joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1120
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4e11e4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4e11e4
mov eax, dword [ecx + 0x14]
mov dword [ecx + 0x20], 0
cmp eax, 0x11
ja case.0x4e1153.1
movzx eax, byte [eax + 0x4e1218]
jmp dword [eax*4 + 0x4e11ec]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e12d0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1230
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1d50
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e2160
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1750
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1fd0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1820
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e2100
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e15b0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1560
mov eax, dword [ecx + 0x28]
push ecx
mov dword [ecx + 0x20], 0xc00000bb
call eax
add esp, 4
pop ebp
ret
mov eax, 0x57
pop ebp
ret

Function at 0x4e11a2
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4e11e4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4e11e4
mov eax, dword [ecx + 0x14]
mov dword [ecx + 0x20], 0
cmp eax, 0x11
ja case.0x4e1153.1
movzx eax, byte [eax + 0x4e1218]
jmp dword [eax*4 + 0x4e11ec]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e12d0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1230
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1d50
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e2160
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1750
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1fd0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1820
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e2100
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e15b0
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
pop ebp
jmp fcn.004e1560
mov eax, dword [ecx + 0x28]
push ecx
mov dword [ecx + 0x20], 0xc00000bb
call eax
add esp, 4
pop ebp
ret
mov eax, 0x57
pop ebp
ret
Function at 0x4e29a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
jne 0x4e29b4
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x4e29ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
je 0x4e29e0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [esi + 0xc], 0xffffffff
cmp dword [esi + 0x26c], edi
je 0x4e2a07
push dword [esi + 0x264]
cmp dword [esi + 4], edi
je 0x4e29fd
call fcn.004e33a0
add esp, 4
jmp 0x4e2a03
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4e2a0c
mov edi, 1
push dword [esi + 0x264]
call fcn.00580204
push esi
call fcn.00580204
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4e2a30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push dword [esi + 0x264]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4e2aaa
shr eax, 4
and eax, 1
mov dword [esi + 4], eax
je 0x4e2a90
cmp dword [esi + 0x27c], 2
jne 0x4e2a70
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret
test byte [esi + 0x280], 0x40
je 0x4e2a87
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret
test byte [esi + 0x280], 1
je 0x4e2ae8
push 0x10b
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [esi + 0x280]
and eax, 1
mov dword [esi + 4], eax
je 0x4e2ae8
mov eax, dword [esi + 0x27c]
cmp eax, 3
je 0x4e2ac8
cmp eax, 2
jne 0x4e2ada
push 0
push dword [esi + 0x264]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4e2a87
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret
cmp dword [esi + 8], 0xffffffff
jne 0x4e2bdc
mov eax, dword [esi + 0x27c]
cmp eax, 5
ja case.default.0x4e2afd
jmp dword [eax*4 + 0x4e2bec]
mov edi, 3
jmp case.default.0x4e2afd
mov edi, 1
jmp case.default.0x4e2afd
mov edi, 4
jmp case.default.0x4e2afd
mov edi, 5
jmp case.default.0x4e2afd
mov edi, 2
push 0
push dword [esi + 0x270]
push edi
push 0
push dword [esi + 0x274]
push dword [esi + 0x278]
push dword [esi + 0x264]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x4e2bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4e2bdc
push 0
push 0
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 4
push str.com.freerdp.channels.drive.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x4e2bd3
push dword [esi + 0x264]
push dword [ebp + 8]
push str.Error_in_drive_file_init:__s__s
push str.drive_file_init
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPchannelsdriveclientdrive_file.c
push 0x132
push 4
push 0
push str.com.freerdp.channels.drive.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x24
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
cmp dword [esi + 8], 0xffffffff
pop edi
setne al
pop esi
pop ebp
ret
Function at 0x4e33a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x63e758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
push esi
mov esi, 1
test eax, eax
jne 0x4e33d5
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ce
mov esp, ebp
pop ebp
ret
mov ecx, eax
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e33e0
sub ecx, edx
sar ecx, 1
push ebx
push edi
lea edi, [ecx + ecx]
lea eax, [edi + 6]
push eax
push 1
call fcn.00580d1f
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4e3461
push 4
push str.com.freerdp.channels.drive.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x4e344e
push str.malloc_failed_
push str.drive_file_remove_dir
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPchannelsdriveclientdrive_file.c
push 0x7a
push 4
push ebx
push str.com.freerdp.channels.drive.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x1c
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ce
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x258]
push ebx
call fcn.00580540
add esp, 0xc
shr edi, 1
lea eax, [ebp - 0x254]
push eax
push ebx
mov dword [ebx + edi*2], 0x2a002f
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
mov dword [ebp - 0x25c], eax
mov word [ebx + edi*2 + 2], cx
cmp eax, 0xffffffff
jne 0x4e34c0
push ebx
call fcn.00580204
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ce
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x228]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e34d0
sub eax, edx
sar eax, 1
cmp eax, 1
jne 0x4e34ee
cmp word [ebp - 0x228], 0x2e
jmp 0x4e3505
cmp eax, 2
jne 0x4e3507
cmp word [ebp - 0x228], 0x2e
jne 0x4e3507
cmp word [ebp - 0x226], 0x2e
je 0x4e3541
add eax, eax
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
call fcn.004e2860
add esp, 0xc
mov edi, eax
test byte [ebp - 0x254], 0x10
push edi
je 0x4e3530
call fcn.004e33a0
add esp, 4
jmp 0x4e3536
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov esi, eax
call fcn.00580204
add esp, 4
test esi, esi
je 0x4e3560
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4e34c0
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x4e3582
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
and esi, eax
push ebx
call fcn.00580204
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop ebx
pop esi
call fcn.005802ce
mov esp, ebp
pop ebp
ret
Function at 0x4e3ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
test ebx, ebx
je 0x4e3f2e
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4e3f2e
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4e3f1d
jmp 0x4e3f00
push 0
lea eax, [ebp + 8]
push eax
push esi
push edi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4e3f27
add edi, dword [ebp + 8]
sub esi, dword [ebp + 8]
jne 0x4e3f00
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4e3f40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str.printers
push dword [eax + 0x3808]
call fcn.00437b30
push dword [ebp + 0x10]
mov edi, eax
push dword [ebp + 0xc]
call sym.wfreerdp.exe_crypto_base64_encode
mov ebx, eax
push ebx
push edi
call fcn.00437b30
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4e3f9c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4e3f9c
push eax
push esi
call fcn.00437ea0
add esp, 8
test eax, eax
jne 0x4e3f9c
push esi
call fcn.00580204
add esp, 4
xor esi, esi
push edi
call fcn.00580204
push ebx
call fcn.00580204
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e4a80
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004e3f40
push dword [ebp + 0x18]
mov edi, eax
push dword [ebp + 0x14]
push esi
call fcn.004e3f40
add esp, 0x18
mov esi, eax
test edi, edi
je 0x4e4ac3
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4e4ac3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, eax
push edi
call fcn.00580204
push esi
call fcn.00580204
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e4ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], 0
push dword [eax*4 + 0x63aba8]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00437b30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e4f25
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0x80
push 3
push 0
push 0
push connect
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push esi
mov dword [ebp + 0xc], edi
call fcn.00580204
add esp, 4
cmp edi, 0xffffffff
jne 0x4e4f5b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x4e4fa6
cmp dword [ebp - 0xc], ebx
jne 0x4e4fa6
test edi, edi
je 0x4e4fa6
push edi
call fcn.0058023c
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x4e4fa6
push 0
lea eax, [ebp - 8]
push eax
push edi
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
xor eax, eax
cmp edi, dword [ebp - 8]
cmovne ebx, eax
jmp 0x4e4fa9
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4e5014
cmp edi, 0x7fffffff
ja 0x4e5014
mov esi, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
push esi
push edi
mov edi, dword [ebp - 4]
push edi
mov dword [ebp + 0xc], 0
call sym.wfreerdp.exe_crypto_base64_decode
add esp, 0x10
cmp dword [esi], 0
je 0x4e4ffb
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4e4ffb
mov eax, dword [ebp + 0x14]
push edi
mov dword [eax], ecx
call fcn.00580204
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
xor ebx, ebx
push edi
mov dword [eax], ebx
call fcn.00580204
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
push edi
mov dword [ecx], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
call fcn.00580204
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e5330
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
xor edi, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004e3f40
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4e5362
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4e5362
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov edi, eax
push esi
call fcn.00580204
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4e5680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [eax*4 + 0x63aba8]
mov dword [ebp - 4], 0
xor edi, edi
push dword [ebp + 8]
xor ebx, ebx
call fcn.00437b30
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e56b6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [ebp + 0xc], eax
call fcn.00580204
add esp, 4
cmp dword [ebp + 0xc], 0xffffffff
je 0x4e56ad
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4e5725
push eax
push dword [ebp + 0x10]
call sym.wfreerdp.exe_crypto_base64_encode
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4e572a
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4e5700
push 0
lea eax, [ebp - 4]
sub esi, ecx
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp esi, dword [ebp - 4]
je 0x4e572a
xor edi, edi
jmp 0x4e572a
mov edi, 1
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00580204
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
call fcn.00580d1f
mov esi, eax
add esp, 8
test esi, esi
jne 0x4e61d4
push 4
push str.com.freerdp.channels.smartcard.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x4e61cf
push str.calloc_failed_
push str.smartcard_context_new
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPchannels_smartcardclient_smartcard_main.c
push 0x92
push 4
push esi
push str.com.freerdp.channels.smartcard.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x1c
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [esi + 4], eax
call fcn.00431040
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x4e624d
push 4
push str.com.freerdp.channels.smartcard.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x4e62bc
push str.MessageQueue_New_failed_
push str.smartcard_context_new
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPchannels_smartcardclient_smartcard_main.c
push 0x9c
push 4
push 0
push str.com.freerdp.channels.smartcard.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x1c
push esi
call fcn.00580204
add esp, 4
xor eax, eax
pop esi
pop ebp
ret
push 0
push 0
push esi
push 0x4e62d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x4e62ca
push 4
push str.com.freerdp.channels.smartcard.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x4e62b1
push str.CreateThread_failed_
push str.smartcard_context_new
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPchannels_smartcardclient_smartcard_main.c
push 0xa6
push 4
push 0
push str.com.freerdp.channels.smartcard.client
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x1c
push dword [esi + 8]
call fcn.00431000
add esp, 4
push esi
call fcn.00580204
add esp, 4
xor eax, eax
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
Function at 0x50dbf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x68
call fcn.005834f0
mov eax, dword [0x63e758]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
lea eax, [esp + 0x34]
mov byte [esp + 0xf], 0x41
push edi
push eax
call fcn.00527b10
lea eax, [esp + 0x3c]
push 8
push eax
call fcn.0052ef10
lea eax, [esp + 0x2c]
push eax
call fcn.00527b10
mov edi, dword [esp + 0x94]
xor ebx, ebx
add esp, 0x10
mov dword [esp + 0x18], ebx
test edi, edi
jle 0x50ddb3
mov eax, 0x10
sub eax, ebp
mov dword [esp + 0x1c], eax
nop
inc esi
cmp esi, 0x10
ja 0x50ddee
test esi, esi
je 0x50dc98
movzx eax, byte [esp + 0x13]
lea edi, [esp + 0x64]
imul eax, eax, 0x1010101
mov ecx, esi
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
mov ebx, dword [esp + 0x18]
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x84]
inc byte [esp + 0x13]
push 0
call fcn.0051baa0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005276f0
push esi
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.005278a0
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0xc0]
push dword [eax + 0x10]
add eax, 0x14
push eax
lea eax, [esp + 0x40]
push eax
call fcn.005278a0
mov eax, dword [esp + 0x38]
push 0x20
mov eax, dword [eax + 0x58]
add eax, 0xa0
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.005278a0
mov eax, dword [esp + 0x44]
push 0x20
mov eax, dword [eax + 0x58]
add eax, 0xc0
push eax
lea eax, [esp + 0x58]
push eax
call fcn.005278a0
push 0
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.00527650
add esp, 0x48
push 0
call fcn.00535630
push eax
lea eax, [esp + 0x40]
push eax
call fcn.005276f0
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc0]
push dword [eax + 0x10]
add eax, 0x14
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.005278a0
push 0x14
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.005278a0
mov eax, dword [esp + 0x40]
add esp, 0x24
add eax, ebp
push 0
cmp eax, edi
jle 0x50dd93
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00527650
mov eax, edi
sub eax, ebx
push eax
lea eax, [esp + 0x60]
push eax
push ebp
call fcn.00580540
add esp, 0x18
jmp 0x50dda1
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.00527650
add esp, 0xc
add ebx, 0x10
add ebp, 0x10
mov dword [esp + 0x18], ebx
cmp ebx, edi
jl 0x50dc60
lea eax, [esp + 0x50]
push 0x14
push eax
call fcn.00401340
lea eax, [esp + 0x40]
push eax
call fcn.005278b0
lea eax, [esp + 0x2c]
push eax
call fcn.005278b0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.005802ce
add esp, 0x68
ret
push 0xb6
push str.._ssl_s3_enc.c
push 0x44
push 0xee
push 0x14
call fcn.0051a470
mov ecx, dword [esp + 0x88]
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005802ce
add esp, 0x68
ret
Function at 0x513d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.005834f0
mov eax, dword [0x63e758]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x513df6
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.0051ae50
add esp, 0xc
cmp edi, 0x40
jbe 0x513e12
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.0051ae50
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x513e39
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x30], esi
call fcn.00580b90
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x513f2f
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x28], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x28]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x30]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x513eb0
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x513f6a
mov ebp, dword [esp + 0x2c]
lea esp, [esp]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x513f40
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005802ce
add esp, 0xa8
ret