joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523700
Capabilities:
Resolve dns

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x470
xor eax, eax
mov r10d, 0x10
mov rbx, rcx
lea rdi, [rsp + 0x70]
mov ecx, 0x7e
test edx, edx
rep stosq qword [rdi], rax
mov eax, 0xa
lea r14, [rsp + 0x60]
mov rsi, r8
cmovne edx, eax
cmp word [rbx], 2
mov eax, 0x1c
mov rbp, r9
cmovne r10d, eax
mov r8, r14
mov rcx, rbx
mov qword [rsp + 0x60], 0
lea r13, [rsp + 0x40]
mov r9d, 0x401
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov byte [rdi], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x30], edx
mov edx, r10d
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], r13
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov r12d, eax
test eax, eax
jne 0x523908
cmp byte [rsp + 0x40], 0
jne 0x5237f8
movzx eax, word [rbx]
cmp ax, 2
je 0x523970
xor ecx, ecx
cmp ax, 0x17
je 0x523970
call qword [sym.imp.WS2_32.dll_ntohs]
lea r8, [0x008ed9b4]
mov edx, 0x20
mov rcx, r13
movzx r9d, ax
call fcn.00526960
test rsi, rsi
je 0x523848
mov r8d, 0xe9
lea rdx, str.crypto_bio_b_addr.c
mov rcx, r14
call fcn.0058cf70
mov qword [rsi], rax
test rbp, rbp
jne 0x5238b0
cmp qword [rsi], 0
je 0x523950
mov r12d, 1
mov eax, r12d
add rsp, 0x470
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rbp, rbp
je 0x523828
mov rcx, r13
mov r8d, 0xeb
lea rdx, str.crypto_bio_b_addr.c
call fcn.0058cf70
mov qword [rbp], rax
mov rcx, rax
test rax, rax
jne 0x523828
mov r8d, 0xfe
lea rdx, str.crypto_bio_b_addr.c
call fcn.00580410
mov qword [rbp], 0
mov r8d, 0x41
mov edx, 0x86
mov ecx, 0x20
mov dword [rsp + 0x20], 0x101
lea r9, str.crypto_bio_b_addr.c
call fcn.0055dd20
jmp 0x52382e
mov r8d, 0xeb
lea rdx, str.crypto_bio_b_addr.c
mov rcx, r13
call fcn.0058cf70
mov qword [rbp], rax
cmp qword [rsi], 0
je 0x523980
cmp qword [rbp], 0
jne 0x523828
mov rcx, qword [rsi]
mov r8d, 0xfa
lea rdx, str.crypto_bio_b_addr.c
call fcn.00580410
mov qword [rsi], 0
mov rcx, qword [rbp]
jmp 0x52386e
mov r8d, 2
mov edx, 0x86
mov ecx, 0x20
mov dword [rsp + 0x20], 0xd7
lea r9, str.crypto_bio_b_addr.c
call fcn.0055dd20
mov ecx, r12d
xor r12d, r12d
call fcn.006f4c70
mov ecx, 1
mov rdx, rax
call fcn.0055fb20
jmp 0x52382e
mov r8d, 0xfa
lea rdx, str.crypto_bio_b_addr.c
xor ecx, ecx
call fcn.00580410
mov qword [rsi], 0
jmp 0x523888
movzx ecx, word [rbx + 2]
jmp 0x5237da
xor ecx, ecx
mov r8d, 0xfa
lea rdx, str.crypto_bio_b_addr.c
call fcn.00580410
mov qword [rsi], 0
mov rcx, qword [rbp]
jmp 0x52386e
Function at 0x524130
Capabilities:
Resolve dns

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov rdi, rdx
mov ebp, r8d
mov ebx, r9d
cmp r9d, 0x17
ja 0x524162
mov eax, 1
mov ecx, r9d
shl rax, cl
test eax, 0x800005
jne 0x5241a0
mov dword [rsp + 0x20], 0x293
lea r9, str.crypto_bio_b_addr.c
mov r8d, 0x83
xor r12d, r12d
mov edx, 0x8f
mov ecx, 0x20
call fcn.0055dd20
mov eax, r12d
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.00526e50
mov r12d, eax
cmp eax, 1
je 0x5241b8
xor r12d, r12d
jmp 0x524189
movd xmm1, dword [rsp + 0xd0]
movd xmm0, ebx
mov qword [rsp + 0x40], 0
mov eax, 1
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
punpckldq xmm0, xmm1
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
movq qword [rsp + 0x44], xmm0
test ebx, ebx
jne 0x52421b
mov dword [rsp + 0x40], 0x400
mov eax, 0x401
cmp ebp, 1
jne 0x524224
mov dword [rsp + 0x40], eax
mov rbx, qword [sym.imp.WS2_32.dll_getaddrinfo]
xor r14d, r14d
lea r13, [rsp + 0x40]
mov r9, qword [rsp + 0xd8]
mov r8, r13
mov rdx, rdi
mov rcx, rsi
call rbx
test eax, eax
je 0x524189
cmp eax, 8
jne 0x524280
mov dword [rsp + 0x20], 0x2c7
lea r9, str.crypto_bio_b_addr.c
mov r8d, 0x41
xor r12d, r12d
mov edx, 0x8f
mov ecx, 0x20
call fcn.0055dd20
jmp 0x524189
mov edx, dword [rsp + 0x40]
test dh, 4
je 0x524298
and dh, 0xfb
mov r14d, eax
or edx, 4
mov dword [rsp + 0x40], edx
jmp 0x524233
lea r9, str.crypto_bio_b_addr.c
mov r8d, 2
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2d6
mov ecx, 0x20
mov dword [rsp + 0x3c], eax
call fcn.0055dd20
mov eax, dword [rsp + 0x3c]
test r14d, r14d
cmove r14d, eax
xor r12d, r12d
mov ecx, r14d
call fcn.006f4c70
mov ecx, 1
mov rdx, rax
call fcn.0055fb20
jmp 0x524189

Function at 0x526e50
Capabilities:
Initialize winsock library

Disassembly:
push rdi
sub rsp, 0x30
mov eax, dword [0x009f4358]
test eax, eax
je 0x526e70
mov eax, 1
add rsp, 0x30
pop rdi
ret
lea rdx, [0x009f41c0]
xor eax, eax
mov ecx, 0x33
mov dword [0x009f4358], 1
mov rdi, rdx
rep stosq qword [rdi], rax
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x526e5f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 9
mov ecx, 2
mov dword [rsp + 0x20], 0x87
mov r8d, eax
lea r9, [0x008edf20]
call fcn.0055dd20
mov r8d, 0x7a
mov edx, 0x70
mov dword [rsp + 0x20], 0x88
lea r9, [0x008edf20]
mov ecx, 0x20
call fcn.0055dd20
mov eax, 0xffffffff
jmp 0x526e64

Function at 0x5273d0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x3c], edx
movsxd rcx, ecx
lea r8, [rsp + 0x3c]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
js 0x527400
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 5
mov ecx, 2
mov dword [rsp + 0x20], 0xc3
mov r8d, eax
lea r9, [0x008edf20]
call fcn.0055dd20
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x40
pop rbx
ret
Function at 0x52bae0
Capabilities:
Check if file exists

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov r12, rdx
mov rsi, rcx
call fcn.0058cd40
mov edx, 0x62
mov rcx, r12
mov r13, rax
call sub.msvcrt.dll_strchr
cmp rax, 1
sbb ebx, ebx
and ebx, 0x10
add ebx, 1
test r13, r13
je 0x52bb60
lea rcx, [0x008eeda0]
call fcn.00528ae0
mov r12, rax
test rax, rax
je 0x52bbf8
xor edx, edx
mov rcx, rax
call fcn.00528f00
mov r9, r13
mov r8d, ebx
mov edx, 0x6a
mov rcx, r12
call fcn.0052a2d0
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 1
mov ecx, 2
mov dword [rsp + 0x20], 0x45
mov r8d, eax
lea r9, str.crypto_bio_bss_file.c
call fcn.0055dd20
lea rax, [0x008eecd2]
mov qword [rsp + 0x20], r12
mov r8, rsi
mov qword [rsp + 0x28], rax
lea r9, [0x008eecc6]
mov ecx, 5
lea rdx, str.fopen_
call fcn.0055fb20
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 2
je 0x52bbc8
call rbx
cmp dword [rax], 6
jne 0x52bc08
mov dword [rsp + 0x20], 0x4c
lea r9, str.crypto_bio_bss_file.c
mov r8d, pe_nt_image_headers64
xor r12d, r12d
mov edx, 0x6d
mov ecx, 0x20
call fcn.0055dd20
jmp 0x52bb4b
mov rcx, r13
call fcn.007453d8
jmp 0x52bb4b
mov dword [rsp + 0x20], 0x4e
lea r9, str.crypto_bio_bss_file.c
mov r8d, 2
xor r12d, r12d
mov edx, 0x6d
mov ecx, 0x20
call fcn.0055dd20
jmp 0x52bb4b

Function at 0x52e460
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rax, rdx
cmp rdx, r8
je 0x52e57a
mov r11, rcx
sub rcx, 1
not r11
and rcx, r11
shr rcx, 0x3f
lea r11, [rcx - 1]
mov ecx, dword [rdx + 8]
mov edx, dword [r8 + 8]
xor edx, ecx
movsxd rdx, edx
and rdx, r11
xor ecx, edx
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0x10]
xor dword [r8 + 8], edx
mov edx, dword [r8 + 0x10]
xor edx, ecx
movsxd rdx, edx
and rdx, r11
xor ecx, edx
mov dword [rax + 0x10], ecx
mov ecx, dword [rax + 0x14]
xor dword [r8 + 0x10], edx
mov edx, dword [r8 + 0x14]
xor edx, ecx
and rdx, r11
and edx, 4
xor ecx, edx
mov dword [rax + 0x14], ecx
xor dword [r8 + 0x14], edx
test r9d, r9d
jle 0x52e57a
mov r10, qword [rax]
mov rbx, qword [r8]
lea rax, [r10 + 0xf]
sub rax, rbx
cmp rax, 0x1e
jbe 0x52e580
lea eax, [r9 - 1]
cmp eax, 1
jbe 0x52e580
mov eax, r9d
movq xmm2, r11
mov rcx, r10
mov rdx, rbx
shr eax, 1
punpcklqdq xmm2, xmm2
shl rax, 4
add rax, r10
nop word [rax + rax]
movdqu xmm3, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
add rcx, 0x10
add rdx, 0x10
pxor xmm0, xmm3
movdqa xmm1, xmm3
pand xmm0, xmm2
pxor xmm1, xmm0
movups xmmword [rcx - 0x10], xmm1
movdqu xmm4, xmmword [rdx - 0x10]
pxor xmm0, xmm4
movups xmmword [rdx - 0x10], xmm0
cmp rax, rcx
jne 0x52e518
mov eax, r9d
and eax, 0xfffffffe
and r9d, 1
je 0x52e57a
shl rax, 3
lea r8, [r10 + rax]
add rax, rbx
mov rcx, qword [r8]
mov rdx, qword [rax]
xor rdx, rcx
and rdx, r11
xor rcx, rdx
mov qword [r8], rcx
xor qword [rax], rdx
pop rbx
ret
mov r9d, r9d
xor ecx, ecx
nop dword [rax]
mov rdx, qword [r10 + rcx*8]
mov rax, qword [rbx + rcx*8]
xor rax, rdx
and rax, r11
xor rdx, rax
mov qword [r10 + rcx*8], rdx
xor qword [rbx + rcx*8], rax
add rcx, 1
cmp r9, rcx
jne 0x52e588
pop rbx
ret
Function at 0x56c0a0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rcx + 0x70]
test rdx, rdx
je 0x56c1f8
movzx ecx, byte [rdx + 2]
movzx r9d, byte [rdx + 1]
shl ecx, 0x10
shl r9d, 8
or ecx, r9d
movzx r9d, byte [rdx]
or ecx, r9d
movzx r9d, byte [rdx + 3]
shl r9d, 0x18
or ecx, r9d
mov dword [rax], ecx
movzx ecx, byte [rdx + 5]
movzx r9d, byte [rdx + 6]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 4]
or ecx, r9d
movzx r9d, byte [rdx + 7]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 4], ecx
movzx ecx, byte [rdx + 9]
movzx r9d, byte [rdx + 0xa]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 8]
or ecx, r9d
movzx r9d, byte [rdx + 0xb]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 8], ecx
movzx ecx, byte [rdx + 0xd]
movzx r9d, byte [rdx + 0xe]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0xc]
or ecx, r9d
movzx r9d, byte [rdx + 0xf]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0xc], ecx
movzx ecx, byte [rdx + 0x11]
movzx r9d, byte [rdx + 0x12]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x10]
or ecx, r9d
movzx r9d, byte [rdx + 0x13]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x10], ecx
movzx ecx, byte [rdx + 0x15]
movzx r9d, byte [rdx + 0x16]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x14]
or ecx, r9d
movzx r9d, byte [rdx + 0x17]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x14], ecx
movzx ecx, byte [rdx + 0x19]
movzx r9d, byte [rdx + 0x1a]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x18]
or ecx, r9d
movzx r9d, byte [rdx + 0x1b]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x18], ecx
movzx ecx, byte [rdx + 0x1d]
movzx r9d, byte [rdx + 0x1e]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x1c]
movzx edx, byte [rdx + 0x1f]
or ecx, r9d
shl edx, 0x18
or edx, ecx
mov dword [rax + 0x1c], edx
test r8, r8
je 0x56c298
movzx edx, byte [r8 + 2]
movzx ecx, byte [r8 + 1]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8]
or edx, ecx
movzx ecx, byte [r8 + 3]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x20], edx
movzx edx, byte [r8 + 6]
movzx ecx, byte [r8 + 5]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 4]
or edx, ecx
movzx ecx, byte [r8 + 7]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x24], edx
movzx edx, byte [r8 + 0xa]
movzx ecx, byte [r8 + 9]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 8]
or edx, ecx
movzx ecx, byte [r8 + 0xb]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x28], edx
movzx edx, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xe]
shl edx, 8
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [r8 + 0xc]
or edx, ecx
movzx ecx, byte [r8 + 0xf]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x2c], edx
mov dword [rax + 0x70], 0
mov eax, 1
ret
Function at 0x57a7d0
Capabilities:
Query environment variable

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
call fcn.005d7a60
test eax, eax
jne 0x57a7f0
mov rcx, r12
add rsp, 0x20
pop r12
jmp sub.msvcrt.dll_getenv
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x57ffb0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x580010
movsx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x580000
mov edi, 0x100
xor ebx, ebx
nop
call fcn.0053b800
add rsi, 1
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
movsx ecx, byte [rsi]
xor ebx, eax
test cl, cl
jne 0x57ffd0
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x581140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x581260
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x5811a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x5811a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x5811a0
Function at 0x584920
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xc8]
mov rbx, rcx
mov rdi, rdx
mov r12, r9
test r8, r8
je 0x5849a3
lea r13, [rcx + r8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
test ecx, ecx
jne 0x5849b0
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
movzx edx, byte [rsi]
xor edx, eax
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov byte [rdi - 1], dl
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x584960
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
xor al, byte [rsi]
mov byte [rdi - 1], al
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x5849b0
jmp 0x5849a3
Function at 0x589780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x28]
mov rax, qword [rcx + 0x58]
mov rbx, rcx
mov rsi, rdx
cmp rdi, rdx
jae 0x58996f
mov rcx, qword [rcx + 0x30]
cmp rcx, rdx
jbe 0x589936
lea r11, [rdi + 1]
mov r10, r11
shl r10, 4
jmp 0x5897c8
mov rax, qword [rbx + 0x58]
add r11, 1
lea rdx, [rax + r10]
lea rax, [rax + r10 - 0x10]
movzx r9d, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
movzx ecx, byte [rax]
lea ebp, [r8 + r8]
lea edi, [r9 + r9]
sar r9d, 7
sar r8d, 7
or r9d, ebp
sar cl, 7
mov byte [rdx + 0xe], r9b
movzx r9d, byte [rax + 0xd]
and ecx, 0xffffff87
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xd], r8b
movzx r8d, byte [rax + 0xc]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xc], r9b
movzx r9d, byte [rax + 0xb]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xb], r8b
movzx r8d, byte [rax + 0xa]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xa], r9b
movzx r9d, byte [rax + 9]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 9], r8b
movzx r8d, byte [rax + 8]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 8], r9b
movzx r9d, byte [rax + 7]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 7], r8b
movzx r8d, byte [rax + 6]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 6], r9b
movzx r9d, byte [rax + 5]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 5], r8b
movzx r8d, byte [rax + 4]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 4], r9b
movzx r9d, byte [rax + 3]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 3], r8b
movzx r8d, byte [rax + 2]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 2], r9b
movzx r9d, byte [rax + 1]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 1], r8b
movzx r8d, byte [rax]
lea eax, [r8 + r8]
or eax, r9d
xor ecx, edi
add r10, 0x10
mov byte [rdx], al
mov byte [rdx + 0xf], cl
cmp r11, rsi
jne 0x5897c0
mov qword [rbx + 0x28], r11
mov rax, r11
shl rax, 4
add rax, qword [rbx + 0x58]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rdx + 4]
mov r9d, 0x71
lea r8, str.crypto_modes_ocb128.c
sub rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, rax
mov qword [rbx + 0x30], rdx
shl rdx, 4
call fcn.00580490
test rax, rax
je 0x58992d
mov qword [rbx + 0x58], rax
jmp 0x5897ac
shl rsi, 4
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x59d140
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x59d175
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x59d150
and r10, 0xf
je 0x59d1a6
mov r9, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x59d181
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x59d19a
mov rax, r8
repz ret

Function at 0x59d1b0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x59d1ed
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x59d1c0
pxor xmm1, xmm1
and r10, 0xf
je 0x59d224
mov r9, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x59d1fc
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x59d218
mov rax, r8
repz ret

Function at 0x5a2c90
Capabilities:
Generate random numbers via winapi

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov edx, 1
mov r12, rcx
call fcn.005a19d0
mov rcx, r12
mov rdx, rax
mov r13, rax
call fcn.005a1fb0
mov rbx, rax
test rax, rax
je 0x5a2d10
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x5a2d90
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call fcn.005a21d0
mov rcx, r12
call fcn.005a1980
test rax, rax
je 0x5a2d10
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov edx, 1
mov rcx, r12
call fcn.005a19d0
mov rcx, r12
mov rdx, rax
mov r13, rax
call fcn.005a1fb0
mov rbx, rax
test rax, rax
je 0x5a2d7b
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x48]
mov r9d, 0x16
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x5a2de0
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call fcn.005a21d0
mov rcx, r12
call fcn.005a1980
test rax, rax
jne 0x5a2d00
mov rcx, r12
call fcn.005a1980
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x5a2dd0
xor r8d, r8d
xor r13d, r13d
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x5a2ce8
lea r8, [r13*8]
jmp 0x5a2dab
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x5a2e20
lea r8, [r13*8]
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x5a2d63
xor r8d, r8d
xor r13d, r13d
jmp 0x5a2dfd
Function at 0x5b0290
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
mov r10, rcx
cmp eax, r9d
jne 0x5b0368
movzx ecx, byte [r8]
lea edx, [rcx - 0x6a]
cmp dl, 1
ja 0x5b0368
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp cl, 0x6b
je 0x5b02e8
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x5b0397
mov r8d, r12d
mov rcx, r10
call sub.msvcrt.dll_memcpy
mov eax, r12d
add rsp, 0x30
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x5b0318
xor eax, eax
jmp 0x5b0305
cmp cl, 0xbb
jne 0x5b0328
add eax, 1
cmp r12d, eax
je 0x5b0360
movzx ecx, byte [rdx]
add rdx, 1
cmp cl, 0xba
jne 0x5b02f8
sub r12d, eax
test eax, eax
jne 0x5b02c3
mov dword [rsp + 0x20], 0x50
jmp 0x5b0330
mov dword [rsp + 0x20], 0x48
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov r12d, 0xffffffff
lea r9, str.crypto_rsa_rsa_x931.c
call fcn.0055dd20
mov eax, r12d
add rsp, 0x30
pop r12
ret
xor r12d, r12d
jmp 0x5b02c3
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x3d
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call fcn.0055dd20
jmp 0x5b02db
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x59
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call fcn.0055dd20
jmp 0x5b02db
Function at 0x5cd1d0
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
sub rsp, 0x90
lea rax, [0x009f7000]
movdqa xmm0, xmmword [0x0091a610]
test r8, r8
mov r12, r8
lea r8, [rsp + 0x40]
mov r9, rcx
cmove r12, rax
mov ecx, 9
xor eax, eax
mov rdi, r8
rep stosq qword [rdi], rax
movaps xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x0091a620]
lea r13, [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
mov dword [rdi], 0
mov dword [rsp + 0x8c], 0x20
test rdx, rdx
je 0x5cd245
mov r8, rdx
mov rcx, r13
mov rdx, r9
call fcn.005cc7c0
mov rdx, r13
mov rcx, r12
call fcn.005ccec0
mov edx, 0x70
mov rcx, r13
call fcn.005fddf0
mov rax, r12
add rsp, 0x90
pop rdi
pop r12
pop r13
ret
Function at 0x5d6e40
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
ret

Function at 0x5d6e60
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [r12]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x5d6ea0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret

Function at 0x5fde50
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x5fde9d
cmp r8, 0x10
jne 0x5fde80
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x5fde80
neg rax
shr rax, 0x3f
repz ret