x47f6e6
push 0x57
mov edi, str.d:package_cacheopenssl1.1.1g.2cryptoececx_meth.c
push edi
push esi
call fcn.00473a33
mov eax, dword [ebp - 4]
add esp, 0xc
and dword [eax + 0x3c], 0
push 0x79
push edi
push eax
call fcn.004551e9
add esp, 0xc
xor eax, eax
jmp 0x47f78f
cmp edi, 0x40a
jne 0x47f6fd
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
jmp 0x47f739
cmp edi, 0x40b
jne 0x47f739
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x47f739
cmp edi, 0x40a
je 0x47f72c
cmp edi, 0x43f
je 0x47f72c
xor ebx, ebx
cmp edi, 0x40b
setne bl
add ebx, 0x38
push ebx
push dword [ebp + 0x14]
push esi
call fcn.005594a0
add esp, 0xc
mov eax, edi
sub eax, 0x40a
je 0x47f772
sub eax, 1
je 0x47f767
sub eax, 0x34
je 0x47f75c
sub eax, 1
jne 0x47f77d
push esi
push dword [ebp - 4]
call fcn.004a76ec
jmp 0x47f77b
push esi
push dword [ebp - 4]
call fcn.0049e642
jmp 0x47f77b
push esi
push dword [ebp - 4]
call fcn.004a5e60
jmp 0x47f77b
push esi
push dword [ebp - 4]
call fcn.0049e9db
pop ecx
pop ecx
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call fcn.00452aa3
xor eax, eax
add esp, 0xc
inc eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4816ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00450f01
pop ecx
cmp eax, 0x72
jne 0x4817b7
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
mov ecx, eax
push esi
push edi
push dword [ebp + 0x18]
shr ecx, 1
and eax, 1
push dword [ebp + 0x14]
add eax, ecx
mov dword [ebp - 8], ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.00470345
push eax
call fcn.004814cd
add esp, 0x1c
test eax, eax
je 0x48174b
push 0x104
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push esi
call fcn.004551b7
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x481752
push 0x105
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.004559e9
add esp, 0x14
xor eax, eax
jmp 0x4817df
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0xc]
push esi
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call fcn.00452a79
push eax
call fcn.004814cd
add esp, 0x1c
test eax, eax
jne 0x48178c
push 0x10a
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.00455260
add esp, 0x10
jmp 0x48174b
test esi, esi
je 0x4817a1
mov ecx, ebx
mov edx, esi
sub ecx, edi
mov al, byte [ecx + edi]
xor byte [edi], al
inc edi
sub edx, 1
jne 0x481796
push 0x10f
push str.d:package_cacheopenssl1.1.1g.2cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.00455260
add esp, 0x10
jmp 0x4817dc
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004814cd
add esp, 0x1c
test eax, eax
je 0x48174b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48309f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
xor bl, bl
test edx, edx
je 0x4830c3
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub esi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
or bl, al
inc ecx
sub edx, 1
jne 0x4830b5
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x4831db
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
test edi, edi
je 0x48324a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x48324a
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push esi
push dword [ebp + 8]
mov ebx, 0x200
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.004833a6
add esp, 0x14
lea ecx, [ebp - 0x208]
test eax, eax
cmovs eax, ebx
push esi
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x483391
mov ecx, dword [ebp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x483250
sub ecx, edx
lea edi, [ecx + 1]
lea eax, [edi + edi]
call fcn.00541d90
mov ebx, esp
xor esi, esi
test ebx, ebx
jne 0x483276
mov ebx, str.no_stack_
jmp 0x483315
push edi
push ebx
push edi
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x48329f
mov ecx, esi
test edi, edi
je 0x48329f
mov eax, dword [ebp + 8]
movsx ax, byte [ecx + eax]
mov word [ebx + ecx*2], ax
inc ecx
cmp ecx, edi
jb 0x48328e
mov ecx, esi
test edi, edi
je 0x483315
push 0x43
mov dword [ebp - 0x208], 0x73
pop esi
cmp word [ebx + ecx*2], 0x25
jne 0x48330e
lea edx, [ecx + 1]
lea edx, [ebx + edx*2]
movzx eax, word [edx]
cmp eax, esi
ja 0x4832e9
je 0x4832e5
cmp eax, 0x2a
je 0x4832df
cmp eax, 0x2c
jbe 0x48330e
cmp eax, 0x2e
jbe 0x4832df
add eax, 0xffffffd0
cmp eax, 9
ja 0x48330e
inc ecx
add edx, 2
jmp 0x4832bf
push 0x63
jmp 0x48330a
cmp eax, 0x53
je 0x483308
cmp eax, 0x63
je 0x483303
movzx eax, word [edx]
cmp ax, word [ebp - 0x208]
jne 0x48330e
push 0x53
jmp 0x48330a
mov word [edx], si
jmp 0x48330e
push 0x73
pop eax
mov word [edx], ax
inc ecx
cmp ecx, edi
jb 0x4832b2
xor esi, esi
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.004833d8
add esp, 0x14
xor eax, eax
mov word [ebp - 6], ax
call fcn.004830f1
test eax, eax
jle 0x48337c
push str.OpenSSL
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x483391
push esi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push esi
push 1
push esi
push esi
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x483391
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00540aaa
leave
ret

Function at 0x48fe91
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push 0
push esi
call fcn.00559fa0
add esp, 0xc
mov dword [esi], 0x67452301
xor eax, eax
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
inc eax
mov dword [esi + 0xc], 0x10325476
pop esi
pop ebp
ret
Function at 0x4945b3
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
push edi
test eax, eax
je 0x4945d0
test byte [eax + 0x5c], 2
mov edi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x4945d5
mov edi, 0x5c5ac8
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
test esi, esi
jle 0x494698
push ebx
mov ebx, dword [ebp + 0x10]
inc ebx
movzx ecx, byte [ebx - 1]
cmp esi, 3
jl 0x494633
movzx eax, byte [ebx]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + edi]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + edi]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
and ecx, 0x3f
mov al, byte [eax + edi]
mov byte [edx + 2], al
lea eax, [edx + 3]
mov cl, byte [ecx + edi]
jmp 0x49467b
shl ecx, 0x10
cmp esi, 2
jne 0x494643
movzx eax, byte [ebx]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + edi]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
inc edx
and eax, 0x3f
mov dword [ebp + 0xc], edx
mov al, byte [eax + edi]
mov byte [edx], al
cmp esi, 1
jne 0x494667
mov al, 0x3d
jmp 0x494670
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + edi]
mov byte [edx + 1], al
mov cl, 0x3d
mov eax, dword [ebp + 0xc]
add eax, 2
mov byte [eax], cl
lea edx, [eax + 1]
mov ecx, dword [ebp - 4]
sub esi, 3
add ecx, 4
add ebx, 3
mov dword [ebp - 4], ecx
test esi, esi
jg 0x4945e8
pop ebx
pop edi
mov byte [edx], 0
mov eax, ecx
pop esi
leave
ret
Function at 0x49e642
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
push esi
mov esi, dword [ebp + 8]
push ecx
push 0x20
push eax
call fcn.00462f33
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004a12ca
lea eax, [ebp - 0xe4]
push eax
push esi
call fcn.004a1272
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00457860
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop esi
call fcn.00540aaa
leave
ret

Function at 0x49e6ae
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x19c]
push edi
mov edi, dword [ebp + 0x14]
push eax
call fcn.00463267
push 0x20
lea eax, [ebp - 0x19c]
push esi
push eax
call fcn.004632ff
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00462fa5
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x19c]
push eax
call fcn.00463267
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.004632ff
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.004632ff
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00462fa5
lea eax, [ebp - 0x84]
push eax
call fcn.004a44c4
add esp, 0x40
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.004a12ca
mov esi, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
push eax
push esi
call fcn.004a1272
lea eax, [ebp - 0x19c]
push eax
call fcn.00463267
push 0x20
lea eax, [ebp - 0x19c]
push esi
push eax
call fcn.004632ff
push 0x20
lea eax, [ebp - 0x19c]
push edi
push eax
call fcn.004632ff
push dword [ebp + 0x10]
lea eax, [ebp - 0x19c]
push ebx
push eax
call fcn.004632ff
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.00462fa5
add esp, 0x40
lea eax, [ebp - 0xc4]
push eax
call fcn.004a44c4
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [esi + 0x20]
push eax
call fcn.004a15d7
lea eax, [ebp - 0x19c]
push 0xd8
push eax
call fcn.00457860
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.00457860
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.00457860
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor eax, eax
xor ecx, ebp
inc eax
pop edi
pop esi
pop ebx
call fcn.00540aaa
leave
ret
Function at 0x49e9db
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
and byte [ebp - 0x24], 0xf8
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [ebp - 5], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004a12ca
pop ecx
pop ecx
xor esi, esi
mov edx, dword [ebp + esi - 0xc4]
mov ecx, dword [ebp + esi - 0xec]
lea eax, [edx + ecx]
sub edx, ecx
mov dword [ebp + esi - 0x4c], eax
mov dword [ebp + esi - 0x74], edx
add esi, 4
cmp esi, 0x28
jb 0x49ea24
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.0049edda
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x4c]
push eax
push eax
call fcn.0049f043
lea eax, [ebp - 0x4c]
push eax
push ebx
call fcn.004a06c7
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.00457860
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00540aaa
leave
ret

Function at 0x49eaf4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
neg edx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0xa
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x49eb09
pop edi
pop esi
pop ebp
ret

Function at 0x49eb1e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0xa
neg edi
sub esi, edx
pop ebx
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, edi
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x49eb34
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a6b3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10
sub esi, edx
pop edi
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, dword [ebp + 0x10]
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub edi, 1
jne 0x4a6b4f
pop edi
pop esi
pop ebp
ret
Function at 0x4a7fec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x62fff4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x134], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], ecx
test edi, edi
je 0x4a8040
cmp edi, dword [ebx]
je 0x4a803c
test eax, eax
je 0x4a8226
test esi, esi
js 0x4a8226
mov dword [ebx], edi
jmp 0x4a804b
cmp dword [ebx], 0
je 0x4a8226
mov edi, dword [ebx]
push edi
call fcn.0045258f
pop ecx
test al, 2
jne 0x4a8226
xor eax, eax
inc eax
cmp dword [ebp - 0x128], 0
je 0x4a81e0
push edi
mov dword [ebp - 0x134], eax
call fcn.0045029d
pop ecx
mov ecx, 0x90
cmp eax, ecx
jg 0x4a8226
cmp eax, esi
jge 0x4a80e5
push dword [ebp - 0x12c]
push edi
push dword [ebx + 4]
call fcn.00466952
add esp, 0xc
test eax, eax
je 0x4a8226
push esi
push dword [ebp - 0x128]
push dword [ebx + 4]
call fcn.00466ad3
add esp, 0xc
test eax, eax
je 0x4a8226
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x94]
push eax
push dword [ebx + 4]
call fcn.004668c7
add esp, 0xc
test eax, eax
je 0x4a8226
mov esi, dword [ebp - 0x130]
jmp 0x4a8109
cmp esi, ecx
ja 0x4a8226
push esi
push dword [ebp - 0x128]
lea eax, [ebp - 0x94]
push eax
call fcn.005594a0
add esp, 0xc
mov dword [ebp - 0x130], esi
mov ecx, 0x90
cmp esi, ecx
je 0x4a812d
sub ecx, esi
lea eax, [ebp - 0x94]
push ecx
add eax, esi
push 0
push eax
call fcn.00559fa0
add esp, 0xc
mov ecx, 0x90
xor esi, esi
mov eax, esi
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmmword [str.6666666666666666d:package_cacheopenssl1.1.1g.2crypto_rsa_rsa_sign.c]
movups xmmword [ebp + eax - 0x124], xmm0
add eax, 0x10
cmp eax, ecx
jl 0x4a8131
push dword [ebp - 0x12c]
push edi
push dword [ebx + 8]
call fcn.00466952
add esp, 0xc
test eax, eax
je 0x4a8200
push edi
call fcn.0045029d
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 8]
call fcn.00466ad3
add esp, 0x10
test eax, eax
je 0x4a8200
mov eax, esi
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmmword [0x5cf6b0]
movups xmmword [ebp + eax - 0x124], xmm0
add eax, 0x10
cmp eax, 0x90
jl 0x4a8189
push dword [ebp - 0x12c]
push edi
push dword [ebx + 0xc]
call fcn.00466952
add esp, 0xc
test eax, eax
je 0x4a8200
push edi
call fcn.0045029d
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebx + 0xc]
call fcn.00466ad3
add esp, 0x10
test eax, eax
je 0x4a8200
jmp 0x4a81e2
xor esi, esi
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00466af3
pop ecx
pop ecx
test eax, eax
push 1
pop eax
cmovne esi, eax
cmp dword [ebp - 0x134], 0
je 0x4a8222
mov ebx, 0x90
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.00457860
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.00457860
add esp, 0x10
mov eax, esi
jmp 0x4a8228
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00540aaa
leave
ret