joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a5a30
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d61c0
mov dword [ebp - 4], 0
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.005a5f60
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005a6380
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5a5ab6
mov dword [ebp - 0x10], 0
push 2
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x5a5a90
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 3
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005a6430
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.005a5f00
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x5a5ac1
mov eax, dword [ebp - 4]
jmp 0x5a5acd
mov ecx, dword [ebp + 8]
push ecx
call fcn.005a5f00
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x5bd150
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push 0x70
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004d4a00
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xc1059ed8
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0x367cd507
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3070dd17
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xf70e5939
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xffc00b31
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x68581511
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0x64f98fa7
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0xbefa4fa4
mov eax, dword [ebp + 8]
mov dword [eax + 0x6c], 0x1c
mov eax, 1
pop ebp
ret

Function at 0x5bd1d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0x70
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004d4a00
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x6a09e667
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3c6ef372
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xa54ff53a
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x9b05688c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0x1f83d9ab
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0x5be0cd19
mov eax, dword [ebp + 8]
mov dword [eax + 0x6c], 0x20
mov eax, 1
pop ebp
ret

Function at 0x5bd990
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x3070dd17
mov dword [edx + 0x14], 0x9159015a
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 0x68581511
mov dword [edx + 0x2c], 0x8eb44a87
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xd0], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0xd4], 0x30
mov eax, 1
pop ebp
ret
Function at 0x5bda60
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x84caa73b
mov dword [ecx + 0xc], 0xbb67ae85
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xfe94f82b
mov dword [edx + 0x14], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0xade682d1
mov dword [ecx + 0x24], 0x510e527f
mov edx, dword [ebp + 8]
mov dword [edx + 0x28], 0x2b3e6c1f
mov dword [edx + 0x2c], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x38], 0x137e2179
mov dword [ecx + 0x3c], 0x5be0cd19
mov edx, dword [ebp + 8]
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xd0], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x5cc900
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x5cc9db
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x5cc976
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.005cc540
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5cc944
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x5cca94
call fcn.005cc988
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x5cca33
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.005cc540
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5cc9ec
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x5cca94
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.005cc540
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5cca8f
jmp 0x5cca94
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5ccb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x5ccbe4
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x5ccb7f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005cc6a0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5ccb4d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x5ccc9d
call fcn.005ccb91
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x5ccc3c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005cc7d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x5ccbf5
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x5ccc9d
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.005cc7d0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5ccc98
jmp 0x5ccc9d
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5d0c40
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004d61c0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0xffffffff
jne 0x5d0c8b
call fcn.005316f0
push str.BIO_connect
push 0x54
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.00531a70
add esp, 0xc
xor eax, eax
jmp 0x5d0e48
mov eax, dword [ebp + 0x10]
and eax, 8
neg eax
sbb eax, eax
neg eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005826f0
add esp, 8
test eax, eax
jne 0x5d0caf
xor eax, eax
jmp 0x5d0e48
mov edx, dword [ebp + 0x10]
and edx, 4
je 0x5d0d32
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x5d0d32
call fcn.005316f0
push str.BIO_connect
push 0x5e
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.00531a70
add esp, 0xc
call fcn.005316f0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push 0
push 0x89
push 0x20
call fcn.00531a70
add esp, 0xc
xor eax, eax
jmp 0x5d0e48
mov edx, dword [ebp + 0x10]
and edx, 0x10
je 0x5d0db2
push 4
lea eax, [ebp - 4]
push eax
push 1
push 6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x5d0db2
call fcn.005316f0
push str.BIO_connect
push 0x68
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.00531a70
add esp, 0xc
call fcn.005316f0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push 0
push 0x8a
push 0x20
call fcn.00531a70
add esp, 0xc
xor eax, eax
jmp 0x5d0e48
mov edx, dword [ebp + 0xc]
push edx
call fcn.0057ad90
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0057ad70
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x5d0e43
push 0xffffffffffffffff
call fcn.0053d3d0
add esp, 4
test eax, eax
jne 0x5d0e3f
call fcn.005316f0
push str.BIO_connect
push 0x72
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 2
call fcn.00531a70
add esp, 0xc
call fcn.005316f0
push str.BIO_connect
push 0x74
push str.crypto_bio_bio_sock2.c
call fcn.00531940
add esp, 0xc
push 0
push 0x67
push 0x20
call fcn.00531a70
add esp, 0xc
xor eax, eax
jmp 0x5d0e48
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x5d3420
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.004d61c0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x5d344e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x5c]
and ecx, 2
je 0x5d344e
mov dword [ebp - 8], str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jmp 0x5d3455
mov dword [ebp - 8], str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], edx
jmp 0x5d3466
mov eax, dword [ebp - 4]
sub eax, 3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x5d35c6
cmp dword [ebp - 4], 3
jl 0x5d3511
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
shl edx, 0x10
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
shl ecx, 8
or edx, ecx
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 2]
or edx, ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x10]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
and ecx, 0x3f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov cl, byte [eax + ecx]
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x10]
shr eax, 6
and eax, 0x3f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov al, byte [edx + eax]
mov byte [ecx], al
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0x10]
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
jmp 0x5d35af
mov ecx, dword [ebp + 0x10]
movzx edx, byte [ecx]
shl edx, 0x10
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 2
jne 0x5d3533
mov eax, dword [ebp + 0x10]
movzx ecx, byte [eax + 1]
shl ecx, 8
or ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shr edx, 0x12
and edx, 0x3f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
mov byte [eax], dl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 0x10]
shr ecx, 0xc
and ecx, 0x3f
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov cl, byte [eax + ecx]
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp - 4], 1
jne 0x5d357c
mov dword [ebp - 0x14], 0x3d
jmp 0x5d358f
mov eax, dword [ebp - 0x10]
shr eax, 6
and eax, 0x3f
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + eax]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 0x14]
mov byte [eax], cl
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x3d
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
add eax, 3
mov dword [ebp + 0x10], eax
jmp 0x5d345d
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x624070
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.004d61c0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
cmp ecx, dword [ebp + 0x14]
jne 0x6240a8
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp eax, 0x6a
je 0x6240da
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
cmp edx, 0x6b
je 0x6240da
call fcn.005316f0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.00531940
add esp, 0xc
push 0
push 0x89
push 4
call fcn.00531a70
add esp, 0xc
or eax, 0xffffffff
jmp 0x624213
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp ecx, 0x6b
jne 0x6241b3
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jmp 0x62410d
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jge 0x624173
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov byte [ebp - 0xd], cl
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
movzx eax, byte [ebp - 0xd]
cmp eax, 0xba
jne 0x624133
jmp 0x624173
movzx ecx, byte [ebp - 0xd]
cmp ecx, 0xbb
je 0x624171
call fcn.005316f0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.00531940
add esp, 0xc
push 0
push 0x8a
push 4
call fcn.00531a70
add esp, 0xc
or eax, 0xffffffff
jmp 0x624213
jmp 0x624104
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jne 0x6241b1
call fcn.005316f0
push str.RSA_padding_check_X931
push 0x56
push str.crypto_rsa_rsa_x931.c
call fcn.00531940
add esp, 0xc
push 0
push 0x8a
push 4
call fcn.00531a70
add esp, 0xc
or eax, 0xffffffff
jmp 0x624213
jmp 0x6241bc
mov eax, dword [ebp + 0x14]
sub eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x6241fc
call fcn.005316f0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.00531940
add esp, 0xc
push 0
push 0x8b
push 4
call fcn.00531a70
add esp, 0xc
or eax, 0xffffffff
jmp 0x624213
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004d3550
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x6494c0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xec
call fcn.004d61c0
mov eax, dword [0x7d3574]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
push str.SHA512
mov ecx, dword [ebp + 8]
push ecx
call fcn.00529400
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x649503
xor eax, eax
jmp 0x6495a4
push 0
mov edx, dword [ebp - 4]
push edx
push 0
lea eax, [ebp - 0x48]
push eax
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00528c40
add esp, 0x18
mov dword [ebp - 0xec], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00529c10
add esp, 4
cmp dword [ebp - 0xec], 0
jne 0x64954a
push 0x40
lea eax, [ebp - 0x48]
push eax
call fcn.0054bca0
add esp, 8
xor eax, eax
jmp 0x6495a4
movzx ecx, byte [ebp - 0x48]
and ecx, 0xf8
mov byte [ebp - 0x48], cl
movzx edx, byte [ebp - 0x29]
and edx, 0x3f
mov byte [ebp - 0x29], dl
movzx eax, byte [ebp - 0x29]
or eax, 0x40
mov byte [ebp - 0x29], al
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0xe8]
push edx
call fcn.0063e310
add esp, 8
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0063ad90
add esp, 8
push 0x40
lea edx, [ebp - 0x48]
push edx
call fcn.0054bca0
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d482d
mov esp, ebp
pop ebp
ret
Function at 0x649fc0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x140
call fcn.004d61c0
mov eax, dword [0x7d3574]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.004d3550
add esp, 0xc
movzx edx, byte [ebp - 0x118]
and edx, 0xf8
mov byte [ebp - 0x118], dl
movzx eax, byte [ebp - 0xf9]
and eax, 0x7f
mov byte [ebp - 0xf9], al
movzx ecx, byte [ebp - 0xf9]
or ecx, 0x40
mov byte [ebp - 0xf9], cl
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0xf8]
push eax
call fcn.0063e310
add esp, 8
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x54]
push eax
call fcn.0063e800
add esp, 0xc
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.0063e850
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.0063cda0
add esp, 8
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.0063b220
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0063ae30
add esp, 8
push 0x20
lea edx, [ebp - 0x118]
push edx
call fcn.0054bca0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d482d
mov esp, ebp
pop ebp
ret
Function at 0x6926e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x6926fe
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x692740
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69275e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x6927a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x6927c2
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x692820
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x692842
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x6928a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x6928ca
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret
Function at 0x692930
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x69295a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x6929c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x692a1f

Function at 0x692aa0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x692aff