joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdae0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test rcx, rcx
mov r8, rcx
je 0x4bdb31
movzx ecx, byte [rcx]
test cl, cl
je 0x4bdb31
mov r9d, 0x100
nop word [rax + rax]
movsx edx, cl
add r8, 1
or edx, r9d
add r9d, 0x100
mov ecx, edx
shr ecx, 2
xor ecx, edx
and ecx, 0xf
rol eax, cl
movzx ecx, byte [r8]
imul edx, edx
xor eax, edx
test cl, cl
jne 0x4bdb00
mov edx, eax
shr edx, 0x10
xor eax, edx
ret

Function at 0x4d2e50
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4d2e75
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00494650
call fcn.00508b50
cmp byte [rax], 0
je 0x4d2f40
xor edx, edx
jmp 0x4d2e98
test edx, edx
js 0x4d2f40
add rax, 1
add edx, 1
cmp byte [rax], 0
jne 0x4d2e90
and edx, 0x7fffffff
add edx, 1
lea rcx, [0x006adad3]
mov eax, 1
nop dword [rax]
test eax, eax
js 0x4d2f50
add rcx, 1
add eax, 1
cmp byte [rcx], 0
jne 0x4d2ec0
and eax, 0x7fffffff
mov r8d, 0x231
lea ebx, [rdx + rax + 1]
lea rdx, str.conf_mod.c
mov ecx, ebx
call fcn.00493db0
test rax, rax
mov rsi, rax
je 0x4d2f33
movsxd rbx, ebx
call fcn.00508b50
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.004948f0
lea rdx, [0x006adaeb]
mov r8, rbx
mov rcx, rsi
call fcn.00494980
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rsi
call fcn.00494980
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, 1
jmp 0x4d2ead
mov eax, 0x80000000
jmp 0x4d2ed4
Function at 0x4dba00
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x4dba20
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x4dba20
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x4dbe60
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x004dd800]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.004dbbf0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x4dbe6d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x004dd800]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.004dbbf0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4dbf40
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x4dbf60
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x4dbf60
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x4dc410
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x004de440]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.004dc120
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x4dc41d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x004de440]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.004dc120
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4dc7ed
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4dc7e0
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.004dc550
mov r8, qword [rsp]
cmp eax, 0
jne 0x4dc9ed
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x4dc828
lea rax, [0x004ddc00]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov rbx, rax
mov rdx, rcx
and rbx, rsi
and rdx, rsi
mov r9, rbx
mov r12, rdx
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor rbx, r8
xor rdx, r11
mov r8, rbx
mov r11, rdx
and rbx, rsi
and rdx, rsi
mov r10, rbx
mov r13, rdx
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor rbx, r9
xor rdx, r12
mov r9, rbx
mov r12, rdx
and rbx, rsi
and rdx, rsi
mov r10, rbx
mov r13, rdx
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
xor r12, r13
shr rbx, 0x20
shr rdx, 0x20
xor r10, r8
xor r13, r11
rol eax, 8
rol ecx, 8
xor r10, r9
xor r13, r12
rol ebx, 8
rol edx, 8
xor eax, r10d
xor ecx, r13d
shr r10, 0x20
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
mov r13, r11
shr r10, 0x20
shr r13, 0x20
rol r8d, 0x18
rol r11d, 0x18
rol r10d, 0x18
rol r13d, 0x18
xor eax, r8d
xor ecx, r11d
mov r8, r9
mov r11, r12
xor ebx, r10d
xor edx, r13d
shr r8, 0x20
shr r11, 0x20
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
rol r11d, 0x10
xor eax, r9d
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x4dc86c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4eef60
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jne 0x4ef032
movzx edx, byte [r8]
lea r9d, [rdx - 0x6a]
cmp r9b, 1
ja 0x4ef032
cmp dl, 0x6b
je 0x4eefb0
lea rdx, [r8 + 1]
lea ebx, [rax - 2]
movsxd rax, ebx
cmp byte [rdx + rax], 0xcc
jne 0x4ef060
mov r8d, ebx
call sub.msvcrt.dll_memcpy
mov eax, ebx
add rsp, 0x30
pop rbx
ret
lea ebx, [rax - 3]
test ebx, ebx
jle 0x4ef090
lea rdx, [r8 + 2]
movzx r8d, byte [r8 + 1]
cmp r8b, 0xba
je 0x4ef090
cmp r8b, 0xbb
jne 0x4ef001
lea r9d, [rax - 4]
xor eax, eax
add r9, rdx
jmp 0x4eeff5
add rdx, 1
movzx r8d, byte [rdx - 1]
cmp r8b, 0xba
je 0x4eeffd
cmp r8b, 0xbb
jne 0x4ef001
add eax, 1
cmp rdx, r9
jne 0x4eefe0
sub ebx, eax
jmp 0x4eef90
mov dword [rsp + 0x20], 0x81
lea r9, str.rsa_x931.c
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov ebx, 0xffffffff
call fcn.00498ab0
mov eax, ebx
add rsp, 0x30
pop rbx
ret
lea r9, str.rsa_x931.c
mov dword [rsp + 0x20], 0x72
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov ebx, 0xffffffff
call fcn.00498ab0
jmp 0x4eefa5
lea r9, str.rsa_x931.c
mov dword [rsp + 0x20], 0x93
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov ebx, 0xffffffff
call fcn.00498ab0
jmp 0x4eefa5
mov dword [rsp + 0x20], 0x8a
jmp 0x4ef009
Function at 0x4f82f0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test rcx, rcx
mov rbp, rcx
je 0x4f8564
lea r8, str.eng_list.c
mov r9d, 0x168
mov edx, 0x1e
mov ecx, 9
call fcn.00493400
mov rbx, qword [0x00730168]
test rbx, rbx
jne 0x4f8341
jmp 0x4f8420
mov rbx, qword [rbx + 0xd0]
test rbx, rbx
je 0x4f8420
mov rdx, qword [rbx]
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4f8331
test byte [rbx + 0xa8], 4
jne 0x4f8390
add dword [rbx + 0xac], 1
lea r8, str.eng_list.c
mov r9d, 0x182
mov edx, 0x1e
mov ecx, 0xa
call fcn.00493400
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004f7610
test rax, rax
je 0x4f8420
movdqu xmm2, xmmword [rbx + 0x10]
movdqu xmm1, xmmword [rbx + 0x20]
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm3, xmmword [rbx]
movups xmmword [rax + 0x10], xmm2
movups xmmword [rax], xmm3
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov qword [rax + 0x40], rdx
movdqu xmm0, xmmword [rbx + 0x48]
movups xmmword [rax + 0x48], xmm0
mov rdx, qword [rbx + 0x58]
mov qword [rax + 0x58], rdx
movdqu xmm2, xmmword [rbx + 0x68]
movdqu xmm1, xmmword [rbx + 0x78]
movdqu xmm0, xmmword [rbx + 0x88]
movups xmmword [rax + 0x68], xmm2
movups xmmword [rax + 0x78], xmm1
movups xmmword [rax + 0x88], xmm0
mov rdx, qword [rbx + 0xa0]
mov qword [rax + 0xa0], rdx
mov edx, dword [rbx + 0xa8]
mov rbx, rax
mov dword [rax + 0xa8], edx
jmp 0x4f8360
lea r8, str.eng_list.c
lea rbx, [0x006b9062]
mov ecx, 0xa
mov r9d, 0x182
mov edx, 0x1e
mov rsi, rbp
call fcn.00493400
mov rdi, rbx
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
je 0x4f8560
lea rcx, str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
test rax, rax
mov rsi, rax
lea rax, str._home_ubuntu_build_bitcoin_depends_x86_64_w64_mingw32_lib_engines
mov rcx, rbx
cmove rsi, rax
call fcn.004f82f0
test rax, rax
mov rbx, rax
je 0x4f8560
lea rdx, [0x006b907a]
xor r9d, r9d
mov r8, rbp
mov rcx, rax
call fcn.004f8f60
test eax, eax
je 0x4f8510
lea r8, [0x006b907d]
lea rdx, str.DIR_LOAD
xor r9d, r9d
mov rcx, rbx
call fcn.004f8f60
test eax, eax
je 0x4f8510
lea rdx, str.DIR_ADD
xor r9d, r9d
mov r8, rsi
mov rcx, rbx
call fcn.004f8f60
test eax, eax
je 0x4f8510
lea r8, [0x006b9090]
lea rdx, [0x006b9092]
xor r9d, r9d
mov rcx, rbx
call fcn.004f8f60
test eax, eax
je 0x4f8510
lea rdx, [0x006b909b]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.004f8f60
test eax, eax
jne 0x4f837c
mov rcx, rbx
xor ebx, ebx
call fcn.004f7840
lea r9, str.eng_list.c
mov dword [rsp + 0x20], 0x1a2
mov r8d, 0x74
mov edx, 0x6a
mov ecx, 0x26
call fcn.00498ab0
lea rdx, [0x006b90a0]
mov r8, rbp
mov ecx, 2
call fcn.00499a10
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
jmp 0x4f8510
lea r9, str.eng_list.c
mov dword [rsp + 0x20], 0x165
mov r8d, 0x43
mov edx, 0x6a
mov ecx, 0x26
xor ebx, ebx
call fcn.00498ab0
jmp 0x4f837c
Function at 0x519120
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
test r8, r8
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
je 0x5191c2
test rcx, rcx
je 0x5191d0
test rdx, rdx
mov rcx, qword [rcx + 0x10]
lea r12, [rsp + 0x30]
je 0x5191a4
mov qword [rsp + 0x28], rdx
lea r12, [rsp + 0x30]
movq xmm0, qword [rsp + 0x28]
mov qword [rsp + 0x28], r8
movhps xmm0, qword [rsp + 0x28]
mov rdx, r12
movaps xmmword [rsp + 0x30], xmm0
call fcn.004be020
test rax, rax
je 0x519190
mov rax, qword [rax + 0x10]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [0x006bd700]
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
je 0x5191e3
mov rcx, qword [rbp + 0x10]
lea rax, [0x006bd704]
mov rdx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
call fcn.004be020
test rax, rax
jne 0x51917f
xor eax, eax
jmp 0x519183
mov rcx, r8
call sub.msvcrt.dll_getenv
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x519183
jmp 0x5191a0

Function at 0x5333b0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebx, dword [rsp + 0xa0]
test edx, edx
mov rdi, rcx
mov esi, edx
mov r12, r8
js 0x533550
test r9d, r9d
js 0x533550
cmp r9d, ebx
jg 0x5333e6
cmp ebx, 0xa
jg 0x533420
lea r9, str.rsa_pk1.c
mov dword [rsp + 0x20], 0x10b
mov r8d, 0x9f
mov edx, 0x71
mov ecx, 4
mov ebx, 0xffffffff
call fcn.00498ab0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, str.rsa_pk1.c
mov r8d, 0xcc
mov ecx, ebx
mov dword [rsp + 0x3c], r9d
call fcn.00493db0
test rax, rax
mov rbp, rax
mov r9d, dword [rsp + 0x3c]
je 0x53355a
movsxd r13, ebx
xor edx, edx
mov rcx, rax
mov r8, r13
mov dword [rsp + 0x3c], r9d
call fcn.005999d0
movsxd r8, dword [rsp + 0x3c]
mov rdx, r12
sub r13, r8
lea rcx, [rbp + r13]
call sub.msvcrt.dll_memcpy
movzx eax, byte [rbp + 1]
movzx edx, byte [rbp]
mov ecx, 2
xor r8d, r8d
xor r9d, r9d
xor eax, 2
movzx eax, al
mov r10d, eax
sub eax, 1
not r10d
and eax, r10d
mov r10d, edx
sub edx, 1
not r10d
and r10d, edx
and r10d, eax
sar r10d, 0x1f
nop dword [rax]
movzx eax, byte [rbp + rcx]
mov r11d, r8d
xor r11d, ecx
add rcx, 1
mov edx, eax
sub eax, 1
not edx
and edx, eax
mov eax, r9d
not eax
sar edx, 0x1f
and eax, r11d
or r9d, edx
and eax, edx
xor r8d, eax
cmp ebx, ecx
jg 0x5334b0
lea eax, [r8 - 0xa]
mov edx, r8d
xor edx, 0xa
xor eax, 0xa
or eax, edx
xor eax, r8d
add r8d, 1
sar eax, 0x1f
sub ebx, r8d
not eax
mov edx, ebx
and r10d, eax
mov eax, esi
xor edx, esi
sub eax, ebx
xor eax, ebx
or eax, edx
xor esi, eax
sar esi, 0x1f
not esi
test esi, r10d
jne 0x533525
mov rcx, rbp
call fcn.00494240
jmp 0x5333e6
movsxd r8, r8d
mov rcx, rdi
lea rdx, [rbp + r8]
movsxd r8, ebx
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call fcn.00494240
cmp ebx, 0xffffffff
jne 0x53340f
jmp 0x5333e6
mov ebx, 0xffffffff
jmp 0x53340f
lea r9, str.rsa_pk1.c
mov dword [rsp + 0x20], 0xcf
mov r8d, 0x41
mov edx, 0x71
mov ecx, 4
mov ebx, 0xffffffff
call fcn.00498ab0
jmp 0x53340f
Function at 0x554020
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
mov r10d, dword [rcx]
test r10d, r10d
jne 0x554032
mov dword [r8], r10d
pop rbx
pop rsi
pop rdi
ret
test r10d, r10d
lea r11, [rcx + 8]
jle 0x554170
cmp r10d, 2
mov rax, rdx
jg 0x5540df
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
xor esi, esi
movzx r9d, byte [r11]
add rax, 4
shl r9d, 0x10
cmp r10d, 2
je 0x554197
mov edi, r9d
shr edi, 0x12
movzx edi, byte [rbx + rdi]
mov byte [rax - 4], dil
mov edi, r9d
shr edi, 0xc
and edi, 0x3f
cmp r10d, 1
movzx edi, byte [rbx + rdi]
mov byte [rax - 3], dil
je 0x554187
shr r9d, 6
sub r10d, 3
add esi, 4
and r9d, 0x3c
add r11, 3
test r10d, r10d
movzx r9d, byte [rbx + r9]
mov byte [rax - 1], 0x3d
mov byte [rax - 2], r9b
jg 0x554055
lea r11d, [rsi + 1]
movsxd r9, esi
add r9, rdx
mov r10, r11
mov byte [rax], 0
mov byte [r9], 0xa
mov byte [rdx + r11], 0
mov dword [rcx], 0
mov dword [r8], r10d
pop rbx
pop rsi
pop rdi
ret
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop word cs:[rax + rax]
movzx r9d, byte [r11 + 1]
movzx esi, byte [r11]
add rax, 4
sub r10d, 3
add r11, 3
shl esi, 0x10
shl r9d, 8
or r9d, esi
movzx esi, byte [r11 - 1]
or r9d, esi
mov esi, r9d
shr esi, 0x12
movzx esi, byte [rbx + rsi]
mov byte [rax - 4], sil
mov esi, r9d
shr esi, 0xc
and esi, 0x3f
movzx esi, byte [rbx + rsi]
mov byte [rax - 3], sil
mov esi, r9d
and r9d, 0x3f
shr esi, 6
movzx r9d, byte [rbx + r9]
and esi, 0x3f
movzx esi, byte [rbx + rsi]
mov byte [rax - 1], r9b
mov byte [rax - 2], sil
mov esi, eax
sub esi, edx
cmp r10d, 2
jg 0x5540f0
test r10d, r10d
jne 0x554055
jmp 0x5540b9
mov r9, rdx
mov rax, rdx
mov r10d, 1
mov r11d, 1
jmp 0x5540c6
mov byte [rax - 2], 0x3d
mov byte [rax - 1], 0x3d
add esi, 4
jmp 0x5540b9
movzx edi, byte [r11 + 1]
shl edi, 8
or r9d, edi
mov edi, r9d
shr edi, 0x12
movzx edi, byte [rbx + rdi]
mov byte [rax - 4], dil
mov edi, r9d
shr edi, 0xc
and edi, 0x3f
movzx edi, byte [rbx + rdi]
mov byte [rax - 3], dil
jmp 0x554094