joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542460
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
call sym.EVP_CIPHER_CTX_get_key_length
mov ecx, 2
mov r12d, eax
call qword [sym.__acrt_iob_func]
mov r8d, 0x2e
mov edx, 1
lea rcx, str._TEST_ENG_OPENSSL_RC4__test_init_key___called_n
mov r9, rax
call sym.fwrite
test r12d, r12d
jle 0x5424e0
mov rcx, r13
call sym.EVP_CIPHER_CTX_get_cipher_data
movsxd r8, r12d
mov rdx, r14
mov rcx, rax
call sym.memcpy
mov rcx, r13
call sym.EVP_CIPHER_CTX_get_cipher_data
mov rcx, r13
mov r14, rax
call sym.EVP_CIPHER_CTX_get_cipher_data
mov edx, r12d
mov r8, r14
mov r12d, 1
lea rcx, [rax + 0x10]
call sym.RC4_set_key
mov eax, r12d
add rsp, 0x20
pop r12
pop r13
pop r14
ret

Function at 0x548080
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
cmp rcx, 0xffffffffffffffff
je 0x548098
lea rcx, [0x00829a3c]
jmp sym.CRYPTO_THREAD_set_local
ret

Function at 0x5488a0
Capabilities:
Set thread local storage value

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, 0x40000
mov r13d, eax
call sym.OPENSSL_init_crypto
test eax, eax
je 0x548925
lea rdx, [sym.err_do_init_ossl_]
lea rcx, [0x00829a44]
call sym.CRYPTO_THREAD_run_once
test eax, eax
je 0x548925
mov eax, dword [0x00829a20]
test eax, eax
je 0x548925
lea rcx, [0x00829a3c]
call sym.CRYPTO_THREAD_get_local
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x548925
test rax, rax
je 0x548930
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub ebx, 1
movsxd rdx, dword [r12 + 0x340]
not eax
and eax, ebx
sar eax, 0x1f
not eax
and eax, 2
or dword [r12 + rdx*4], eax
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rdx, 0xffffffffffffffff
lea rcx, [0x00829a3c]
call sym.CRYPTO_THREAD_set_local
test eax, eax
je 0x548925
mov r8d, 0x2b3
lea rdx, str..._openssl_3.1.1_crypto_err_err.c
mov ecx, 0x348
call sym.CRYPTO_zalloc
mov r12, rax
test rax, rax
je 0x5489a8
xor edx, edx
xor ecx, ecx
lea r8, [sym.err_delete_thread_state]
call sym.ossl_init_thread_start
test eax, eax
je 0x5489a0
mov rdx, r12
lea rcx, [0x00829a3c]
call sym.CRYPTO_THREAD_set_local
test eax, eax
je 0x5489a0
xor edx, edx
mov ecx, 2
call sym.OPENSSL_init_crypto
jmp 0x5488ff
mov rcx, r12
call sym.ERR_STATE_free.part.0
xor edx, edx
lea rcx, [0x00829a3c]
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp sym.CRYPTO_THREAD_set_local
Function at 0x55cf60
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rcx + 0x78]
test rdx, rdx
je 0x55d0b8
movzx ecx, byte [rdx + 2]
movzx r9d, byte [rdx + 1]
shl ecx, 0x10
shl r9d, 8
or ecx, r9d
movzx r9d, byte [rdx]
or ecx, r9d
movzx r9d, byte [rdx + 3]
shl r9d, 0x18
or ecx, r9d
mov dword [rax], ecx
movzx ecx, byte [rdx + 5]
movzx r9d, byte [rdx + 6]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 4]
or ecx, r9d
movzx r9d, byte [rdx + 7]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 4], ecx
movzx ecx, byte [rdx + 9]
movzx r9d, byte [rdx + 0xa]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 8]
or ecx, r9d
movzx r9d, byte [rdx + 0xb]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 8], ecx
movzx ecx, byte [rdx + 0xd]
movzx r9d, byte [rdx + 0xe]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0xc]
or ecx, r9d
movzx r9d, byte [rdx + 0xf]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0xc], ecx
movzx ecx, byte [rdx + 0x11]
movzx r9d, byte [rdx + 0x12]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x10]
or ecx, r9d
movzx r9d, byte [rdx + 0x13]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x10], ecx
movzx ecx, byte [rdx + 0x15]
movzx r9d, byte [rdx + 0x16]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x14]
or ecx, r9d
movzx r9d, byte [rdx + 0x17]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x14], ecx
movzx ecx, byte [rdx + 0x19]
movzx r9d, byte [rdx + 0x1a]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x18]
or ecx, r9d
movzx r9d, byte [rdx + 0x1b]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x18], ecx
movzx ecx, byte [rdx + 0x1d]
movzx r9d, byte [rdx + 0x1e]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x1c]
movzx edx, byte [rdx + 0x1f]
or ecx, r9d
shl edx, 0x18
or edx, ecx
mov dword [rax + 0x1c], edx
test r8, r8
je 0x55d158
movzx edx, byte [r8 + 2]
movzx ecx, byte [r8 + 1]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8]
or edx, ecx
movzx ecx, byte [r8 + 3]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x20], edx
movzx edx, byte [r8 + 6]
movzx ecx, byte [r8 + 5]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 4]
or edx, ecx
movzx ecx, byte [r8 + 7]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x24], edx
movzx edx, byte [r8 + 0xa]
movzx ecx, byte [r8 + 9]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 8]
or edx, ecx
movzx ecx, byte [r8 + 0xb]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x28], edx
movzx edx, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xe]
shl edx, 8
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [r8 + 0xc]
or edx, ecx
movzx ecx, byte [r8 + 0xf]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x2c], edx
mov dword [rax + 0x70], 0
mov eax, 1
ret
Function at 0x561030
Capabilities:
Encrypt data using rc6

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov rbx, rdx
call sym.EVP_CIPHER_CTX_get_key_length
mov r13d, eax
cmp eax, 0xff
ja 0x561080
mov rcx, r12
call sym.EVP_CIPHER_CTX_get_cipher_data
mov rcx, r12
mov esi, dword [rax]
call sym.EVP_CIPHER_CTX_get_cipher_data
mov r8, rbx
mov edx, r13d
lea rcx, [rax + 4]
mov r9d, esi
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp sym.RC5_32_set_key
call sym.ERR_new
lea r8, str.r_32_12_16_init_key
mov edx, 0x4e
lea rcx, [0x007bd980]
call sym.ERR_set_debug
xor r8d, r8d
mov edx, 0xc3
mov ecx, 6
call sym.ERR_set_error
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x568ff0
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_get0_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA256_Init

Function at 0x5690f0
Capabilities:
Hash data using sha384

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_get0_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA384_Init

Function at 0x569110
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_get0_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA512_Init
Function at 0x57b6d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rcx
test rcx, rcx
je 0x57b740
movzx edx, byte [rcx]
xor eax, eax
test dl, dl
je 0x57b737
xor r8d, r8d
mov r11d, 0x100
mov ebx, 0x20
movsx eax, dl
mov r10d, r8d
add r9, 1
mov r8d, r8d
or eax, r11d
add r11d, 0x100
mov edx, eax
shr edx, 2
xor edx, eax
imul eax, eax
and edx, 0xf
mov ecx, edx
shl r10d, cl
mov ecx, ebx
sub ecx, edx
movzx edx, byte [r9]
shr r8, cl
or r8d, r10d
xor r8d, eax
test dl, dl
jne 0x57b6f0
mov eax, r8d
shr eax, 0x10
xor eax, r8d
pop rbx
ret
xor eax, eax
pop rbx
ret

Function at 0x57be50
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rcx
test rcx, rcx
je 0x57bec8
movzx edx, byte [rcx]
xor eax, eax
test dl, dl
je 0x57bec2
mov r10d, 0x100
xor r8d, r8d
mov r11d, 0x20
nop dword [rax]
and edx, 0xffffffdf
mov ebx, r8d
add r9, 1
mov r8d, r8d
movsx eax, dl
or eax, r10d
add r10d, 0x100
mov edx, eax
shr edx, 2
xor edx, eax
imul eax, eax
and edx, 0xf
mov ecx, edx
shl ebx, cl
mov ecx, r11d
sub ecx, edx
movzx edx, byte [r9]
shr r8, cl
or r8d, ebx
xor r8d, eax
test dl, dl
jne 0x57be78
mov eax, r8d
shr eax, 0x10
xor eax, r8d
pop rbx
ret
xor eax, eax
pop rbx
ret
Function at 0x57c6e0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x00829b00]
test eax, eax
je 0x57c710
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [0x00829b00], 1
mov r8d, 0x30
lea rdx, [0x00829aa0]
lea rcx, str.OPENSSL_ia32cap
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x2e
ja 0x57c8f8
movzx ebp, word [0x00829aa0]
xor edx, edx
mov esi, 0xa
lea rax, [0x00829aa0]
cmp bp, 0x7e
sete dl
lea rbx, [rax + rdx*2]
cmp word [rbx], 0x30
je 0x57c960
xor r13d, r13d
mov edi, esi
jmp 0x57c788
sub r12d, 0x30
cmp esi, r12d
jbe 0x57c7b1
imul r13, rdi
add r13, r12
movzx r12d, word [rbx]
add rbx, 2
mov ecx, r12d
call sym.ossl_isdigit
test eax, eax
jne 0x57c778
mov edx, 0x10
mov ecx, r12d
call sym.ossl_ctype_check
test eax, eax
jne 0x57c8b0
cmp bp, 0x7e
je 0x57c918
movzx r14d, word [0x00829aa0]
cmp r14w, 0x3a
je 0x57c9b0
test r14w, r14w
je 0x57c8e0
lea rax, [0x00829aa0]
jmp 0x57c7f6
add rax, 2
test r14w, r14w
je 0x57c8e0
mov edx, r14d
movzx r14d, word [rax + 2]
cmp dx, 0x3a
jne 0x57c7e8
xor edx, edx
cmp r14w, 0x7e
sete dl
lea rbx, [rax + rdx*2 + 2]
cmp word [rbx], 0x30
je 0x57c9f0
mov esi, 0xa
xor ebp, ebp
mov edi, esi
jmp 0x57c840
sub r12d, 0x30
cmp esi, r12d
jbe 0x57c865
imul rbp, rdi
add rbp, r12
movzx r12d, word [rbx]
add rbx, 2
mov ecx, r12d
call sym.ossl_isdigit
test eax, eax
jne 0x57c830
mov edx, 0x10
mov ecx, r12d
call sym.ossl_ctype_check
test eax, eax
jne 0x57c8c8
mov rax, rbp
shr rax, 0x20
cmp r14w, 0x7e
je 0x57c980
mov rdx, qword [0x007e9a80]
movd xmm0, ebp
movd xmm2, eax
punpckldq xmm0, xmm2
movq qword [rdx + 8], xmm0
mov eax, r13d
shr r13, 0x20
or ah, 4
mov dword [rdx + 4], r13d
mov dword [rdx], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, r12d
call sym.ossl_tolower
lea r12d, [rax - 0x57]
jmp 0x57c77c
mov ecx, r12d
call sym.ossl_tolower
lea r12d, [rax - 0x57]
jmp 0x57c834
mov rdx, qword [0x007e9a80]
mov qword [rdx + 8], 0
jmp 0x57c88f
mov rcx, qword [0x007e9a80]
call sym.OPENSSL_ia32_cpuid
mov rdx, qword [0x007e9a80]
mov r13, rax
jmp 0x57c88f
mov rcx, qword [0x007e9a80]
call sym.OPENSSL_ia32_cpuid
mov r8, rax
mov rax, r13
not rax
and rax, r8
test r13d, 0x1000000
je 0x57c9d0
movabs r12, 0xedfff7fdffffffff
movzx r14d, word [0x00829aa0]
and rax, r12
mov r13, rax
jmp 0x57c7ce
movzx ecx, word [rbx + 2]
call sym.ossl_tolower
cmp eax, 0x78
je 0x57c9e0
add rbx, 2
mov esi, 8
jmp 0x57c76a
mov rdx, qword [0x007e9a80]
movd xmm0, ebp
movd xmm3, eax
punpckldq xmm0, xmm3
movq xmm1, qword [rdx + 8]
pandn xmm0, xmm1
movq qword [rdx + 8], xmm0
jmp 0x57c88f
mov rcx, qword [0x007e9a80]
call sym.OPENSSL_ia32_cpuid
movzx r14d, word [0x00829aa0]
mov r13, rax
jmp 0x57c7ce
movzx r14d, word [0x00829aa0]
mov r13, rax
jmp 0x57c7ce
add rbx, 4
mov esi, 0x10
jmp 0x57c76a
movzx ecx, word [rbx + 2]
call sym.ossl_tolower
cmp eax, 0x78
je 0x57ca0c
add rbx, 2
mov esi, 8
jmp 0x57c822
add rbx, 4
mov esi, 0x10
jmp 0x57c822
Function at 0x584640
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp sym.md4_block_data_order

Function at 0x584e40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x120], r8
mov rbx, rcx
mov r13, rdx
test r8, r8
je 0x584f54
movzx edx, byte [rcx + 0xc]
movzx eax, byte [rcx + 0x14]
lea r12, [rcx + 0xc]
lea rbp, [rcx + 0x14]
xor esi, esi
lea rdi, [rsp + 0x40]
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x38]
nop dword [rax + rax]
and edx, 0xffffff9f
and eax, 0xffffff9f
mov r9d, dword [r13 + rsi]
mov r10d, dword [r13 + rsi + 4]
or eax, 0x20
or edx, 0x40
mov rcx, qword [r13 + rsi]
add rsi, 8
mov byte [rbx + 0x14], al
mov byte [rbx + 0xc], dl
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov rcx, r12
mov dword [rsp + 0x2c], r9d
mov dword [rsp + 0x28], r10d
call sym.DES_set_odd_parity
mov rdx, rdi
mov rcx, r12
call sym.DES_set_key_unchecked
mov r8d, 1
mov rdx, rdi
mov rcx, r15
call sym.DES_encrypt1
mov rcx, rbp
call sym.DES_set_odd_parity
mov rdx, rdi
mov rcx, rbp
call sym.DES_set_key_unchecked
mov rdx, rdi
mov rcx, r14
mov r8d, 1
call sym.DES_encrypt1
mov r9d, dword [rsp + 0x2c]
mov r10d, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
xor ecx, r9d
xor eax, r10d
xor r9d, dword [rsp + 0x30]
xor r10d, dword [rsp + 0x34]
mov dword [rbx + 0x10], eax
mov edx, r9d
mov eax, ecx
mov dword [rbx + 0xc], r9d
mov dword [rbx + 0x14], ecx
mov dword [rbx + 0x18], r10d
cmp qword [rsp + 0x120], rsi
ja 0x584e90
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x642f00
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x642f35
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x642f10
and r10, 0xf
je 0x642f66
mov r9, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x642f41
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x642f5a
mov rax, r8
repz ret

Function at 0x642f70
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x642fad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x642f80
pxor xmm1, xmm1
and r10, 0xf
je 0x642fe4
mov r9, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x642fbc
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x642fd8
mov rax, r8
repz ret
Function at 0x647390
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp sym.ripemd160_block_data_order
Function at 0x656d20
Capabilities:
Encode data using xor

Disassembly:
mov r10d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
test r10d, r10d
je 0x656d40
mov r10, qword [sym.SEED_encrypt]
mov qword [rsp + 0x30], r10
jmp sym.CRYPTO_cbc128_encrypt
mov r10, qword [sym.SEED_decrypt]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r10
jmp sym.CRYPTO_cbc128_decrypt
Function at 0x657160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, [0x00657340]
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x657200
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x6571c6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call sym.__KeccakF1600
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x6571b9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x65a06d
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8

Function at 0x664410
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
mov r8d, 1
jmp sym.sha1_block_data_order
Function at 0x6670ad
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
Function at 0x671ec0
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp sym.sha256_block_data_order

Function at 0x673150
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x28]
add qword [rcx], r8
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov r13, rdx
mov r14, r8
test eax, eax
je 0x6731fa
mov r15d, 8
lea rcx, [rcx + rax + 0x38]
sub r15d, eax
cmp r8, r15
jb 0x6732ca
mov r8, r15
sub r14, r15
add r13, r15
call sym.memcpy
mov rcx, qword [r12 + 0x38]
mov edx, dword [r12 + 0x30]
xor rbx, rcx
test edx, edx
je 0x6731f7
xor eax, eax
nop dword [rax + rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp eax, edx
jne 0x6731c0
xor rdi, rcx
mov r9d, r14d
and r14, 0xfffffffffffffff8
lea r8, [r13 + r14]
and r9d, 7
cmp r13, r8
je 0x67326b
mov edx, dword [r12 + 0x30]
nop dword [rax]
mov rcx, qword [r13]
xor rbx, rcx
test edx, edx
je 0x67325f
xor eax, eax
nop dword [rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp edx, eax
jne 0x673228
add r13, 8
xor rdi, rcx
cmp r8, r13
jne 0x673218
test r9d, r9d
jne 0x6732ae
movq xmm0, rdi
movq xmm1, rsi
movq xmm2, rbx
mov dword [r12 + 0x28], r9d
punpcklqdq xmm0, xmm1
movups xmmword [r12 + 8], xmm0
movq xmm0, rbp
punpcklqdq xmm0, xmm2
movups xmmword [r12 + 0x18], xmm0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r10, [r12 + 0x38]
xor eax, eax
mov edx, eax
add eax, 1
movzx ecx, byte [r8 + rdx]
mov byte [r10 + rdx], cl
cmp eax, r9d
jb 0x6732b5
jmp 0x673270
call sym.memcpy
add dword [r12 + 0x28], r14d
jmp 0x67329d
Function at 0x6732e0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rdi
push rsi
push rbx
mov ebx, dword [rcx + 0x30]
mov r10, rcx
mov r9, rdx
test ebx, ebx
je 0x673328
test r8, r8
je 0x673328
mov eax, dword [rcx + 0x2c]
xor r12d, r12d
mov rsi, rax
cmp rax, r8
jne 0x67332b
mov rdi, qword [rcx]
shl rdi, 0x38
cmp dword [rcx + 0x28], 7
ja case.0x673323.0
mov eax, dword [rcx + 0x28]
lea rdx, [0x007cac40]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
xor r12d, r12d
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
ret
movzx eax, byte [rcx + 0x3e]
shl rax, 0x30
or rdi, rax
movzx eax, byte [r10 + 0x3d]
shl rax, 0x28
or rdi, rax
movzx eax, byte [r10 + 0x3c]
shl rax, 0x20
or rdi, rax
movzx eax, byte [r10 + 0x3b]
shl rax, 0x18
or rdi, rax
movzx eax, byte [r10 + 0x3a]
shl rax, 0x10
or rdi, rax
movzx eax, byte [r10 + 0x39]
shl rax, 8
or rdi, rax
movzx eax, byte [r10 + 0x38]
or rdi, rax
mov r8, qword [r10 + 0x20]
mov r11, qword [r10 + 8]
xor ecx, ecx
mov rax, qword [r10 + 0x10]
mov rdx, qword [r10 + 0x18]
xor r8, rdi
nop dword [rax]
add r11, rax
add rdx, r8
rol rax, 0xd
add ecx, 1
rol r8, 0x10
xor rax, r11
rol r11, 0x20
xor r8, rdx
add rdx, rax
rol rax, 0x11
add r11, r8
rol r8, 0x15
xor rax, rdx
xor r8, r11
rol rdx, 0x20
cmp ebx, ecx
ja 0x6733a0
mov rcx, rdx
xor r11, rdi
xor dl, 0xff
xor cl, 0xee
cmp esi, 0x10
mov esi, dword [r10 + 0x34]
cmove rdx, rcx
xor ebx, ebx
test esi, esi
je 0x67343b
nop dword [rax]
add r11, rax
rol rax, 0xd
add rdx, r8
add ebx, 1
mov rcx, rax
mov rax, r8
rol rax, 0x10
xor rcx, r11
rol r11, 0x20
xor rax, rdx
add rdx, rcx
rol rcx, 0x11
add r11, rax
rol rax, 0x15
xor rax, r11
mov r8, rax
mov rax, rcx
xor rax, rdx
rol rdx, 0x20
cmp esi, ebx
jne 0x6733f8
mov rcx, r8
mov r12d, 1
xor rcx, rdx
xor rcx, rax
xor rcx, r11
mov qword [r9], rcx
cmp dword [r10 + 0x2c], 8
je 0x67332b
mov r10d, dword [r10 + 0x34]
xor al, 0xdd
test r10d, r10d
je 0x6734a8
xor ecx, ecx
nop dword [rax + rax]
add r11, rax
add rdx, r8
rol rax, 0xd
add ecx, 1
rol r8, 0x10
xor rax, r11
rol r11, 0x20
xor r8, rdx
add rdx, rax
rol rax, 0x11
add r11, r8
rol r8, 0x15
xor rax, rdx
xor r8, r11
rol rdx, 0x20
cmp r10d, ecx
jne 0x673470
xor rdx, rax
mov r12d, 1
mov rax, rdx
xor rax, r8
xor rax, r11
mov qword [r9 + 8], rax
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x678ad0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
lea r8, [0x007cb000]
lea rsi, [r8 + 0x80]
mov r10d, dword [rcx]
mov r9d, dword [rcx + 4]
bswap r10d
bswap r9d
xor r10d, 0xa3b1bac6
xor r9d, 0x56aa3350
mov rax, rcx
mov r11, rdx
mov ecx, dword [rcx + 8]
mov edx, dword [rax + 0xc]
lea rax, [0x007cc080]
bswap ecx
mov edi, ecx
bswap edx
mov ebx, edx
xor edi, 0x677d9197
xor ebx, 0xb27022dc
nop word cs:[rax + rax]
mov ecx, ebx
mov ebp, r9d
xor ecx, edi
xor ebp, ecx
xor ebp, dword [r8]
xor ecx, dword [r8 + 4]
mov edx, ebp
movzx r12d, bpl
shr edx, 0x18
movzx r12d, byte [rax + r12]
movzx edx, byte [rax + rdx]
shl edx, 0x18
or edx, r12d
mov r12d, ebp
shr r12d, 0x10
movzx r12d, r12b
movzx r12d, byte [rax + r12]
shl r12d, 0x10
or r12d, edx
mov edx, ebp
movzx ebp, dh
mov edx, r12d
movzx ebp, byte [rax + rbp]
shl ebp, 8
or edx, ebp
mov ebp, edx
mov r12d, edx
rol ebp, 0xd
ror r12d, 9
xor ebp, r12d
xor edx, ebp
xor r10d, edx
xor ecx, r10d
mov edx, ecx
movzx ebp, cl
shr edx, 0x18
movzx ebp, byte [rax + rbp]
movzx edx, byte [rax + rdx]
shl edx, 0x18
or edx, ebp
mov ebp, ecx
movzx ecx, ch
shr ebp, 0x10
movzx ecx, byte [rax + rcx]
movzx ebp, bpl
movzx ebp, byte [rax + rbp]
shl ecx, 8
shl ebp, 0x10
or edx, ebp
or edx, ecx
mov ecx, edx
rol ecx, 0xd
xor ecx, edx
ror edx, 9
xor r9d, ecx
xor r9d, edx
mov edx, dword [r8 + 8]
xor edx, ebx
xor edx, r10d
add r8, 0x10
xor edx, r9d
mov ecx, edx
movzx ebp, dl
shr ecx, 0x18
movzx ebp, byte [rax + rbp]
movzx ecx, byte [rax + rcx]
shl ecx, 0x18
or ecx, ebp
mov ebp, edx
movzx edx, dh
shr ebp, 0x10
movzx edx, byte [rax + rdx]
movzx ebp, bpl
movzx ebp, byte [rax + rbp]
shl edx, 8
shl ebp, 0x10
or ecx, ebp
or ecx, edx
mov edx, ecx
rol edx, 0xd
xor edx, ecx
ror ecx, 9
xor edi, edx
xor edi, ecx
mov ecx, dword [r8 - 4]
mov dword [r11], r10d
mov dword [r11 + 4], r9d
xor ecx, r10d
mov dword [r11 + 8], edi
xor ecx, r9d
xor ecx, edi
mov edx, ecx
movzx ebp, cl
shr edx, 0x18
movzx ebp, byte [rax + rbp]
movzx edx, byte [rax + rdx]
shl edx, 0x18
or edx, ebp
mov ebp, ecx
movzx ecx, ch
shr ebp, 0x10
movzx ecx, byte [rax + rcx]
movzx ebp, bpl
movzx ebp, byte [rax + rbp]
shl ecx, 8
shl ebp, 0x10
or edx, ebp
or edx, ecx
mov ecx, edx
rol ecx, 0xd
xor ecx, edx
ror edx, 9
xor ebx, ecx
xor ebx, edx
add r11, 0x10
mov dword [r11 - 4], ebx
cmp r8, rsi
jne 0x678b30
mov eax, 1
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x67d190
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov r12, rdx
call sym.UI_get_string_type
cmp eax, 2
je 0x67d1d0
cmp eax, 3
je 0x67d2d0
cmp eax, 1
je 0x67d280
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, qword [0x00829c30]
lea rdx, str.Verifying____s
mov r8, rax
call sym.fprintf
mov rcx, qword [0x00829c30]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
mov r9d, 1
mov rdx, r12
mov rcx, r13
and eax, 1
mov r8d, eax
call sym.read_string_inner
test eax, eax
jle 0x67d1c4
mov rcx, r12
call sym.UI_get0_test_string
mov rcx, r12
mov r13, rax
call sym.UI_get0_result_string
mov rdx, r13
mov rcx, rax
call sym.strcmp
mov r8d, eax
mov eax, 1
test r8d, r8d
je 0x67d1c4
mov r9, qword [0x00829c30]
mov r8d, 0xf
mov edx, 1
lea rcx, str.Verify_failure_n
call sym.fwrite
mov rcx, qword [0x00829c30]
call sym.fflush
xor eax, eax
jmp 0x67d1c4
mov r14, qword [0x00829c30]
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov rcx, qword [0x00829c30]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
mov r9d, 1
and eax, 1
mov rdx, r12
mov rcx, r13
mov r8d, eax
add rsp, 0x20
pop r12
pop r13
pop r14
jmp sym.read_string_inner
mov r14, qword [0x00829c30]
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov r14, qword [0x00829c30]
mov rcx, r12
call sym.UI_get0_action_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov rcx, qword [0x00829c30]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
xor r9d, r9d
jmp 0x67d2b4