joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb0f0
Capabilities:
Resolve dns

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r12, r9
mov qword [r9], r13
lea r9, [rsp + 0x68]
mov ebx, r13d
mov r15d, r13d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r14d, eax
test eax, eax
jne 0x1400cb2be
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
test rsi, rsi
je 0x1400cb29e
mov qword [rsp + 0x50], rbp
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x1400cb14d
lea ebp, [rax + 0xe]
jmp 0x1400cb159
cmp eax, 0x17
jne 0x1400cb201
lea ebp, [rax + 5]
cmp qword [rsi + 0x20], r13
je 0x1400cb201
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400cb201
cmp rax, rbp
jb 0x1400cb201
mov ecx, 0x30
call qword [sub.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400cb23c
mov ecx, dword [rsi]
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0x10], ebp
mov dword [rax + 0xc], ecx
mov rcx, rbp
mov qword [rax + 0x20], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x28], r13
call qword [sub.MSVCR120.dll_malloc]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1400cb22b
mov rdx, qword [rsi + 0x20]
mov r8, rbp
mov rcx, rax
call sub.MSVCR120.dll_memcpy
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400cb1ee
call qword [case.0x1400ba044.0]
mov qword [rdi + 0x18], rax
test rax, rax
je 0x1400cb210
test rbx, rbx
cmove rbx, rdi
test r15, r15
je 0x1400cb1fe
mov qword [r15 + 0x28], rdi
mov r15, rdi
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x1400cb140
jmp 0x1400cb242
mov rcx, qword [rdi + 0x20]
mov r14d, 8
call qword [sub.MSVCR120.dll_free]
mov rcx, rdi
call qword [sub.MSVCR120.dll_free]
jmp 0x1400cb242
mov rcx, rdi
mov r14d, 8
call qword [sub.MSVCR120.dll_free]
jmp 0x1400cb242
mov r14d, 8
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
test rcx, rcx
je 0x1400cb257
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r14d, r14d
je 0x1400cb299
test rbx, rbx
je 0x1400cb294
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400cb270
call qword [sub.MSVCR120.dll_free]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400cb27f
call qword [sub.MSVCR120.dll_free]
mov rdi, qword [rbx + 0x28]
mov rcx, rbx
call qword [sub.MSVCR120.dll_free]
mov rbx, rdi
test rdi, rdi
jne 0x1400cb261
mov rbx, r13
jmp 0x1400cb2ad
test rbx, rbx
jne 0x1400cb2ad
mov r14d, 0x2af9
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov qword [r12], rbx
mov eax, r14d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x1400d2470
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 2
mov rsi, rdx
jne 0x1400d24ba
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1400d24aa
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x1400d2504
cmp qword [rbx + 0x10], 0
jne 0x1400d24ef
mov rcx, qword [rcx + 0x10]
lea rdx, [0x14025b964]
call qword [sym.imp.MSVCR120.dll_fopen]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400d24ef
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll_fread]
mov rdi, rax
test rax, rax
jne 0x1400d2528
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d251f
call qword [sym.imp.MSVCR120.dll_fclose]
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400d2b00
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x5c]
lea rcx, [rsp + 0x20]
call sub.MSVCR120.dll_memset
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400d2b60
lea rcx, [rsp + 0x20]
mov r8d, eax
mov rdx, rbx
call fcn.1400d8da0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d8ed0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401bddc0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
Function at 0x1400d4120
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call sub.MSVCR120.dll_memset
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1400d4180
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
test r8, r8
mov rdi, rdx
mov rbx, rcx
lea rsi, [0x1402ddff8]
lea rcx, [rsp + 0x20]
cmovne rsi, r8
xor edx, edx
lea r8d, [rdx + 0x70]
call sub.MSVCR120.dll_memset
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov dword [rsp + 0x8c], 0x20
call fcn.1400d4260
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400d4390
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_WSASetLastError
call fcn.140011ba0
mov rax, rsi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d5260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rdx + 8]
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
xor rcx, r10
shr rbx, 0x3f
movsxd rsi, r9d
dec rbx
lea eax, [rsi - 1]
mov r11, r8
and rcx, rbx
mov rdi, rdx
xor r10d, ecx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x1400d52b7
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0xd5460]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x1400d52b7.10
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi]
mov rcx, qword [rax + r9*8]
lea rdx, [rax + r9*8]
mov rax, qword [r11]
inc r9
mov r8, qword [rax + r9*8 - 8]
xor r8, rcx
and r8, rbx
xor rcx, r8
mov qword [rdx], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], r8
cmp r9, rsi
jl 0x1400d52d0
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x18]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x1400e8320
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, str.OPENSSL_CONF
call qword [sym.imp.MSVCR120.dll_getenv]
xor ebx, ebx
test rax, rax
je 0x1400e8366
mov rcx, rax
cmp byte [rax], bl
je 0x1400e8353
cmp ebx, 0x80000000
jae 0x1400e8353
inc rcx
inc ebx
cmp byte [rcx], 0
jne 0x1400e8341
mov edx, ebx
mov rcx, rax
btr edx, 0x1f
add rsp, 0x30
pop rbx
jmp fcn.1400f3ed0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
lea rdi, [0x14025f9ac]
mov eax, ebx
mov rcx, rdi
cmp byte [reloc.WS2_32.dll_WSAStartup], al
je 0x1400e8394
cmp eax, 0x80000000
jae 0x1400e8394
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400e8384
btr eax, 0x1f
mov ecx, ebx
lea rdx, [0x140266de0]
inc eax
cmp byte [reloc.WS2_32.dll_WSAGetLastError], cl
je 0x1400e83c1
nop dword [rax + rax]
cmp ecx, 0x80000000
jae 0x1400e83c1
inc rdx
inc ecx
cmp byte [rdx], bl
jne 0x1400e83b0
btr ecx, 0x1f
mov qword [rsp + 0x40], rbp
lea esi, [rcx + rax]
inc esi
test esi, esi
jle 0x1400e855e
mov rax, qword [0x1402ddc90]
mov dword [reloc.WS2_32.dll_accept], ebx
test rax, rax
je 0x1400e8406
lea r8, [0x140266df0]
mov r9d, 0x231
mov edx, esi
xor ecx, ecx
mov dword [reloc.WS2_32.dll_accept], ebx
mov dword [rsp + 0x20], ebx
call rax
lea rdx, [0x140266df0]
movsxd rcx, esi
mov r8d, 0x231
call qword [0x140218c18]
mov r10, qword [0x1402ddc90]
mov rbp, rax
test r10, r10
je 0x1400e8448
lea r8, [0x140266df0]
mov r9d, 0x231
mov edx, esi
mov rcx, rax
mov dword [rsp + 0x20], 1
call r10
test rbp, rbp
je 0x1400e855e
movsxd rdx, esi
mov rcx, rbp
mov rax, rdx
cmp rdx, 1
jbe 0x1400e847b
movzx r8d, byte [rdi]
test r8b, r8b
je 0x1400e847b
dec rax
mov byte [rcx], r8b
inc rcx
inc rdi
cmp rax, 1
ja 0x1400e8460
test rax, rax
je 0x1400e8482
mov byte [rcx], bl
mov eax, ebx
cmp byte [rdi], al
je 0x1400e8498
cmp eax, 0x80000000
jae 0x1400e8498
inc rdi
inc eax
cmp byte [rdi], bl
jne 0x1400e8488
mov rax, rdx
mov rcx, rbp
test esi, esi
je 0x1400e84ae
cmp byte [rcx], bl
je 0x1400e84ae
inc rcx
dec rax
jne 0x1400e84a2
lea r8, [0x14025ccfc]
cmp rax, 1
jbe 0x1400e84db
nop dword [rax + rax]
movzx r9d, byte [r8]
test r9b, r9b
je 0x1400e84db
dec rax
mov byte [rcx], r9b
inc rcx
inc r8
cmp rax, 1
ja 0x1400e84c0
test rax, rax
je 0x1400e84e2
mov byte [rcx], bl
mov eax, ebx
cmp byte [r8], al
je 0x1400e8501
nop dword [rax]
cmp eax, 0x80000000
jae 0x1400e8501
inc r8
inc eax
cmp byte [r8], bl
jne 0x1400e84f0
mov rcx, rbp
test esi, esi
je 0x1400e8514
cmp byte [rcx], bl
je 0x1400e8514
inc rcx
dec rdx
jne 0x1400e8508
lea rax, str.openssl.cnf
cmp rdx, 1
jbe 0x1400e853c
movzx r8d, byte [rax]
test r8b, r8b
je 0x1400e853c
dec rdx
mov byte [rcx], r8b
inc rcx
inc rax
cmp rdx, 1
ja 0x1400e8521
test rdx, rdx
je 0x1400e8543
mov byte [rcx], bl
cmp byte [rax], bl
je 0x1400e8559
cmp ebx, 0x80000000
jae 0x1400e8559
inc rax
inc ebx
cmp byte [rax], 0
jne 0x1400e8547
mov rax, rbp
jmp 0x1400e8560
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x1400e8bb0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x460
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor ebp, ebp
mov rdi, rcx
mov ebx, 0x400
test rcx, rcx
jne 0x1400e8be3
xor eax, eax
jmp 0x1400e8ce7
xor eax, eax
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.MSVCR120.dll__stat64i32]
test eax, eax
js 0x1400e8bdc
mov qword [rsp + 0x490], r14
call fcn.1400d8c40
test rax, rax
je 0x1400e8c3d
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400e8c3d
xorps xmm2, xmm2
lea rcx, [rsp + 0x20]
mov edx, 0x30
call r8
lea rdx, [0x14025cd14]
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_fopen]
mov r14, rax
test rax, rax
je 0x1400e8cdd
mov qword [rsp + 0x488], rsi
mov edi, 0x400
test ebx, ebx
jle 0x1400e8c6f
cmp ebx, edi
cmovl edi, ebx
lea rcx, [rsp + 0x50]
movsxd r8, edi
mov r9, r14
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fread]
mov rsi, rax
test eax, eax
jle 0x1400e8cbd
call fcn.1400d8c40
test rax, rax
je 0x1400e8cb1
mov r8, qword [rax + 0x18]
test r8, r8
je 0x1400e8cb1
movd xmm2, esi
lea rcx, [rsp + 0x50]
mov edx, esi
cvtdq2pd xmm2, xmm2
call r8
add ebp, esi
test ebx, ebx
jle 0x1400e8c61
sub ebx, edi
test ebx, ebx
jg 0x1400e8c61
mov rcx, r14
call qword [sym.imp.MSVCR120.dll_fclose]
lea rcx, [rsp + 0x50]
mov edx, 0x400
call fcn.140011ba0
mov rsi, qword [rsp + 0x488]
mov r14, qword [rsp + 0x490]
mov eax, ebp
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x460
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400e8d10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.RANDFILE
call qword [sym.imp.MSVCR120.dll_getenv]
xor edi, edi
mov ebx, 0x4000
test rax, rax
je 0x1400e8d8a
cmp byte [rax], dil
je 0x1400e8d8a
mov rdx, rax
mov ecx, edi
cmp ecx, 0x80000000
jae 0x1400e8d57
inc rdx
inc ecx
cmp byte [rdx], dil
jne 0x1400e8d45
btr ecx, 0x1f
inc ecx
cmp ecx, ebx
jae 0x1400e8d8a
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1400f40d0
cmp rax, rbx
jb 0x1400e8edd
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, str.HOME
call qword [sym.imp.MSVCR120.dll_getenv]
lea rdx, [0x14025cdfc]
test rax, rax
cmovne rdx, rax
cmp byte [rdx], dil
je 0x1400e8eda
mov rcx, rdx
mov eax, edi
cmp eax, 0x80000000
jae 0x1400e8dc4
inc rcx
inc eax
cmp byte [rcx], dil
jne 0x1400e8db3
mov ecx, edi
lea r8, [0x14026702c]
cmp byte [0x14026702c], cl
je 0x1400e8de7
cmp ecx, 0x80000000
jae 0x1400e8de7
inc r8
inc ecx
cmp byte [r8], dil
jne 0x1400e8dd5
btr eax, 0x1f
btr ecx, 0x1f
add eax, 2
add eax, ecx
cmp eax, ebx
jae 0x1400e8eda
mov r8, rbx
mov rcx, rsi
call fcn.1400f40d0
mov r11, rbx
mov rcx, rsi
nop dword [rax]
cmp byte [rcx], dil
je 0x1400e8e1d
inc rcx
dec r11
jne 0x1400e8e10
lea rax, [0x14025ce7c]
cmp r11, 1
jbe 0x1400e8e48
nop word [rax + rax]
movzx edx, byte [rax]
test dl, dl
je 0x1400e8e48
dec r11
mov byte [rcx], dl
inc rcx
inc rax
cmp r11, 1
ja 0x1400e8e30
test r11, r11
je 0x1400e8e50
mov byte [rcx], dil
mov ecx, edi
cmp byte [rax], cl
je 0x1400e8e68
cmp ecx, 0x80000000
jae 0x1400e8e68
inc rax
inc ecx
cmp byte [rax], dil
jne 0x1400e8e56
mov rcx, rsi
nop dword [rax + rax]
cmp byte [rcx], dil
je 0x1400e8e7d
inc rcx
dec rbx
jne 0x1400e8e70
lea rax, str..rnd
cmp rbx, 1
jbe 0x1400e8ea8
nop word [rax + rax]
movzx edx, byte [rax]
test dl, dl
je 0x1400e8ea8
dec rbx
mov byte [rcx], dl
inc rcx
inc rax
cmp rbx, 1
ja 0x1400e8e90
test rbx, rbx
je 0x1400e8eb0
mov byte [rcx], dil
cmp byte [rax], dil
je 0x1400e8edd
cmp edi, 0x80000000
jae 0x1400e8edd
inc rax
inc edi
cmp byte [rax], 0
jne 0x1400e8eb5
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov byte [rsi], dil
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f3e40
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov r9, rcx
test rcx, rcx
je 0x1400f3e9a
movzx eax, byte [rcx]
test al, al
je 0x1400f3e9a
mov r10d, 0x100
nop word [rax + rax]
movsx r8d, al
lea r9, [r9 + 1]
or r8d, r10d
add r10d, 0x100
mov eax, r8d
shr eax, 2
xor eax, r8d
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul r8d, r8d
rol edx, cl
xor edx, r8d
test al, al
jne 0x1400f3e60
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor eax, eax
ret

Function at 0x1400f6200
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1402ddca8], 0
jne 0x1400f62bb
lea rcx, str.OPENSSL_ia32cap
mov dword [0x1402ddca8], 1
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
je 0x1400f629d
mov qword [rsp + 0x38], rbx
xor ebx, ebx
cmp byte [rax], 0x7e
sete bl
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
movsxd rdi, ebx
lea rdx, str._I64i
add rdi, rax
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_sscanf]
test eax, eax
jne 0x1400f6275
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll_strtoul]
mov edx, eax
mov qword [rsp + 0x30], rdx
jmp 0x1400f627a
mov rdx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
test ebx, ebx
mov rbx, qword [rsp + 0x38]
je 0x1400f62a5
call fcn.140011a30
mov rdx, rax
mov rax, qword [rsp + 0x30]
not rax
and rdx, rax
jmp 0x1400f62a5
call fcn.140011a30
mov rdx, rax
mov ecx, edx
bts ecx, 0xa
shr rdx, 0x20
mov dword [0x1402e023c], edx
mov dword [0x1402e0238], ecx
add rsp, 0x28
ret

Function at 0x1400f6440
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x170
mov rax, qword [0x1402581e0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
je 0x1400f64b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1400f64b3
lea rbx, [rsp + 0x188]
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, qword [rsp + 0x180]
lea rcx, [rax + 0x60]
mov r8, rbx
call qword [sym.imp.MSVCR120.dll_vfprintf]
jmp 0x1400f655b
mov r8, qword [rsp + 0x180]
lea r9, [rsp + 0x188]
lea rcx, [rsp + 0x60]
mov edx, 0xff
call qword [sym.imp.MSVCR120.dll__vsnprintf]
mov byte [rsp + 0x15f], 0
call fcn.1400f62c0
xor ecx, ecx
test eax, eax
jle 0x1400f6543
lea rdx, str.OPENSSL
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
xor ecx, ecx
mov r9d, 1
mov qword [rsp + 0x40], rcx
mov rbx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov edx, r9d
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1400f655b
lea r8, str.OpenSSL:_FATAL
lea rdx, [rsp + 0x60]
mov r9d, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401bddc0
add rsp, 0x170
pop rbx
ret
Function at 0x140101ce0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
mov edx, 0x11d0
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 1]
mov r9d, setsockopt
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x60]
cmp dword [rsp + 0x50], 0
mov edx, eax
je 0x140101e07
mov rax, qword [rbx + 0x80]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
cmp dword [rax + 0x1c8], 0
jne 0x140101d5e
mov edi, 0xa
mov dword [rsp + 0x20], 0x103
lea r9, [0x140276760]
mov r8d, 0x9a
jmp 0x140101dde
mov dword [rax + 0x1c8], 0
mov r9, qword [rbx + 0x80]
mov rcx, qword [rbx + 0x58]
movsxd rdi, dword [r9 + 0x394]
cmp edi, edx
je 0x140101d98
mov edi, 0x32
mov dword [rsp + 0x20], 0x10e
lea r9, [0x140276788]
lea r8d, [rdi + 0x3d]
jmp 0x140101dde
xor dl, dl
test edi, edi
je 0x140101e0d
lea r10, [r9 + 0x314]
mov r8, rdi
sub r10, rcx
nop dword [rax + rax]
movzx eax, byte [r10 + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or dl, al
dec r8
jne 0x140101db0
test dl, dl
je 0x140101e0d
lea edi, [r8 + 0x33]
mov dword [rsp + 0x20], 0x115
lea r9, [0x1402767b0]
lea r8d, [rdi + 0x62]
mov edx, 0x8c
lea ecx, [rdx - 0x78]
call fcn.1400d9be0
mov r8d, edi
mov edx, 2
mov rcx, rbx
call fcn.1400fe9f0
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp dword [rbx + 4], 0x2000
jne 0x140101e8b
cmp edi, 0x40
jg 0x140101e54
lea rcx, [r9 + 0x418]
lea rdx, [r9 + 0x314]
mov r8, rdi
call sub.MSVCR120.dll_memcpy
mov rax, qword [rbx + 0x80]
mov rsi, qword [rsp + 0x40]
mov byte [rax + 0x458], dil
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea r9, [0x1402767d8]
lea rdx, [0x1402767f0]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x11d
call fcn.1400f6440
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3
cmp edi, 0x40
jg 0x140101ec9
lea rcx, [r9 + 0x459]
lea rdx, [r9 + 0x314]
mov r8, rdi
call sub.MSVCR120.dll_memcpy
mov rax, qword [rbx + 0x80]
mov rsi, qword [rsp + 0x40]
mov byte [rax + 0x499], dil
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rbx
ret
lea r9, str.i___EVP_MAX_MD_SIZE
lea rdx, [0x140276830]
lea rcx, str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r8d, 0x124
call fcn.1400f6440
mov ecx, reloc.WS2_32.dll_shutdown
call qword [sym.imp.MSVCR120.dll_raise]
mov ecx, 3
call qword [sym.imp.MSVCR120.dll__exit]
int3