joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c750
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52460d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x592830]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x13c]
xorps xmm0, xmm0
mov dword [esi + 0x260], 0
mov dword [esi + 0x264], 0
movsd qword [esi + 0x258], xmm0
mov dword [esi + 0x254], 0
mov byte [eax + 0x17], 1
cmp byte [esi + 0x188], 0
je 0x40c821
mov eax, dword [esi + 0x13c]
push 0
movups xmm1, xmmword [eax]
movaps xmm0, xmm1
movd ecx, xmm1
psrldq xmm0, 4
movd edx, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
psrldq xmm1, 0xc
mov dword [ebp - 0x28], ecx
add eax, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
movd eax, xmm1
add eax, edx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
movups xmm0, xmmword [ebp - 0x28]
push eax
push dword [esi + 8]
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x138]
push 0
mov byte [eax + 0x17], 1
mov eax, dword [esi + 0x138]
movups xmm1, xmmword [eax]
movaps xmm0, xmm1
movd ecx, xmm1
psrldq xmm0, 4
movd edx, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
psrldq xmm1, 0xc
mov dword [ebp - 0x28], ecx
add eax, ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
movd eax, xmm1
add eax, edx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
movups xmm0, xmmword [ebp - 0x28]
push eax
push dword [esi + 8]
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 0x248]
mov al, byte [ebx + 8]
mov byte [ecx + 0x94], al
cmp dword [esi + 0x250], 0
je 0x40c8d3
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [esi + 0x250], eax
je 0x40c95d
push 0
push dword [esi + 0x250]
push dword [esi + 0x24c]
call fcn.004f87a2
add esp, 0xc
test eax, eax
jne 0x40c964
mov dword [esi + 0x24c], eax
mov dword [esi + 0x250], eax
push 8
call fcn.004f952f
mov ecx, dword [esi + 0x248]
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x412f80
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x4117a0
push 0
push 0
call fcn.005054f2
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x40c94f
cmp dword [esi + 0x250], 0
jne 0x40c96b
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x24c], ecx
mov dword [esi + 0x250], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f929f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 6
mov dword [ebp - 0x1c], 0
call fcn.004f873e
push 5
call fcn.004f873e
push 2
call fcn.004f873e
call fcn.00504e5b
int3
Function at 0x40f9b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5240f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x592830]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004f952f
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f814c
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412d70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524d04
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x592830]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], edx
lea ecx, [edx + 0x18]
mov dword [ebp - 0x4c], edx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov dword [ebp - 4], eax
xor esi, esi
movups xmmword [edx + 0x30], xmm0
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], 7
mov word [edx + 0x30], si
movups xmmword [edx + 0x48], xmm0
mov dword [edx + 0x58], esi
mov dword [edx + 0x5c], 7
mov word [edx + 0x48], si
lea esi, [edx + 0x60]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [edx + 0x7c]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 4
push eax
push 0x5868d4
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
call fcn.0040eb10
push 0
push 0x5868d4
mov ecx, esi
call fcn.0040eb10
mov esi, dword [ebp - 0x44]
push 0xf
push 0x586a34
lea ecx, [esi + 0x30]
call fcn.0040eb10
push 0
push 0x5868d4
lea ecx, [esi + 0x48]
call fcn.0040eb10
push 0
push 0x5868d4
mov ecx, edi
mov dword [esi + 0x98], 0
mov word [esi + 0x78], 0
call fcn.0040eb10
lea ecx, [ebp - 0x40]
mov byte [esi + 0x94], 0
call fcn.00404bf0
push str._old_metin2.bak
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0041b990
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x412f0b
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412f01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412f72
push ecx
push edx
call fcn.004f92ad
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.005059d0
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 8
jb 0x412f55
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412f4b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412f77
push ecx
push edx
call fcn.004f92ad
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f929f
mov esp, ebp
pop ebp
ret
call fcn.004febef
call fcn.004febef
int3
Function at 0x418da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x592830]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
cmp byte [edi + 0x78], 0
je 0x418ecb
lea ecx, [esp + 0x30]
call fcn.00411d40
mov ebx, dword [esp + 0x34]
cmp ebx, 0x7fffffff
jg 0x418df5
mov esi, dword [esp + 0x30]
jl 0x418dea
cmp esi, 0xfa0a1eff
jae 0x418df5
add esi, 0x5f5e100
adc ebx, 0
jmp 0x418dfd
or esi, 0xffffffff
mov ebx, bind
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x18]
call fcn.00411d40
cmp dword [esp + 0x1c], ebx
jg 0x418ebd
jl 0x418e24
cmp dword [esp + 0x18], esi
jae 0x418ebd
call fcn.004f8d7d
push 0
push 0x64
push edx
push eax
call fcn.004f9f30
sub esi, dword [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x10]
mov ebx, edx
sbb eax, dword [esp + 0x1c]
mov ecx, esi
mov edx, eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], eax
call fcn.004f9da0
comisd xmm0, xmmword [0x587d68]
jbe 0x418e73
mov esi, edi
mov eax, 0xad160000
add esi, 0xad160000
mov ecx, 0x311cd
jmp 0x418e7d
mov ecx, dword [esp + 0x20]
add esi, edi
mov eax, dword [esp + 0x28]
add edi, eax
push 0
push 0x3b9aca00
adc ebx, ecx
push ebx
push edi
call fcn.004f9f90
mov dword [esp + 0x38], eax
imul eax, eax, 0x3b9aca00
mov dword [esp + 0x3c], edx
sub esi, eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x44], esi
call fcn.004f87f1
mov esi, dword [esp + 0x18]
add esp, 4
mov ebx, dword [esp + 0x10]
jmp 0x418e05
mov eax, dword [esp + 0x2c]
cmp byte [eax + 0x78], 0
jne 0x418dc7
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004f929f
mov esp, ebp
pop ebp
ret
Function at 0x41efe0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525c2b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x592830]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 7
mov word [edi + 0x30], cx
mov dword [ebp - 4], ecx
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], ecx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0041eb80
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov esi, dword [edi + 0x5c]
mov dword [edi + 0x58], ecx
mov dword [edi + 0x5c], edx
or edi, 0xffffffff
test esi, esi
je 0x41f080
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x41f080
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x41f080
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x41f0a5
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x41f0a5
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x41f0a5
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x10]
push 0xd
push 0x5878f0
lea ecx, [esi + 0x30]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0x64
call fcn.0040eb10
mov byte [esi + 0x54], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x424570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x424749
cmp dword [esi + 0x20], 0
je 0x424749
cmp dword [esi + 0x24], 0
je 0x424749
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x424749
cmp dword [eax], esi
jne 0x424749
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x4245d3
cmp eax, 0x39
je 0x4245d3
cmp eax, 0x45
je 0x4245d3
cmp eax, 0x49
je 0x4245d3
cmp eax, 0x5b
je 0x4245d3
cmp eax, 0x67
je 0x4245d3
cmp eax, 0x71
je 0x4245d3
cmp eax, 0x29a
jne 0x424749
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x42460c
neg ecx
mov dword [edi + 0x18], ecx
cmp ecx, 2
mov eax, 0x2a
mov edx, 0x39
cmove eax, edx
mov dword [edi + 4], eax
push 0
jne 0x42462e
xor edx, edx
xor ecx, ecx
call fcn.00423cb0
jmp 0x424637
xor edx, edx
xor ecx, ecx
call fcn.004230e0
mov dword [esi + 0x30], eax
add esp, 4
lea eax, [edi + 0x94]
mov dword [edi + 0x28], 0xfffffffe
mov dword [edi + 0xb18], eax
mov ecx, edi
lea eax, [edi + 0x988]
mov dword [edi + 0xb20], 0x5860bc
mov dword [edi + 0xb24], eax
lea eax, [edi + 0xa7c]
mov dword [edi + 0xb30], eax
xor eax, eax
mov dword [edi + 0xb2c], 0x5865e0
mov dword [edi + 0xb38], 0x5860d0
mov word [edi + 0x16b8], ax
mov dword [edi + 0x16bc], eax
call fcn.00426b50
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.004fb430
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x585b1a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x585b18]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x585b1c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x585b1e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x4310b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x4310d6
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4310c6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x441de0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x441e3c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x441e2d
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call fcn.00451f90
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x441e2d
push 0x2f
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.0042e220
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x441e38
cmp dword [esp + 0x18], 0x20
je 0x441e3c
push 0x35
jmp 0x441e12
push esi
push 0x3a
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x24
call fcn.0042bc30
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x441e72
push 0x3c
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0042e220
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x441e89
push dword [esp + 0x1c]
push edi
push esi
call fcn.004faeb0
add esp, 0xc
jmp 0x441f35
push 0x43
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x20
call fcn.00450db0
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x441ecc
push 0x45
push str.....openssl_1.1.0fcryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0042e220
push 0x46
push str.....openssl_1.1.0fcryptoececx_meth.c
push esi
call fcn.0042b9f0
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x441f1b
push 0x20
push eax
call fcn.00452140
add esp, 8
test eax, eax
jg 0x441f05
push 0x4b
push str.....openssl_1.1.0fcryptoececx_meth.c
push dword [esi + 0x20]
call fcn.00450da0
push 0x4c
push str.....openssl_1.1.0fcryptoececx_meth.c
push esi
call fcn.0042b9f0
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x20]
and byte [eax], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x441f29
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.00464060
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call fcn.00428480
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x44f160
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.004f99a0
push esi
mov esi, dword [esp + 0xc]
push esi
call fcn.00428730
add esp, 4
cmp eax, 0x72
jne 0x44f2bd
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push ebp
push edi
mov edi, dword [esp + 0x2c]
mov ebp, eax
push edi
push esi
push dword [esp + 0x2c]
and eax, 1
shr ebp, 1
push dword [esp + 0x2c]
add eax, ebp
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x24], eax
call fcn.00457390
push eax
call fcn.0044eef0
add esp, 0x1c
test eax, eax
jne 0x44f1c2
pop edi
pop ebp
pop esi
pop ecx
ret
push ebx
push 0xf8
push str.....openssl_1.1.0fcryptokdf_tls1_prf.c
push edi
call fcn.0042b9c0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x44f217
mov eax, dword [esp + 0x1c]
push edi
push ebx
push dword [esp + 0x30]
add eax, ebp
push dword [esp + 0x30]
push dword [esp + 0x20]
push eax
call fcn.004296f0
push eax
call fcn.0044eef0
add esp, 0x1c
test eax, eax
jne 0x44f21f
push 0xfd
push str.....openssl_1.1.0fcryptokdf_tls1_prf.c
push edi
push ebx
call fcn.0042bac0
add esp, 0x10
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
pop ecx
ret
xor edx, edx
test edi, edi
je 0x44f29e
cmp edi, 0x20
jb 0x44f27b
lea eax, [edi - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp esi, eax
ja 0x44f23c
cmp ecx, ebx
jae 0x44f27b
mov ecx, edi
mov ebp, ebx
and ecx, 0xffffffe0
mov eax, esi
sub ebp, esi
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edx + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x44f250
cmp edx, edi
jae 0x44f29e
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
mov esi, edi
sub esi, edx
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub esi, 1
jne 0x44f290
push 0x102
push str.....openssl_1.1.0fcryptokdf_tls1_prf.c
push edi
push ebx
call fcn.0042bac0
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop ebp
pop esi
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.0044eef0
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
pop ecx
ret
Function at 0x455a60
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.00480c10
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.004fad80
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x455b17
push 0x4a
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0042e220
push 0x54575c
push esi
push 0x545760
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.0042da10
add esp, 0x2c
call fcn.004ff389
cmp dword [eax], 2
je 0x455af9
call fcn.004ff389
cmp dword [eax], 6
je 0x455af9
push 0x53
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0042e220
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0042e220
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x5456f8
call fcn.0042c130
mov esi, eax
add esp, 4
test esi, esi
jne 0x455b39
push edi
call fcn.004fef52
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.0042bd20
push edi
push ebx
push 0x6a
push esi
call fcn.0042bd50
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x457080
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x45716c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x4570fd
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x545980]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x545980]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x545980]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x545980]
mov byte [edx], al
jmp 0x457151
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x457111
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x545980]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x545980]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x45713b
lea eax, [esi + 0x3c]
jmp 0x457148
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x545980]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x4570a0
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x4577e0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.0042bd20
add esp, 8
test esi, esi
jg 0x457837
je 0x457819
cmp esi, 0xffffffff
jne 0x457837
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00457a20
add esp, 4
test eax, eax
je 0x457837
push 0xa
push edi
call fcn.0042c410
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x464060
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x11c
call fcn.004f99a0
mov eax, dword [0x592830]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x124]
push esi
mov esi, dword [esp + 0x124]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [esp + 0xdc], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [esp + 0xcc], xmm0
mov byte [esp + 0xcc], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [esp + 0xeb], al
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00466b30
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x84]
lea eax, [ecx + edx]
sub edx, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0xfc], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0xd4], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x100], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0xd8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x104], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 0xdc], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x108], edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0xe0], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x10c], edx
mov edx, dword [esp + 0x98]
mov dword [esp + 0xe4], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x110], edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0xe8], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x114], edx
mov edx, dword [esp + 0xa0]
mov dword [esp + 0xec], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x118], edx
mov edx, dword [esp + 0xa4]
mov dword [esp + 0xf0], eax
lea eax, [edx + ecx]
sub edx, ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x11c], edx
mov edx, dword [esp + 0xa8]
mov dword [esp + 0xf4], eax
lea eax, [edx + ecx]
sub edx, ecx
mov dword [esp + 0xf8], eax
mov dword [esp + 0x120], edx
lea eax, [esp + 0xfc]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00464800
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xe0]
push eax
push eax
call fcn.00464a80
lea eax, [esp + 0xe8]
push eax
push esi
call fcn.004662e0
mov ecx, dword [esp + 0x140]
add esp, 0x24
pop esi
xor ecx, esp
call fcn.004f929f
add esp, 0x11c
ret