joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401720
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x409040]
xor eax, esp
mov dword [esp + 0x430], eax
push ebx
push esi
push edi
push ecx
push 8
mov edi, edx
mov dword [esp + 0x18], 0x428
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40177e
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.Failed_to_create_snapshot_for_modules._n
call fcn.00403ce0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.004049d0
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x401804
nop
lea ecx, [esp + 0x30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401797
sub ecx, edx
mov esi, edi
sar ecx, 1
cmp dword [edi + 0x14], 7
jbe 0x4017b0
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ecx
jne 0x4017f4
lea eax, [esp + 0x30]
test edx, edx
je 0x4017d4
mov ecx, eax
sub esi, ecx
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x4017f4
add eax, 2
sub edx, 1
jne 0x4017c3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.004049d0
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x401790
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, str.Module
call fcn.00403ce0
cmp dword [edi + 0x14], 7
mov edx, edi
jbe 0x40181e
mov edx, dword [edi]
push dword [edi + 0x10]
mov ecx, eax
call fcn.004042b0
add esp, 4
mov edx, str._not_found_in_process._n
mov ecx, eax
call fcn.00403ce0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x43c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004049d0
mov esp, ebp
pop ebp
ret
Function at 0x405409
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405448
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405448
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405448
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405448
cmp dword [ecx + 0x74], 0xe
jbe 0x405448
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40c250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x562bc1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
mov eax, dword [0x5df890]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 4], bl
lea ecx, [esp + 8]
push ecx
push ebx
push 3
mov dword [esp + 0x44], ebx
push eax
mov dword [esp + 0x1c], 1
call fcn.00458e80
mov edx, dword [esp + 0x18]
add esp, 0x10
push eax
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.004016f0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
mov dword [esp + 0x44], 1
call fcn.00401d50
cmp dword [esp + 0x2c], 0x10
jb 0x40c2f6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0041d541
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x34
ret

Function at 0x40c530
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, 0x10
cmp dword [esp + 0x28], edi
jae 0x40c546
lea eax, [esp + 0x14]
push 0x5cfcfc
push eax
call fcn.0043ae67
mov esi, eax
xor ebx, ebx
add esp, 8
cmp esi, ebx
jne 0x40c5bd
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x40c56a
lea eax, [esp + 0x14]
push eax
push str.fopen_fail:_s_n
call fcn.0043abee
add eax, 0x40
push eax
call fcn.0043b13b
add esp, 0xc
cmp dword [esp + 0x28], edi
jb 0x40c594
mov eax, dword [esp + 0x14]
push eax
call fcn.0041d541
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], edi
jb 0x40c5b7
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041d541
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], edi
jae 0x40c5cb
lea eax, [esp + 0x30]
mov edx, dword [esp + 0x40]
push esi
push edx
push 1
push eax
call fcn.0043b3b9
push esi
call fcn.0043b4b2
add esp, 0x14
cmp dword [esp + 0x28], edi
jb 0x40c5f5
mov eax, dword [esp + 0x14]
push eax
call fcn.0041d541
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
cmp dword [esp + 0x44], edi
jb 0x40c618
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041d541
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x40c620
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x56315b
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5df890]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
push esi
mov eax, dword [0x5df890]
xor eax, esp
push eax
lea eax, [esp + 0x434]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x444]
xor ebx, ebx
cmp dword [ebp + 0x18], 0x10
lea eax, [ebp + 4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], eax
jb 0x40c676
mov eax, dword [eax]
push 0x5cfd10
push eax
call fcn.0043ae67
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40c6cc
cmp dword [ebp + 0x18], 0x10
mov eax, dword [esp + 0x10]
jb 0x40c696
mov eax, dword [eax]
push eax
push str.fopen_fail:_s_n
call fcn.0043abee
add eax, 0x40
push eax
call fcn.0043b13b
add esp, 0xc
push ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
push 0x5cf898
mov ecx, edi
mov byte [edi + 4], bl
call fcn.004016f0
jmp 0x40c75d
mov ebp, 0xf
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
push esi
push 0x400
lea ecx, [esp + 0x38]
push 1
push ecx
mov dword [esp + 0x44c], ebx
call fcn.0043b11e
add esp, 0x10
cmp eax, ebx
je 0x40c728
lea ecx, [ecx]
push eax
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x1c]
call fcn.00404610
push esi
push 0x400
lea eax, [esp + 0x38]
push 1
push eax
call fcn.0043b11e
add esp, 0x10
cmp eax, ebx
jne 0x40c700
push esi
call fcn.0043b4b2
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1c]
push ecx
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
mov ecx, edi
mov byte [edi + 4], bl
call fcn.00401d50
cmp dword [esp + 0x2c], 0x10
jb 0x40c75d
mov edx, dword [esp + 0x18]
push edx
call fcn.0041d541
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0043a097
add esp, 0x430
ret

Function at 0x40d370
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x56385b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x5df890]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
push esi
call fcn.0040d610
lea eax, [esi + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x38], ebx
call fcn.0040d610
mov byte [esp + 0x34], 1
push 0xc
push str._firefox.exe
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.004016f0
lea ecx, [esp + 0x10]
push ecx
mov ebx, esi
mov byte [esp + 0x38], 2
call fcn.00406140
cmp dword [esp + 0x28], 0x10
jb 0x40d3f8
mov edx, dword [esp + 0x14]
push edx
call fcn.0041d541
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret 4
Function at 0x455620
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x4556ab
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x4556aa
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x455683
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x455950
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
push esi
lea esi, [ecx - 1]
je 0x45596b
pop esi
mov dword [esp + 4], eax
jmp fcn.00455280
test ecx, ecx
jne 0x455973
xor eax, eax
pop esi
ret
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.004551f0
shl esi, 5
add esp, 4
add eax, esi
pop esi
ret
Function at 0x461be0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x461c15
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
dec ecx
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x461c00
pop ebx
pop edi
pop esi
ret
Function at 0x463b30
Capabilities:
Hash data using sha256

Disassembly:
mov eax, 0x70
call fcn.004400a0
push esi
mov esi, dword [esp + 0x80]
test esi, esi
jne 0x463b4b
mov esi, 0x5e7244
push 0x70
lea eax, [esp + 8]
push 0
push eax
call fcn.0043bff0
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x84]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x6a09e667
mov dword [esp + 0x20], 0xbb67ae85
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0xa54ff53a
mov dword [esp + 0x2c], 0x510e527f
mov dword [esp + 0x30], 0x9b05688c
mov dword [esp + 0x34], 0x1f83d9ab
mov dword [esp + 0x38], 0x5be0cd19
mov dword [esp + 0x88], 0x20
call fcn.00463750
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.00463850
lea edx, [esp + 0x24]
push 0x70
push edx
call fcn.00470f60
add esp, 0x28
mov eax, esi
pop esi
add esp, 0x70
ret
Function at 0x476620
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x476648
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
sub edi, 1
jne 0x476637
pop esi
pop ebx
movzx eax, cl
pop edi
ret

Function at 0x4823d0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x4a1340
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
test edx, edx
je 0x4a135c
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x4a1361
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test ebp, ebp
jle 0x4a1425
push ebx
lea ebx, [ebx]
cmp ebp, 3
movzx edx, byte [edi]
jl 0x4a13c2
movzx ebx, byte [edi + 1]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + 2]
shl edx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
inc ecx
mov ebx, edx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
inc ecx
mov byte [ecx], bl
inc ecx
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [ecx], dl
jmp 0x4a140b
shl edx, 0x10
cmp ebp, 2
jne 0x4a13d3
movzx ebx, byte [edi + 1]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
inc ecx
mov byte [ecx], bl
inc ecx
cmp ebp, 1
jne 0x4a13fb
lea edx, [ebp + 0x3c]
jmp 0x4a1405
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub ebp, 3
inc ecx
add eax, 4
add edi, 3
test ebp, ebp
jg 0x4a1370
pop ebx
pop edi
pop esi
mov byte [ecx], 0
pop ebp
ret
pop edi
pop esi
mov byte [ecx], al
pop ebp
ret
Function at 0x4a95a9
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x4a961f
test eax, eax
je 0x4a95eb
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00492020
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x4a95eb
push 0x3b
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.00470660
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x4a961b
cmp edi, 0x40a
je 0x4a9612
cmp edi, 0x43f
je 0x4a9612
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4a9617
mov eax, 0x20
cmp esi, eax
je 0x4a961f
push 0x41
jmp 0x4a95d0
push ebx
push 0x46
push str.cryptoececx_meth.c
push 0x40
call fcn.00469c40
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4a9655
push 0x48
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00470660
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x4a966d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.0043ea50
add esp, 0xc
jmp case.0x4a979e.1036
cmp edi, 0x40a
je 0x4a968d
cmp edi, 0x43f
je 0x4a968d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4a9692
mov eax, 0x20
push 0x50
push str.cryptoececx_meth.c
push eax
call fcn.00471660
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x4a96c5
push 0x52
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.00470660
add esp, 0x14
jmp 0x4a9718
cmp ebp, 2
jne 0x4a9758
cmp edi, 0x40a
je 0x4a96ee
cmp edi, 0x43f
je 0x4a96ee
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4a96f3
mov eax, 0x20
push eax
push esi
call fcn.00476200
add esp, 8
test eax, eax
jg 0x4a972e
push 0x57
push str.cryptoececx_meth.c
push esi
call fcn.00471680
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.cryptoececx_meth.c
push ebx
call fcn.00469cb0
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x4a9747
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x4a978c
cmp edi, 0x40b
jne 0x4a978c
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x4a978c
cmp edi, 0x40a
je 0x4a9778
cmp edi, 0x43f
je 0x4a9778
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4a977d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.0043ea50
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x4a979e.1036
movzx ecx, byte [eax + 0x4a97f8]
jmp dword [ecx*4 + 0x4a97e4]
push esi
push ebx
call fcn.004e1740
jmp 0x4a97c7
push esi
push ebx
call fcn.004e1670
jmp 0x4a97c7
push esi
push ebx
call fcn.004d4460
jmp 0x4a97c7
push esi
push ebx
call fcn.004d2750
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.0045bd40
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x4b7200
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.004400a0
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.00455e80
add esp, 8
test eax, eax
jne 0x4b723b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x4b729d
xor ebx, ebx
test ebp, ebp
jle 0x4b7400
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x4b727f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x4b7258
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x4b7250
jmp 0x4b7400
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x4b7400
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x4b73dc
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x4b7370
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x4b7340
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x4d2940
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
sub ebp, 1
jne 0x4d2952
pop esi
pop ebp
pop ebx
ret
Function at 0x4e1670
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.004400a0
mov eax, dword [0x5df890]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xec]
push esi
mov esi, dword [esp + 0xec]
push edi
lea ecx, [esp + 0xa8]
push ecx
push 0x20
push eax
call fcn.00483340
mov dl, byte [esp + 0xd3]
and byte [esp + 0xb4], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esp + 0xd3], dl
lea ecx, [esp + 0xb4]
lea edx, [esp + 0x14]
call fcn.004d8f10
lea edi, [esp + 0x14]
call fcn.004d8370
lea eax, [esp + 0xb4]
push 0x40
push eax
call fcn.00470f60
mov ecx, dword [esp + 0xfc]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.0043a097
add esp, 0xe4
ret
Function at 0x4e1740
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.004400a0
mov eax, dword [0x5df890]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x154]
push edi
mov ecx, 8
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x148]
and byte [esp + 0x12c], 0xf8
shr ecx, 0x18
and cl, 0x3f
or cl, 0x40
mov byte [esp + 0x14b], cl
lea ecx, [esp + 0x12c]
lea edx, [esp + 0x64]
mov dword [esp + 0x10], eax
call fcn.004d8f10
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb8]
mov esi, dword [esp + 0x94]
mov edi, dword [esp + 0x98]
mov ebx, dword [esp + 0x9c]
add edx, eax
sub eax, dword [esp + 0x8c]
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x90]
add edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xbc]
add esi, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0xc0]
add edi, esi
sub ecx, dword [esp + 0x90]
sub edx, dword [esp + 0x94]
sub esi, dword [esp + 0x98]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0xc4]
add ebx, edi
sub edi, dword [esp + 0x9c]
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0xc8]
add ebx, ebp
mov ebp, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc8]
sub eax, dword [esp + 0xa0]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0xcc]
add ebx, ebp
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xcc]
sub eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0xd0]
add ebx, ebp
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xd0]
sub eax, dword [esp + 0xa8]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0xd4]
add ebx, ebp
mov ebp, dword [esp + 0xb0]
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xd4]
add ebp, ebx
sub eax, dword [esp + 0xac]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x5c], eax
sub ebx, dword [esp + 0xb0]
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x64], ebx
call fcn.004d6f50
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edx
call fcn.004d4cd0
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
call fcn.004d4970
lea ecx, [esp + 0x13c]
push 0x20
push ecx
call fcn.00470f60
mov ecx, dword [esp + 0x164]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043a097
add esp, 0x140
ret