joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40299d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call sym._x86_64_AES_set_encrypt_key
mov r8, qword [rsp]
cmp eax, 0
jne 0x402b9d
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x4029d8
lea rax, [0x00403dc0]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x402a1c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4064f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov edx, 1
mov r12, rcx
call sym.rand_pool_bytes_needed
mov rcx, r12
mov rdx, rax
mov r13, rax
call sym.rand_pool_add_begin
mov rbx, rax
test rax, rax
je 0x406570
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4065f0
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call sym.rand_pool_add_end
mov rcx, r12
call sym.rand_pool_entropy_available
test rax, rax
je 0x406570
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov edx, 1
mov rcx, r12
call sym.rand_pool_bytes_needed
mov rcx, r12
mov rdx, rax
mov r13, rax
call sym.rand_pool_add_begin
mov rbx, rax
test rax, rax
je 0x4065db
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x48]
mov r9d, 0x16
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x406640
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call sym.rand_pool_add_end
mov rcx, r12
call sym.rand_pool_entropy_available
test rax, rax
jne 0x406560
mov rcx, r12
call sym.rand_pool_entropy_available
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x406630
xor r8d, r8d
xor r13d, r13d
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x406548
lea r8, [r13*8]
jmp 0x40660b
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x406680
lea r8, [r13*8]
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x4065c3
xor r8d, r8d
xor r13d, r13d
jmp 0x40665d

Function at 0x406920
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
ret

Function at 0x406940
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [r12]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x406980
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x406ec0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x0063d100]
test eax, eax
je 0x406ef0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [0x0063d100], 1
mov r8d, 0x30
lea rdx, [0x0063d0a0]
lea rcx, str.OPENSSL_ia32cap
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x2e
ja 0x4070d8
movzx ebp, word [0x0063d0a0]
xor edx, edx
mov esi, 0xa
lea rax, [0x0063d0a0]
cmp bp, 0x7e
sete dl
lea rbx, [rax + rdx*2]
cmp word [rbx], 0x30
je 0x407140
xor r13d, r13d
mov edi, esi
jmp 0x406f68
sub r12d, 0x30
cmp esi, r12d
jbe 0x406f96
imul r13, rdi
add r13, r12
movzx r12d, word [rbx]
mov edx, 4
add rbx, 2
mov ecx, r12d
call sym.ossl_ctype_check
test eax, eax
jne 0x406f58
mov edx, 0x10
mov ecx, r12d
call sym.ossl_ctype_check
test eax, eax
jne 0x407090
cmp bp, 0x7e
je 0x4070f8
movzx r14d, word [0x0063d0a0]
cmp r14w, 0x3a
je 0x407180
test r14w, r14w
je 0x4070c0
lea rax, [0x0063d0a0]
jmp 0x406fde
add rax, 2
test r14w, r14w
je 0x4070c0
mov edx, r14d
movzx r14d, word [rax + 2]
cmp dx, 0x3a
jne 0x406fd0
xor edx, edx
cmp r14w, 0x7e
sete dl
add rdx, 1
lea rbx, [rax + rdx*2]
cmp word [rbx], 0x30
je 0x4071c0
mov esi, 0xa
xor ebp, ebp
mov edi, esi
jmp 0x407028
sub r12d, 0x30
cmp esi, r12d
jbe 0x407052
imul rbp, rdi
add rbp, r12
movzx r12d, word [rbx]
mov edx, 4
add rbx, 2
mov ecx, r12d
call sym.ossl_ctype_check
test eax, eax
jne 0x407018
mov edx, 0x10
mov ecx, r12d
call sym.ossl_ctype_check
test eax, eax
jne 0x4070a8
mov rax, rbp
shr rax, 0x20
cmp r14w, 0x7e
je 0x407160
mov rdx, qword [0x00619730]
mov qword [rdx + 8], rbp
mov eax, r13d
shr r13, 0x20
or ah, 4
mov dword [rdx + 4], r13d
mov dword [rdx], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, r12d
call sym.ossl_tolower
lea r12d, [rax - 0x57]
jmp 0x406f5c
mov ecx, r12d
call sym.ossl_tolower
lea r12d, [rax - 0x57]
jmp 0x40701c
mov rdx, qword [0x00619730]
mov qword [rdx + 8], 0
jmp 0x40706f
mov rcx, qword [0x00619730]
call sym.OPENSSL_ia32_cpuid
mov rdx, qword [0x00619730]
mov r13, rax
jmp 0x40706f
mov rcx, qword [0x00619730]
call sym.OPENSSL_ia32_cpuid
mov r8, rax
mov rax, r13
not rax
and rax, r8
test r13d, 0x1000000
je 0x4071a0
movabs r12, 0xedfff7fdffffffff
movzx r14d, word [0x0063d0a0]
and rax, r12
mov r13, rax
jmp 0x406fb3
movzx ecx, word [rbx + 2]
call sym.ossl_tolower
cmp eax, 0x78
je 0x4071b0
add rbx, 2
mov esi, 8
jmp 0x406f4a
mov rdx, qword [0x00619730]
mov r12d, ebp
not eax
not r12d
and dword [rdx + 0xc], eax
and dword [rdx + 8], r12d
jmp 0x40706f
mov rcx, qword [0x00619730]
call sym.OPENSSL_ia32_cpuid
movzx r14d, word [0x0063d0a0]
mov r13, rax
jmp 0x406fb3
movzx r14d, word [0x0063d0a0]
mov r13, rax
jmp 0x406fb3
add rbx, 4
mov esi, 0x10
jmp 0x406f4a
movzx ecx, word [rbx + 2]
call sym.ossl_tolower
cmp eax, 0x78
je 0x4071dc
add rbx, 2
mov esi, 8
jmp 0x40700d
add rbx, 4
mov esi, 0x10
jmp 0x40700d
Function at 0x40e4c0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
cmp rcx, 0xffffffffffffffff
je 0x40e4d8
lea rcx, [0x0063ea94]
jmp sym.CRYPTO_THREAD_set_local
ret
Function at 0x4153b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x415410
movsx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x415400
mov edi, 0x100
xor ebx, ebx
nop
call sym.ossl_tolower
add rsi, 1
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
movsx ecx, byte [rsi]
xor ebx, eax
test cl, cl
jne 0x4153d0
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x4160e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, dword [rcx]
mov rdx, qword [rcx + 8]
mov rbx, rcx
cmp r8d, 2
je 0x4161a0
jg 0x416128
test r8d, r8d
je 0x416148
cmp r8d, 1
jne 0x416138
mov rcx, qword [rdx]
call sym.OPENSSL_LH_strhash
mov r8d, dword [rbx]
and eax, 0x3fffffff
shl r8d, 0x1e
or eax, r8d
add rsp, 0x28
pop rbx
pop rsi
ret
cmp r8d, 3
jne 0x416138
mov eax, dword [rdx + 0x10]
jmp 0x416112
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, dword [rdx + 0x14]
mov r11, qword [rdx + 0x18]
mov eax, ecx
shl eax, 0x14
test ecx, ecx
jle 0x416112
lea esi, [rcx + rcx*2]
xor r9d, r9d
mov ebx, 0xaaaaaaab
nop dword [rax + rax]
mov edx, r9d
movzx r10d, byte [r11]
mov ecx, r9d
add r9d, 3
imul rdx, rbx
add r11, 1
shr rdx, 0x24
lea edx, [rdx + rdx*2]
shl edx, 3
sub ecx, edx
shl r10d, cl
xor eax, r10d
cmp esi, r9d
jne 0x416168
jmp 0x416112
mov rcx, qword [rdx + 8]
call sym.OPENSSL_LH_strhash
mov r8d, dword [rbx]
jmp 0x416112
Function at 0x41e450
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jne 0x41e528
movzx r9d, byte [r8]
lea edx, [r9 - 0x6a]
cmp dl, 1
ja 0x41e528
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp r9b, 0x6b
je 0x41e4a8
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x41e557
mov r8d, r12d
call sym.memcpy
mov eax, r12d
add rsp, 0x30
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x41e4db
xor eax, eax
jmp 0x41e4c6
cmp r8b, 0xbb
jne 0x41e4e8
add eax, 1
cmp r12d, eax
je 0x41e520
movzx r8d, byte [rdx]
add rdx, 1
cmp r8b, 0xba
jne 0x41e4b8
sub r12d, eax
test eax, eax
jne 0x41e482
mov dword [rsp + 0x20], 0x50
jmp 0x41e4f0
mov dword [rsp + 0x20], 0x48
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov r12d, 0xffffffff
lea r9, str.crypto_rsa_rsa_x931.c
call sym.ERR_put_error
mov eax, r12d
add rsp, 0x30
pop r12
ret
xor r12d, r12d
jmp 0x41e482
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x3d
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call sym.ERR_put_error
jmp 0x41e497
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x59
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call sym.ERR_put_error
jmp 0x41e497

Function at 0x4270a0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x0063ecb4]
jmp sym.CRYPTO_THREAD_get_local

Function at 0x427f70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
mov r8d, 1
call sym.fwrite
add rsp, 0x28
ret
Function at 0x42ff30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movsxd rax, dword [r9 + 8]
mov rsi, rax
mov rdi, rdx
mov edx, eax
mov qword [rsp + 0x120], rcx
mov rbx, r8
mov qword [rsp + 0x28], rax
mov rbp, r9
call sym.bn_wexpand
test rax, rax
je 0x430131
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x28], 0x10
mov qword [rsp + 0x30], rax
mov r12, rax
ja 0x430108
mov rax, qword [rbp]
mov r10, qword [rdi]
movsxd rcx, esi
mov r11, qword [rbx]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x120]
test r10, r10
cmove r10, r12
test r11, r11
mov rax, qword [rax]
cmove r11, r12
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x430140
movsxd r9, dword [rdi + 8]
movsxd rax, dword [rdi + 0xc]
xor r8d, r8d
movsxd rbp, dword [rbx + 8]
movsxd r15, dword [rbx + 0xc]
xor ebx, ebx
mov qword [rsp + 0x48], rax
mov rax, r9
sub rcx, r9
mov rdx, r9
lea rdi, [r9 + 1]
lea r13, [r12 + r9*8]
sub rax, rbp
sub r9, r15
mov r14, rcx
neg rdx
xor ecx, ecx
mov rbp, rax
sub rdi, qword [rsp + 0x48]
add r9, 1
nop word [rax + rax]
mov rax, qword [r10 + rcx*8]
mov r15, rdx
sar r15, 0x3f
and rax, r15
add rax, rbx
mov r15, rax
lea rax, [rbp + rdx]
setb bl
sar rax, 0x3f
and rax, qword [r11 + r8*8]
movzx ebx, bl
add rax, r15
mov qword [r13 + rdx*8], rax
lea rax, [rdi + rdx]
adc rbx, 0
shr rax, 0x3f
add rcx, rax
lea rax, [r9 + rdx]
add rdx, 1
shr rax, 0x3f
add r8, rax
cmp r14, rdx
jne 0x430010
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r9d, esi
mov rdx, r12
mov rcx, rdi
call sym.bn_sub_words
mov rdx, r12
mov rcx, rdi
sub rbx, rax
mov rax, qword [rsp + 0x28]
lea r9, [r12 + rax*8]
nop dword [rax]
mov r8, qword [rcx]
mov rax, qword [rdx]
add rdx, 8
add rcx, 8
xor rax, r8
and rax, rbx
xor rax, r8
mov qword [rcx - 8], rax
mov qword [rdx - 8], 0
cmp r9, rdx
jne 0x430090
mov rax, qword [rsp + 0x120]
mov r13d, 1
mov dword [rax + 8], esi
mov dword [rax + 0x10], 0
cmp r12, qword [rsp + 0x30]
je 0x4300ec
mov r8d, 0x5a
lea rdx, str.crypto_bn_bn_mod.c
mov rcx, r12
call sym.CRYPTO_free
mov eax, r13d
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, esi
mov r8d, 0x3c
lea rdx, str.crypto_bn_bn_mod.c
lea rcx, [rax*8]
call sym.CRYPTO_malloc
mov r12, rax
test rax, rax
jne 0x42ff89
xor r13d, r13d
jmp 0x4300ec
mov r8, qword [rsp + 0x38]
mov rcx, rax
xor r9d, r9d
mov rdx, r12
call sym.bn_sub_words
jmp 0x4300b8
Function at 0x43c1a0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
sub rsp, 0x38
call sym.OPENSSL_issetugid
test eax, eax
jne 0x43c1c2
lea rcx, str.OPENSSL_CONF
call sym.getenv
test rax, rax
jne 0x43c238
call sym.X509_get_default_cert_area
mov rcx, rax
call sym.strlen
mov r8d, 0x1f0
lea rdx, str.crypto_conf_conf_mod.c
lea r12d, [rax + 0xd]
movsxd r12, r12d
mov rcx, r12
call sym.CRYPTO_malloc
mov r13, rax
test rax, rax
je 0x43c225
call sym.X509_get_default_cert_area
lea r8, str._s_s_s
mov rdx, r12
mov rcx, r13
mov r9, rax
lea rax, str.openssl.cnf
mov qword [rsp + 0x28], rax
lea rax, [0x005cfd3e]
mov qword [rsp + 0x20], rax
call sym.BIO_snprintf
mov rax, r13
add rsp, 0x38
pop r12
pop r13
ret
mov r8d, 0x1e6
lea rdx, str.crypto_conf_conf_mod.c
mov rcx, rax
add rsp, 0x38
pop r12
pop r13
jmp sym.CRYPTO_strdup
Function at 0x45ed50
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x38
mov r8d, 0x45
mov rax, qword [rcx]
mov ecx, 0x48
mov r14d, dword [rax]
mov r15, rdx
lea rdx, str.crypto_ec_ecx_meth.c
call sym.CRYPTO_zalloc
mov r13, rax
test rax, rax
je 0x45efa0
cmp r14d, 0x40a
je 0x45ee40
cmp r14d, 0x43f
je 0x45ee40
cmp r14d, 0x40b
je 0x45eed0
mov r8d, 0x4f
lea rdx, str.crypto_ec_ecx_meth.c
mov ecx, 0x39
call sym.CRYPTO_secure_malloc
mov qword [r13 + 0x40], rax
mov r12, rax
test rax, rax
je 0x45efd0
mov edx, 0x39
mov rcx, r12
call sym.RAND_priv_bytes
test eax, eax
jle 0x45ef40
cmp r14d, 0x440
je 0x45ef28
jg 0x45ee18
cmp r14d, 0x43f
jne 0x45eeb0
mov rdx, r12
mov rcx, r13
call sym.ED25519_public_from_private
nop word [rax + rax]
mov r8, r13
mov edx, r14d
mov rcx, r15
call sym.EVP_PKEY_assign
mov eax, 1
add rsp, 0x38
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0x4f
lea rdx, str.crypto_ec_ecx_meth.c
mov ecx, 0x20
call sym.CRYPTO_secure_malloc
mov qword [r13 + 0x40], rax
mov r12, rax
test rax, rax
je 0x45efd0
mov edx, 0x20
mov rcx, r12
call sym.RAND_priv_bytes
test eax, eax
jle 0x45ef40
cmp r14d, 0x40a
jne 0x45ef88
movzx eax, byte [r12 + 0x1f]
and byte [r12], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [r12 + 0x1f], al
mov rdx, r12
mov rcx, r13
call sym.X25519_public_from_private
jmp 0x45ee18
cmp r14d, 0x40a
je 0x45ee9f
cmp r14d, 0x40b
jne 0x45ee18
jmp 0x45ef13
mov r8d, 0x4f
lea rdx, str.crypto_ec_ecx_meth.c
mov ecx, 0x38
call sym.CRYPTO_secure_malloc
mov qword [r13 + 0x40], rax
mov r12, rax
test rax, rax
je 0x45efd0
mov edx, 0x38
mov rcx, r12
call sym.RAND_priv_bytes
test eax, eax
jle 0x45ef40
and byte [r12], 0xfc
or byte [r12 + 0x37], 0x80
mov rdx, r12
mov rcx, r13
call sym.X448_public_from_private
jmp 0x45ee18
mov rdx, r12
mov rcx, r13
call sym.ED448_public_from_private
jmp 0x45ee18
mov r8d, 0x56
lea rdx, str.crypto_ec_ecx_meth.c
mov rcx, r12
call sym.CRYPTO_secure_free
mov qword [r13 + 0x40], 0
mov r8d, 0x78
lea rdx, str.crypto_ec_ecx_meth.c
mov rcx, r13
call sym.CRYPTO_free
xor eax, eax
add rsp, 0x38
pop r12
pop r13
pop r14
pop r15
ret
cmp r14d, 0x40b
jne 0x45edeb
jmp 0x45ef08
mov r8d, 0x41
mov edx, 0x10a
mov ecx, 0x10
mov dword [rsp + 0x20], 0x47
lea r9, str.crypto_ec_ecx_meth.c
call sym.ERR_put_error
xor eax, eax
jmp 0x45ee2b
mov r8d, 0x41
mov edx, 0x10a
mov ecx, 0x10
mov dword [rsp + 0x20], 0x51
lea r9, str.crypto_ec_ecx_meth.c
call sym.ERR_put_error
jmp 0x45ef5d
Function at 0x460cc0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov r13, rdx
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2e
mov edx, 1
lea rcx, str._TEST_ENG_OPENSSL_RC4__test_init_key___called_n
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.EVP_CIPHER_CTX_key_length
mov rcx, r12
mov ebx, eax
call sym.EVP_CIPHER_CTX_get_cipher_data
movsxd r8, ebx
mov rdx, r13
mov rcx, rax
call sym.memcpy
mov rcx, r12
call sym.EVP_CIPHER_CTX_get_cipher_data
mov rcx, r12
mov rbx, rax
call sym.EVP_CIPHER_CTX_key_length
mov rcx, r12
mov r13d, eax
call sym.EVP_CIPHER_CTX_get_cipher_data
mov r8, rbx
mov edx, r13d
lea rcx, [rax + 0x10]
call sym.RC4_set_key
mov eax, 1
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
Function at 0x46fcd0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rcx + 0x70]
test rdx, rdx
je 0x46fe28
movzx ecx, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx]
or ecx, r9d
movzx r9d, byte [rdx + 3]
shl r9d, 0x18
or ecx, r9d
mov dword [rax], ecx
movzx ecx, byte [rdx + 5]
movzx r9d, byte [rdx + 6]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 4]
or ecx, r9d
movzx r9d, byte [rdx + 7]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 4], ecx
movzx ecx, byte [rdx + 9]
movzx r9d, byte [rdx + 0xa]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 8]
or ecx, r9d
movzx r9d, byte [rdx + 0xb]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 8], ecx
movzx ecx, byte [rdx + 0xd]
movzx r9d, byte [rdx + 0xe]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0xc]
or ecx, r9d
movzx r9d, byte [rdx + 0xf]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0xc], ecx
movzx ecx, byte [rdx + 0x11]
movzx r9d, byte [rdx + 0x12]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x10]
or ecx, r9d
movzx r9d, byte [rdx + 0x13]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x10], ecx
movzx ecx, byte [rdx + 0x15]
movzx r9d, byte [rdx + 0x16]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x14]
or ecx, r9d
movzx r9d, byte [rdx + 0x17]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x14], ecx
movzx ecx, byte [rdx + 0x19]
movzx r9d, byte [rdx + 0x1a]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x18]
or ecx, r9d
movzx r9d, byte [rdx + 0x1b]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x18], ecx
movzx ecx, byte [rdx + 0x1d]
movzx r9d, byte [rdx + 0x1e]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x1c]
movzx edx, byte [rdx + 0x1f]
or ecx, r9d
shl edx, 0x18
or edx, ecx
mov dword [rax + 0x1c], edx
test r8, r8
je 0x46fec8
movzx edx, byte [r8 + 2]
movzx ecx, byte [r8 + 1]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8]
or edx, ecx
movzx ecx, byte [r8 + 3]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x20], edx
movzx edx, byte [r8 + 6]
movzx ecx, byte [r8 + 5]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 4]
or edx, ecx
movzx ecx, byte [r8 + 7]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x24], edx
movzx edx, byte [r8 + 0xa]
movzx ecx, byte [r8 + 9]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 8]
or edx, ecx
movzx ecx, byte [r8 + 0xb]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x28], edx
movzx edx, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xe]
shl edx, 8
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [r8 + 0xc]
or edx, ecx
movzx ecx, byte [r8 + 0xf]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x2c], edx
mov dword [rax + 0x70], 0
mov eax, 1
ret
Function at 0x479960
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA256_Init

Function at 0x479a60
Capabilities:
Hash data using sha384

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA384_Init

Function at 0x479a80
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.SHA512_Init
Function at 0x481230
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp sym.md4_block_data_order

Function at 0x481750
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x120], r8
mov r13, rcx
mov r14, rdx
test r8, r8
je 0x48186b
lea rax, [rsp + 0x30]
movzx edx, byte [rcx + 0xc]
lea rbp, [rcx + 0xc]
xor r12d, r12d
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
movzx r8d, byte [rcx + 0x14]
lea rdi, [rcx + 0x14]
mov qword [rsp + 0x28], rax
lea rsi, [rsp + 0x40]
nop word [rax + rax]
and edx, 0xffffff9f
and r8d, 0xffffff9f
mov ebx, dword [r14 + r12]
mov r15d, dword [r14 + r12 + 4]
or r8d, 0x20
or edx, 0x40
mov rcx, rbp
add r12, 8
mov byte [r13 + 0x14], r8b
mov byte [r13 + 0xc], dl
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x3c], r15d
mov dword [rsp + 0x34], r15d
call sym.DES_set_odd_parity
mov rdx, rsi
mov rcx, rbp
call sym.DES_set_key_unchecked
mov rcx, qword [rsp + 0x20]
mov r8d, 1
mov rdx, rsi
call sym.DES_encrypt1
mov rcx, rdi
call sym.DES_set_odd_parity
mov rdx, rsi
mov rcx, rdi
call sym.DES_set_key_unchecked
mov rcx, qword [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
call sym.DES_encrypt1
mov ecx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
xor ecx, ebx
xor r8d, r15d
xor ebx, dword [rsp + 0x30]
xor r15d, dword [rsp + 0x34]
mov dword [r13 + 0x10], r8d
mov edx, ebx
mov r8d, ecx
mov dword [r13 + 0xc], ebx
mov dword [r13 + 0x14], ecx
mov dword [r13 + 0x18], r15d
cmp qword [rsp + 0x120], r12
ja 0x4817b0
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret