joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3080
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.006149d0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.004f2d50
mov ebx, eax
push ebx
push esi
call fcn.004f2c60
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4f30ff
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f30e3
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004f2cf0
push esi
call fcn.004f2e40
add esp, 0x10
test eax, eax
jne 0x4f3179
push 1
push esi
call fcn.004f2d50
mov ebx, eax
push ebx
push esi
call fcn.004f2c60
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4f3170
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f3154
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.004f2cf0
push esi
call fcn.004f2e40
add esp, 0x10
test eax, eax
jne 0x4f3179
push esi
call fcn.004f2e40
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4fc400
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.006149d0
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [eax + 0x64]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x4fc469
test ebx, ebx
je 0x4fc449
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x4fc449
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [edi], al
inc esi
inc edi
sub ebx, 1
jne 0x4fc435
mov dword [ebp + 0x70], ecx
test ebx, ebx
je 0x4fc524
cmp ecx, 0x40
jne 0x4fc469
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x4fc469
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, ebx
and eax, 0x3f
sub ebx, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp ebx, 0x40
jb 0x4fc4d7
push dword [esp + 0x24]
mov ecx, ebx
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push edi
mov dword [esp + 0x28], edx
call fcn.00413040
mov eax, dword [esp + 0x28]
add esp, 0x14
sub ebx, eax
add esi, eax
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x4fc4d0
inc dword [ebp + 0x24]
mov edx, eax
cmp ebx, 0x40
jae 0x4fc483
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x4fc524
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.00413040
add esp, 0x20
xor edx, edx
test ebx, ebx
je 0x4fc521
sub esi, edi
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + edi]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4fc510
mov dword [ebp + 0x70], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x5016e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.006149d0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x501729
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x501729
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x501710
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x5017c4
mov edi, eax
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [edi + 0xc], eax
test edx, edx
jne 0x5017a6
mov edx, 0xc
mov eax, 1
nop word [eax + eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x501790
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x501741
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x501822
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x5017fd
push eax
call fcn.00501860
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x501810
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x5050d0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.006149d0
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x505118
call fcn.0048aed0
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
push 0
push 0x87
push 0x20
call fcn.0048b0e0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.004bccb0
add esp, 8
test eax, eax
je 0x5051a7
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x5051ae
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x5051ae
call fcn.0048aed0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0048b0e0
call fcn.0048aed0
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
push 0
push 0x89
push 0x20
call fcn.0048b0e0
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x50521f
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x50521f
call fcn.0048aed0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0048b0e0
call fcn.0048aed0
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
push 0
push 0x8a
push 0x20
call fcn.0048b0e0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.004bcfe0
add esp, 4
push eax
push esi
call fcn.004bcfd0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x5052b1
push eax
call fcn.00504fe0
add esp, 4
test eax, eax
jne 0x5051a7
call fcn.0048aed0
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.0048b0e0
call fcn.0048aed0
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.0048afd0
push 0
push 0x67
push 0x20
call fcn.0048b0e0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret

Function at 0x508a20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
movzx eax, cl
and eax, 1
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x508a62
push ebx
add edi, esi
lea ebx, [edx + esi]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x508a42
pop ebx
pop edi
pop esi
ret
Function at 0x51de50
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret

Function at 0x51f600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.006149d0
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x51f648
call fcn.0048aed0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0048afd0
push 0
push 0x78
push 4
call fcn.0048b0e0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.0051f350
add esp, 4
test eax, eax
jne 0x51f684
call fcn.0048aed0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0048afd0
push 0
push 0xb2
push 4
call fcn.0048b0e0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.004ebe10
push esi
call fcn.004ebc20
push esi
mov dword [esp + 0x2c], eax
call fcn.004ebc20
push esi
mov ebp, eax
call fcn.004ebc20
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x51f7e6
test ebp, ebp
je 0x51f7bd
test ebx, ebx
je 0x51f7b4
push 4
push ebp
call fcn.00494470
push 4
push ebx
call fcn.00494470
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x51f6ee
call fcn.00494360
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x51f6fd
call fcn.00494360
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x51f7b0
test eax, eax
je 0x51f7b0
push 4
push ecx
call fcn.00494470
push 4
push dword [esi + 0x24]
call fcn.00494470
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00593fb0
add esp, 0x3c
test eax, eax
je 0x51f7b0
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00593fb0
add esp, 0x2c
test eax, eax
je 0x51f7b0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.0051f2e0
add esp, 0x10
test eax, eax
js 0x51f7b0
je 0x51f750
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.0051f2e0
add esp, 0x10
test eax, eax
js 0x51f7b0
je 0x51f750
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.00493c00
add esp, 4
test ebx, ebx
je 0x51f7ca
push ebx
call fcn.00493c00
add esp, 4
push dword [esp + 0x20]
call fcn.00493c00
push esi
call fcn.004ebb20
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x51f7bd
jmp 0x51f7b4
Function at 0x521ea0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.00482c60
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x521ee4
push 0
push 0
push edi
push 0x521f00
push 0
push 0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x521ee4
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.00482a60
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x53fcd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.006149d0
cmp dword [esp + 0xc], 0
je 0x53fe8d
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
inc eax
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x30]
push esi
push edi
push dword [esp + 0x34]
shr eax, 1
push dword [esp + 0x34]
mov dword [esp + 0x20], eax
push eax
push ebp
push dword [esp + 0x30]
call fcn.0053fb00
add esp, 0x1c
test eax, eax
je 0x53fd6f
push 0x1b8
push str.providersimplementationskdfs_tls1_prf.c
push esi
call fcn.004829d0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x53fd6f
mov eax, dword [esp + 0x10]
sub ebp, eax
add ebp, dword [esp + 0x24]
push esi
push ebx
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push ebp
push dword [esp + 0x34]
call fcn.0053fb00
add esp, 0x1c
test eax, eax
jne 0x53fd77
push 0x1bd
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.00482af0
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
xor edx, edx
test esi, esi
je 0x53fe6e
cmp esi, 8
jb 0x53fe51
lea eax, [esi - 1]
lea ecx, [edi - 1]
add eax, ebx
add ecx, esi
cmp edi, eax
ja 0x53fda0
cmp ecx, ebx
jae 0x53fe51
cmp esi, 0x40
jb 0x53fe25
mov ebp, esi
lea ecx, [ebx + 0x30]
mov eax, esi
and ebp, 0x3f
sub eax, ebp
mov esi, ebx
sub esi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], esi
lea eax, [edi + 0x10]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x1c]
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
add edx, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
xorps xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [edi + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
movups xmm0, xmmword [ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edx, dword [esp + 0x10]
jb 0x53fdd0
mov edi, dword [esp + 0x30]
cmp ebp, 8
jb 0x53fe4d
mov ecx, esi
lea eax, [edx + edi]
mov ebp, ebx
and ecx, 0xfffffff8
sub ebp, edi
movq xmm1, qword [eax + ebp]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add edx, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp edx, ecx
jb 0x53fe31
cmp edx, esi
jae 0x53fe6e
mov ebp, ebx
lea ecx, [edx + edi]
sub ebp, edi
mov edi, esi
sub edi, edx
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x53fe60
push 0x1c2
push str.providersimplementationskdfs_tls1_prf.c
push esi
push ebx
call fcn.00482af0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x20]
call fcn.0053fb00
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop ecx
ret
Function at 0x548970
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x5489ab
cmp esi, edx
jb 0x5489ab
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x548994
pop esi
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop dword [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [esi - 0x40]
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x5489c0
pop esi
ret

Function at 0x54ab60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.006149d0
push ebx
mov ebx, dword [esp + 0x10]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push edi
mov edi, dword [esp + 0x1c]
test esi, esi
jle 0x54ac5e
cmp esi, 8
jb 0x54ac44
lea eax, [esi - 1]
lea edx, [esi - 1]
add eax, edi
add edx, ebx
cmp ebx, eax
ja 0x54abaa
cmp edx, edi
jae 0x54ac44
mov edx, edi
push ebp
cmp esi, 0x40
jb 0x54ac19
mov eax, esi
lea ebp, [edi + 0x30]
and eax, 0xffffffc0
sub edx, ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea ebp, [ebp + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebp - 0x70]
xorps xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [edx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebp - 0x50]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
movups xmm0, xmmword [ebp - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [esp + 0x10]
jl 0x54abc3
mov eax, esi
and al, 0x3f
cmp al, 8
jb 0x54ac3f
jmp 0x54ac1b
sub edx, ebx
mov ebp, esi
lea eax, [ecx + ebx]
and ebp, 0xfffffff8
movq xmm1, qword [edx + eax]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp ecx, ebp
jl 0x54ac23
pop ebp
cmp ecx, esi
jge 0x54ac5e
mov edx, esi
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
nop dword [eax]
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x54ac50
push esi
push ebx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x20]
push ebx
push dword [eax + 8]
call fcn.00499280
add esp, 0x14
test eax, eax
je 0x54ac87
xor eax, eax
cmp dword [esp + 0x20], esi
pop edi
pop esi
sete al
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x54ae20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x54ae93
mov edx, dword [esp + 0x10]
test edx, edx
je 0x54ae93
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [ebx + 0x14]
cmp edx, edi
cmovb edi, edx
test edi, edi
je 0x54ae60
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x54ae50
pop esi
mov eax, dword [ebx + 0x14]
cmp edx, eax
jbe 0x54ae91
sub edx, eax
cmp edx, 0x10
jbe 0x54ae75
mov edx, 0x10
jmp 0x54ae79
test edx, edx
je 0x54ae91
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x54ae80
pop edi
pop ebx
pop ebp
ret
Function at 0x54b110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.006149d0
mov eax, dword [0x6ae280]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x54b170
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x54b197
lea edi, [edx + 0x20]
jmp 0x54b1c2
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x54b1a1
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.00499280
add esp, 0x14
test eax, eax
je 0x54b2d9
cmp dword [esp + 0x14], edi
jne 0x54b2d9
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x54b26f
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x54b22f
test ecx, ecx
jne 0x54b22f
test eax, eax
je 0x54b252
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.0054aea0
add esp, 0x1c
test eax, eax
je 0x54b2d9
test edi, edi
je 0x54b292
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.0054ae20
add esp, 0xc
jmp 0x54b292
push dword [esp + 0x90]
push ebp
push esi
call fcn.0054ae20
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.0054ae20
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.00499250
add esp, 0x18
test eax, eax
je 0x54b2d9
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.00499250
add esp, 0x18
test eax, eax
je 0x54b2d9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.00614242
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00614242
add esp, 0x74
ret
Function at 0x54ea10
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x54ea1d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.004ca050
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x54ea64
call fcn.0048aed0
push str.ecx_gen
push 0x258
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.0048afd0
push edi
push 0x80010
push 0x39
call fcn.0048b0e0
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x54eaaf
push esi
push edi
call fcn.004c9fe0
mov esi, eax
add esp, 4
test esi, esi
jne 0x54eab2
call fcn.0048aed0
push str.ecx_gen
push 0x261
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.0048afd0
push esi
push 0x80010
push 0x39
call fcn.0048b0e0
add esp, 0x18
push edi
call fcn.004ca000
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x54eadf
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x54eadf
mov edx, dword [ebx + 8]
cmp edx, 2
je 0x54eaa3
cmp edx, 3
je 0x54eaa3
push ecx
push eax
push esi
push edi
call fcn.0055ad00
add esp, 0x10
test eax, eax
je 0x54eaa3
jmp 0x54eaf3
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.004b3f00
add esp, 0x10
test eax, eax
jle 0x54eaa3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x54eafb
jmp dword [eax*4 + 0x54eb7c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.004dbd50
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.004e4fc0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004db640
jmp 0x54eb64
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.004e33b0
add esp, 0x10
test eax, eax
je 0x54eaa3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret