joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0eb2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x58]
cmp dword [edx + 4], 0xffffffff
mov dword [esp], ecx
mov ecx, 0
mov esi, 0x7fffffff
mov edi, edx
lea ebp, [esp + 0x10]
cmovne ecx, edx
cmp eax, esi
cmovb esi, eax
lea eax, [edx + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], eax
mov edx, dword [edi + 0x10]
mov ecx, ebp
push dword [esp + 0x50]
call fcn.004e0bf0
pop eax
mov edx, dword [esp + 0x10]
cmp edx, 2
je 0x4e1032
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test edx, edx
jne 0x4e103a
mov esi, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, 0x55980c
mov dword [esp + 0x38], eax
mov ecx, esi
call fcn.004349d9
push 0
push dword [esp + 0x34]
push dword [esp + 0x5c]
push dword [esi + 4]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x4e0f54
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x4e0fd8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esp + 4], cl
and word [esp + 5], 0
mov byte [esp + 7], cl
lea ecx, [esp + 4]
mov dword [esp + 8], eax
call fcn.00425b14
cmp al, 0xd
jne 0x4e0fd8
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov byte [esp + 0x10], 4
test eax, eax
je 0x4e0fbb
mov esi, dword [eax + 8]
mov edx, dword [eax + 4]
lock inc dword [esi]
jle 0x4e105c
add edx, 8
lea ecx, [esp + 0x1c]
push dword [eax + 0xc]
push dword [eax]
push esi
call fcn.0043dc13
add esp, 0xc
mov ecx, ebp
call fcn.004c2e17
mov al, byte [esp + 0x1c]
jmp 0x4e0fcb
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
cmp al, 4
je 0x4e0fd8
mov ebx, dword [esp + 0x1c]
cmp bl, 4
jne 0x4e101b
mov ebx, dword [esp + 4]
mov esi, dword [esp + 8]
cmp bl, 4
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
je 0x4e104b
lea ecx, [esp + 0x24]
call fcn.004ddfd4
cmp al, 0xd
jne 0x4e1044
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
call fcn.004e09eb
push ebp
call fcn.004dc544
pop eax
jmp 0x4e0eeb
mov esi, dword [esp + 0x20]
lea ecx, [esp + 4]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.004c2e17
jmp 0x4e0fed
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x4e1054
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4e1054
mov eax, dword [esp]
mov dword [eax], ebx
jmp 0x4e1051
mov eax, dword [esp]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4e1060
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
lea eax, [edx + 8]
lea esi, [esp + 0x10]
lea ebp, [esp + 4]
mov dword [esp], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
xor eax, eax
cmp dword [edx + 4], 0xffffffff
cmovne eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov ecx, esi
mov edx, dword [eax + 0x10]
push 1
push dword [esp + 0x54]
call fcn.004e0a31
pop eax
pop ecx
mov edx, dword [esp + 0x10]
cmp edx, 2
je 0x4e11df
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
test edx, edx
jne 0x4e11e7
mov edi, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
mov edx, 0x55981c
mov dword [esp + 0x38], eax
mov ecx, edi
call fcn.004349d9
mov eax, dword [edi + 4]
and dword [esp + 0x10], 0
push 0
push 0
push 0
mov edi, esi
push esi
push dword [esp + 0x68]
push dword [esp + 0x68]
push eax
call sub.ws2_32.dll_WSASend
cmp eax, 0xffffffff
je 0x4e111c
mov byte [esp + 0x1c], 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], esi
cmp bl, 4
mov dword [esp + 4], ebx
jne 0x4e11a2
jmp 0x4e11f8
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and dword [esp + 0x1c], 0
lea ecx, [esp + 0x1c]
mov esi, eax
mov dword [esp + 0x20], eax
call fcn.00425b14
cmp al, 0xd
jne 0x4e1197
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov byte [esp + 0x10], 4
test eax, eax
je 0x4e117a
mov ebx, dword [eax + 8]
mov edx, dword [eax + 4]
lock inc dword [ebx]
jle 0x4e1209
add edx, 8
lea ecx, [esp + 0x24]
push dword [eax + 0xc]
push dword [eax]
push ebx
call fcn.0043dc13
add esp, 0xc
mov ecx, edi
call fcn.004c2e17
mov al, byte [esp + 0x24]
jmp 0x4e118a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
cmp al, 4
je 0x4e1197
mov ebx, dword [esp + 0x24]
cmp bl, 4
jne 0x4e11c8
and dword [esp + 4], 0
xor ebx, ebx
mov dword [esp + 8], esi
mov ecx, ebp
call fcn.004ddfd4
cmp al, 0xd
jne 0x4e11f1
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x34]
call fcn.004e09eb
push ebp
call fcn.004dc544
pop eax
mov esi, edi
jmp 0x4e108a
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.004c2e17
jmp 0x4e11a2
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x4e1201
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4e1201
mov eax, dword [esp]
mov dword [eax], ebx
jmp 0x4e11fe
mov eax, dword [esp]
mov byte [eax], 4
mov dword [eax + 4], esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x4e125d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push eax
mov ecx, 0x58b120
call fcn.004db8e5
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x4e127c
cmp dword [eax], 0
mov esi, eax
jne 0x4e12d7
mov ecx, 0x58b120
call fcn.004db8e5
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4e12d5
mov esi, eax
test eax, eax
jne 0x4e12c1
push 8
pop ecx
push 4
pop edx
call fcn.00423cc6
and dword [eax], 0
mov ecx, 0x58b120
mov esi, eax
mov dword [eax + 4], 0x58b120
call fcn.004db8e5
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
call fcn.004ded28
mov edx, dword [esi]
mov ecx, esp
mov dword [ecx], edx
mov dword [esi], eax
call fcn.004ded4c
jmp 0x4e12d7
xor esi, esi
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x4e9394
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
call 0x4e93a0
pop eax
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x74]
test eax, eax
je 0x4e97b2
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x7c]
mov ebx, dword [esp + 0x78]
lea edi, [esp + 0x38]
mov esi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [edi], eax
mov al, byte [esi + 1]
mov dword [edi + 4], ebx
and dword [edi + 8], 0
mov edi, dword [edx + 8]
mov byte [esp + 7], al
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
dec edi
cmp eax, ecx
je 0x4e97c0
cmp edi, 0xffffffff
je 0x4e97d5
mov edx, dword [esp + 0x7c]
cmp ecx, eax
mov dword [edx + 8], edi
jbe 0x4e97b6
mov ebp, dword [esp + 0x38]
mov bl, byte [ebp + eax]
mov edx, ebx
not dl
test dl, 0x1f
je 0x4e97b6
lea edx, [eax + 1]
cmp ecx, edx
jbe 0x4e97b6
mov dword [esp], edi
mov edi, esi
lea esi, [eax + 2]
mov dword [esp + 0x40], esi
movzx edx, byte [ebp + eax + 1]
test dl, dl
jns 0x4e9475
cmp dl, 0x82
je 0x4e9576
cmp edx, 0x81
jne 0x4e97b6
cmp ecx, esi
jbe 0x4e97b6
lea ecx, [eax + 3]
mov dword [esp + 0x40], ecx
movzx edx, byte [ebp + eax + 2]
test dl, dl
jns 0x4e97b6
mov esi, edi
mov edi, dword [esp]
lea ecx, [esp + 0x38]
call fcn.004e8363
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x4e97b8
cmp bl, 0x30
jne 0x4e97b8
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edx
and dword [esp + 0x5c], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x54]
call fcn.004e9214
mov cl, byte [esp + 0x14]
mov al, byte [esp + 0x15]
cmp cl, 4
je 0x4e97b8
mov edx, dword [esp + 0x5c]
cmp edx, dword [esp + 0x58]
jne 0x4e97b6
movzx edx, byte [esi]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, dword [edx*4 + 0x4e97e4]
add edx, dword [esp + 0x50]
jmp edx
cmp ecx, esi
jbe 0x4e97b6
lea edx, [eax + 3]
cmp ecx, edx
jbe 0x4e97b6
lea ecx, [eax + 4]
movzx edx, byte [ebp + eax + 2]
mov dword [esp + 0x40], ecx
movzx eax, byte [ebp + eax + 3]
shl edx, 8
or edx, eax
xor eax, eax
cmp edx, 0x100
jb 0x4e97b8
mov esi, edi
mov edi, dword [esp]
cmp edx, 0xffff
jne 0x4e947a
jmp 0x4e97b8
mov al, 0x27
jmp 0x4e97b8
xor eax, eax
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
test byte [esp + 0x10], 1
sete al
or al, byte [esp + 0xc]
and al, 1
shl al, 4
add al, 0x17
jmp 0x4e97b8
mov al, 0x13
jmp 0x4e97b8
Function at 0x4ed51f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1020
call fcn.004fee60
mov ebp, dword [edx]
mov ebx, dword [edx + 4]
lea edi, [esp + 0x10]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
lea esi, [esp + 0x20]
mov dword [edi], 0x800
push 0x1000
push 0
push esi
call fcn.004ff8d0
add esp, 0xc
push 0
push 0
push 0
push 0
push edi
push esi
push ebp
push dword [ebx]
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x4ed582
cmp eax, 0x103
jne 0x4ed5c4
mov eax, dword [esp + 4]
mov dword [eax], 2
jmp 0x4ed5f6
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push 0x5809a0
call fcn.004ed601
pop ecx
lea esi, [esp + 0x14]
mov ebx, edx
mov edx, eax
mov ecx, esi
push ebx
call fcn.00417b10
pop eax
mov ecx, dword [esi + 4]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
xor edx, edx
test ecx, ecx
sete byte [esp + 3]
je 0x4ed5d3
mov eax, ecx
mov ecx, dword [esp + 0x14]
jmp 0x4ed5d6
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
xor ecx, ecx
xor edx, edx
inc edx
jmp 0x4ed5e8
push 9
pop eax
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov bl, byte [esp + 3]
mov dl, bl
mov ebx, dword [esp + 0xc]
inc ebp
mov dword [esi], edx
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebx
mov dword [edi], ebp
add esp, 0x1020
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ed61f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.004fee60
mov eax, dword [edx]
mov esi, dword [edx + 4]
mov edi, 0x800
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
mov dword [eax], edi
lea eax, [esp + 0x38]
push 0x1000
push 0
push eax
call fcn.004ff8d0
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, 0x800
mov dword [eax], edi
lea eax, [esp + 0x18]
and dword [eax], 0
call fcn.004ed3be
lea edi, [esp + 0x2c]
mov ebx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
and dword [edi + 8], 0
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x2c]
push esi
call dword [sym.imp.advapi32.dll_RegEnumValueW]
cmp eax, 0xea
jne 0x4ed6c3
mov edx, dword [esp + 0xc]
inc dword [esp + 8]
mov ecx, edi
call fcn.004ed3a0
mov ebx, dword [esp + 0x30]
jmp 0x4ed685
mov ebp, eax
test eax, eax
je 0x4ed6e5
cmp ebp, 0x103
jne 0x4ed756
mov al, 0xd
mov dword [esp], eax
mov al, 1
mov dword [esp + 4], eax
jmp 0x4ed765
mov edx, dword [esp + 8]
lea ecx, [esp + 0x38]
push 0x5809b0
call fcn.004ed601
pop ecx
mov edi, edx
lea ebp, [esp + 0x1c]
mov edx, eax
mov ecx, ebp
push edi
call fcn.00417b10
pop eax
mov ebp, dword [ebp + 4]
test ebp, ebp
je 0x4ed743
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x18]
cmp ecx, 0xc
jae 0x4ed748
mov esi, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
mov edx, ecx
mov ebx, edx
mov dword [esp + 0x24], esi
movsd qword [esp + 0x1c], xmm0
jmp 0x4ed787
push 0xd
pop ebp
jmp 0x4ed756
mov ecx, edi
mov edx, ebp
call fcn.004c2719
mov ebp, 0xde
mov al, 0xc
mov dword [esp + 4], 0
xor edi, edi
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edx, ebx
call fcn.004c2719
cmp byte [esp + 4], 0
je 0x4ed785
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp]
mov dword [ecx], edi
mov dword [ecx + 4], ebp
jmp 0x4ed7b2
mov bl, 0xc
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
movsd xmm0, qword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov dword [edx + 0x14], ecx
mov ecx, edx
movsd qword [edx + 0xc], xmm0
mov edx, dword [esp + 0x28]
inc esi
mov dword [ecx + 4], ebp
mov dword [ecx], edi
mov dword [ecx + 8], eax
mov dword [edx], esi
mov byte [ecx + 0x18], bl
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ee380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
movups xmm2, xmmword [eax]
mov ecx, dword [edx + 0xf0]
mov eax, dword [esp + 8]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
lea edx, [edx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec ecx
movups xmm1, xmmword [edx]
lea edx, [edx + 0x10]
jne 0x4ee3a2
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [eax], xmm2
pxor xmm2, xmm2
ret
Function at 0x4f0962
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov edx, ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, esi
push edi
push 8
sub edx, esi
pop edi
mov eax, dword [edx + ecx]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x4f0978
mov edi, dword [esp + 0x1c]
xor ebx, ebx
cmp edi, 1
jbe 0x4f09cb
lea eax, [edi - 1]
add ebp, 0x20
mov edi, eax
push esi
call fcn.004f1082
push esi
call fcn.004f0fc3
push esi
call fcn.004f0aed
add esp, 0xc
mov ecx, ebx
mov eax, dword [ebp]
add ebp, 4
xor dword [esi + ecx*4], eax
inc ecx
cmp ecx, 8
jb 0x4f09af
sub edi, 1
jne 0x4f0998
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
push esi
call fcn.004f1082
push esi
call fcn.004f0fc3
pop ecx
shl edi, 5
pop ecx
add edi, ebp
mov eax, dword [edi]
lea edi, [edi + 4]
xor dword [esi + ebx*4], eax
inc ebx
cmp ebx, 8
jb 0x4f09de
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4f0d7f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x58b148]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0xf0], 0xa
call fcn.004f0830
push 0x10
lea eax, [esp + 0x20]
push eax
push esi
call fcn.005010b0
xor edi, edi
lea ebx, [esi + 0x10]
add esp, 0x14
mov dword [esp + 0x10], ebx
inc edi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004f1005
movzx ebp, byte [edi + 0x58154b]
xor ebx, ebx
pop ecx
pop ecx
mov edx, dword [esp + ebx*4 + 0x24]
mov cl, bl
mov eax, edx
add cl, cl
and eax, 0x3000000
shr edx, 8
or eax, edx
mov esi, ebp
shr eax, 0x12
shr esi, cl
and esi, 3
xor esi, eax
xor esi, dword [esp + ebx*4 + 0x14]
mov eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
cmp ebx, 4
jb 0x4f0de2
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0x10
push eax
push ebx
call fcn.005010b0
add esp, 0xc
add ebx, 0x10
inc edi
mov dword [esp + 0x10], ebx
cmp edi, 0xa
jbe 0x4f0dc8
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fef98
add esp, 0x28
ret
Function at 0x4f0e55
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x58b148]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x4c]
push esi
push eax
mov dword [edi + 0xf0], 0xe
call fcn.004f0830
push 0x10
pop ebx
push ebx
lea eax, [esp + 0x20]
push eax
push edi
call fcn.005010b0
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.004f0830
push ebx
lea eax, [esp + 0x44]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.005010b0
add esp, 0x28
add edi, 0x20
mov dword [esp + 0x10], edi
push 2
pop ebp
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004f1005
mov eax, ebp
shr eax, 1
xor ebx, ebx
pop ecx
pop ecx
movzx edi, byte [eax + 0x58154b]
mov edx, dword [esp + ebx*4 + 0x34]
mov cl, bl
mov eax, edx
add cl, cl
and eax, 0x3000000
shr edx, 8
or eax, edx
mov esi, edi
shr eax, 0x12
shr esi, cl
and esi, 3
xor esi, eax
xor esi, dword [esp + ebx*4 + 0x14]
mov eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
mov dword [esp + ebx*4 + 0x14], eax
inc ebx
cmp ebx, 4
jb 0x4f0edb
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0x10
pop ebx
push ebx
push eax
push edi
call fcn.005010b0
add esp, 0xc
cmp ebp, 0xe
je 0x4f0fb0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004f1005
movups xmm3, xmmword [esp + 0x3c]
push 0x18
movups xmm0, xmmword [esp + 0x30]
pop eax
push 8
movd xmm4, eax
pop eax
psrld xmm3, xmm4
push ebx
pxor xmm3, xmm0
movd xmm0, eax
movaps xmm2, xmm3
pslld xmm2, xmm0
movaps xmm1, xmm3
movd xmm0, ebx
pxor xmm2, xmm3
lea eax, [esp + 0x30]
pslld xmm1, xmm0
pslld xmm3, xmm4
push eax
pxor xmm2, xmm1
lea eax, [edi + 0x10]
pxor xmm2, xmm3
push eax
movups xmmword [esp + 0x38], xmm2
call fcn.005010b0
add ebp, 2
add edi, 0x20
add esp, 0x14
mov dword [esp + 0x10], edi
cmp ebp, 0xe
jbe 0x4f0ebd
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fef98
add esp, 0x38
ret

Function at 0x4f2097
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 4]
neg edx
push esi
mov esi, dword [esp + 0xc]
push edi
push 0xa
sub esi, ecx
pop edi
mov eax, dword [esi + ecx]
xor eax, dword [ecx]
and eax, edx
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x4f20ac
pop edi
pop esi
ret

Function at 0x4f20c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
push 0xa
neg edi
sub esi, edx
pop ebx
mov ecx, dword [esi + edx]
mov eax, dword [edx]
xor eax, ecx
and eax, edi
xor ecx, eax
mov dword [esi + edx], ecx
xor dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x4f20d6
pop edi
pop esi
pop ebx
ret
Function at 0x4f4533
Capabilities:
Encrypt data using curve25519

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx + 0x1f]
and byte [ecx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ecx + 0x1f], al
ret
Function at 0x4f97ed
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x91c
mov eax, dword [0x58b148]
xor eax, esp
mov dword [esp + 0x918], eax
push ebx
mov ebx, dword [esp + 0x92c]
push ebp
push esi
mov esi, dword [esp + 0x92c]
push edi
push 0xf
mov dword [esp + 0x18], esi
lea edi, [esp + 0x274]
pop ebp
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.004f34e3
lea eax, [ebx + 0x20]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004f34e3
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [edi - 0x50]
push eax
call fcn.004f2001
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [edi - 0x28]
push eax
call fcn.004f36a4
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x6c]
push eax
push edi
call fcn.004f270d
push 0x5815a8
push edi
push edi
call fcn.004f270d
add esp, 0x40
add ebx, 0x40
add edi, 0x78
sub ebp, 1
jne 0x4f9821
push esi
call fcn.004f1fd6
lea eax, [esi + 0x28]
push eax
call fcn.004f1fe7
lea eax, [esi + 0x50]
push eax
call fcn.004f1fe7
lea eax, [esi + 0x78]
push eax
call fcn.004f1fd6
add esp, 0x10
inc ebp
push 0x3f
pop eax
mov dword [esp + 0x10], eax
mov edx, eax
mov bl, al
shr edx, 3
xor bh, bh
xor edi, edi
and bl, 7
add edx, dword [esp + 0x934]
mov al, byte [edx]
mov cl, bl
shr al, cl
lea edx, [edx + 8]
and al, 1
mov ecx, edi
shl al, cl
or bh, al
inc edi
cmp edi, 4
jb 0x4f98cb
push 0x28
xor esi, esi
lea eax, [esp + 0x10c]
push esi
push eax
call fcn.004ff8d0
push 0x28
lea eax, [esp + 0x140]
mov dword [esp + 0x118], ebp
push esi
push eax
call fcn.004ff8d0
push 0x28
lea eax, [esp + 0x174]
mov dword [esp + 0x14c], ebp
push esi
push eax
call fcn.004ff8d0
add esp, 0x24
movsx esi, bh
lea edi, [esp + 0x270]
mov eax, esi
xor eax, ebp
lea ebx, [eax - 1]
not eax
shr eax, 0x1f
shr ebx, 0x1f
and bl, al
lea eax, [edi - 0x50]
neg bl
and ebx, 1
push ebx
push eax
lea eax, [esp + 0x110]
push eax
call fcn.004f2097
push ebx
lea eax, [edi - 0x28]
push eax
lea eax, [esp + 0x144]
push eax
call fcn.004f2097
push ebx
lea eax, [esp + 0x174]
push edi
push eax
call fcn.004f2097
add esp, 0x24
add edi, 0x78
inc ebp
cmp ebp, 0x10
jb 0x4f992f
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x180]
push esi
push eax
call fcn.004f9799
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0x74]
push esi
push eax
call fcn.004f9662
lea eax, [esp + 0x7c]
push eax
push esi
call fcn.004f9750
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x88]
push esi
push eax
call fcn.004f3f61
lea eax, [esp + 0x90]
push eax
push esi
call fcn.004f9750
mov eax, dword [esp + 0x40]
add esp, 0x30
dec eax
mov dword [esp + 0x10], eax
push 1
pop ebp
cmp eax, 0x40
jb 0x4f98b6
mov ecx, dword [esp + 0x928]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fef98
add esp, 0x91c
ret

Function at 0x4f9af7
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebx
xor bl, bl
test edx, edx
je 0x4f9b1b
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
or bl, al
inc ecx
sub edx, 1
jne 0x4f9b0d
pop esi
movzx eax, bl
pop ebx
ret
Function at 0x4fb80c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 0x60
push ebx
push edi
call fcn.004ff8d0
mov ebp, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x14], ebx
jbe 0x4fb869
lea ecx, [ebp - 1]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
push esi
push edi
mov esi, ecx
push ebp
xor esi, ebx
push esi
push edi
call fcn.004f9d04
lea ecx, [edi + 0x20]
push ecx
lea eax, [ebp + 0x20]
push eax
push esi
push ecx
call fcn.004f9d04
mov ecx, dword [esp + 0x40]
add esp, 0x20
inc ebx
add ebp, 0x40
cmp ebx, dword [esp + 0x18]
jb 0x4fb837
mov ebp, dword [esp + 0x14]
pop esi
lea eax, [edi + 0x40]
push 0x581d70
push eax
push ebp
push eax
call fcn.004f9d04
add esp, 0x10
pop edi
pop ebp
pop ebx
ret